Check one dependency for license obligations
check_dependency_licenseAssess a dependency's license against your distribution model to determine if it imposes a source-disclosure obligation. Use before adding dependencies or during audits.
Instructions
Determine whether adding or keeping a single open source dependency creates a legal obligation, given how this project ships. Call this BEFORE adding a new dependency to a project, and when auditing an existing one. A permissive result means no source-disclosure duty; a blocked result means the license obligates you and the dependency should be replaced or the shipping model reconsidered.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Package name as written in the manifest, e.g. "express", "requests", "github.com/gin-gonic/gin", or "serde". | |
| scope | No | Where the dependency sits. Use "dev", "build", or "test" for anything that does not end up in the shipped artifact — those carry no distribution obligation. Defaults to "runtime". | |
| version | No | Exact version if known. Omit to use the latest published version, which may differ from what is installed. | |
| ecosystem | Yes | Package registry the dependency comes from. | |
| distribution_model | Yes | How the software incorporating this dependency reaches its users. This determines the answer: "saas" = users reach it over a network; "distributed-binary" = shipped as an app or binary; "on-prem-delivery" = installed in a customer environment; "internal-only" = never leaves your organization; "library-published" = released for others to depend on. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| license | Yes | ||
| verdict | Yes | ||
| rationale | Yes | ||
| reference | No | ||
| obligations | Yes |