license-checkr — License compliance for every ecosystem

Features

Everything you need for license compliance

From a quick local check to a full CI enforcement pipeline.

🔎

Zero-config Detection

Drop license-checkr into any project. It automatically detects your ecosystem from manifest files and starts scanning — no setup required.

📡

Online Registry Enrichment

Missing license data? Use --online to fetch it in parallel from crates.io, PyPI, Maven Central, and npm. Batched for speed.

⚖️

Flexible Policy Engine

Define pass, warn, and error rules per SPDX identifier in a simple TOML file. Sensible defaults are built in.

🏷️

Full SPDX Support

Normalizes 20+ common strings to SPDX identifiers. Parses compound expressions like (Apache-2.0 OR MIT) AND BSD-3-Clause with correct precedence — AND binds tighter than OR, parentheses override.

📊

Four Output Formats

Colored terminal table for local development, structured JSON for pipelines, a polished multi-page PDF for your legal team, or a GitLab Code Quality artifact that surfaces violations inline on every Merge Request.

🦊

GitLab CI Integration

Use --report gitlab to emit a Code Quality JSON artifact. Violations appear as inline annotations on Merge Requests — no extra tooling required.

🗂️

Workspace Scanning

Use --recursive to scan every sub-project in a monorepo in one pass. Each project is scanned independently with its own policy; the PDF includes per-project sections.

🤖

MCP Server

Run license-checkr mcp serve to expose the scanner as an MCP tool. AI agents like Claude Desktop can audit projects and look up package licenses directly.

See it in action

Scan in seconds, act immediately

One command gives you a complete picture of your license exposure.

license-checkr

❯ license-checkr --recursive --online Root: /home/user/monorepo Found: 3 sub-projects → scanning backend (/home/user/monorepo/backend) · Rust 42 dependencies → scanning frontend (/home/user/monorepo/frontend) · Node 87 dependencies → scanning analytics (/home/user/monorepo/analytics) · Python 23 dependencies ┌──────────────────────────────────────────────────────┐ │ WORKSPACE SUMMARY │ │ Projects : 3 │ │ Total dependencies : 152 │ │ ✓ Pass : 138 MIT (82), Apache-2.0 (41)│ │ ⚠ Warn : 11 unknown (8), LGPL-2.1 (3)│ │ ✗ Error : 3 GPL-3.0 (3) │ └──────────────────────────────────────────────────────┘

Policy engine

Your rules.
Your project.

Drop a .license-checkr/config.toml at your project root and define exactly which licenses are acceptable, which need review, and which are blocked.

No config file? Built-in defaults are already sensible — permissive licenses pass, weak-copyleft warns, and GPL/AGPL are errors.

Per-license rules keyed by SPDX identifier
A catch-all default for anything unlisted
Project-level or global ~/.config config
Override at runtime via --config <path>

.license-checkr/config.toml

# Verdict for any license not listed below
[policy]
default = "warn"

[policy.licenses]
# Permissive — always allowed
"MIT"          = "pass"
"Apache-2.0"   = "pass"
"BSD-3-Clause" = "pass"
"ISC"          = "pass"
"Unlicense"    = "pass"

# Weak copyleft — review required
"LGPL-2.1"     = "warn"
"MPL-2.0"      = "warn"

# Strong copyleft — blocked
"GPL-3.0"      = "error"
"AGPL-3.0"     = "error"

License risk levels

Understand your exposure at a glance

Every dependency is classified into one of five risk levels.

Risk level	What it means	Examples
✅ Permissive	Minimal restrictions — use freely in any project, commercial or otherwise.	MIT, Apache-2.0, BSD-3-Clause, ISC, Unlicense, CC0-1.0
⚠️ Weak Copyleft	Share-alike applies only to modifications of the library itself.	LGPL-2.1, LGPL-3.0, MPL-2.0, EPL-2.0, CDDL-1.0
🔴 Strong Copyleft	Your project may need to be released as open source if you use this.	GPL-2.0, GPL-3.0, AGPL-3.0, EUPL-1.1
🔒 Proprietary	Source is closed; a commercial agreement is required for use.	"proprietary", "commercial", "All rights reserved"
❓ Unknown	License could not be determined. Use `--online` to try to resolve it.	Missing, empty, or unrecognized strings

How it works

Three steps to compliance

Install

A single static binary with no runtime dependencies. Install globally or drop into your CI environment.

cargo install --git https://github.com/QuentinRob/license-checkr

Scan

Run at the root of any project. Ecosystems are detected automatically. Add --online to resolve missing licenses.

license-checkr --online

Enforce

Plug into your CI pipeline. Exits 1 on policy violations — blocking merges before problematic licenses sneak in.

license-checkr -q

GitLab CI

License violations
inline on every MR.

Use --report gitlab to produce a GitLab Code Quality JSON artifact. Upload it as a CI artifact and violations appear as inline annotations on every Merge Request — no extra tools or plugins required.

blocker severity for error policy verdicts
minor severity for warn policy verdicts
pass dependencies are silently omitted
Works with --recursive for monorepo workspaces

.gitlab-ci.yml

license-check:
  stage: test
  image: rust:latest
  script:
    - cargo install --git https://github.com/QuentinRob/license-checkr
    - license-checkr --report gitlab > gl-code-quality-report.json
  artifacts:
    reports:
      codequality: gl-code-quality-report.json

Example output

[
  {
    "description": "Dependency 'some-gpl-lib@2.1.0'
    uses license 'GPL-3.0' — verdict: error",
    "check_name": "license-checkr/license-error",
    "severity": "blocker",
    "location": { "path": "Cargo.lock", "lines": {"begin": 1} }
  }
]

MCP server

Talk to your AI.
Let it check licenses.

Start license-checkr mcp serve and connect it to any MCP-compatible AI agent. Claude Desktop, Cursor, and other tools can then audit your projects and look up package licenses on demand.

Two tools are exposed over stdio JSON-RPC — no extra config needed.

scan_licenses — full project scan with policy evaluation
get_package_license — single-package registry lookup
Works with Claude Desktop, Cursor, and any MCP client
Reuses the same pipeline as the CLI — consistent results

claude_desktop_config.json

{
  "mcpServers": {
    "license-checkr": {
      "command": "license-checkr",
      "args": ["mcp", "serve"]
    }
  }
}

Example prompts

"Scan ~/my-app and list any license errors"

"What license does serde 1.0 use? Is it compatible?"

Know every license
in your project

Everything you need for license compliance

Zero-config Detection

Online Registry Enrichment

Flexible Policy Engine

Full SPDX Support

Four Output Formats

GitLab CI Integration

Workspace Scanning

MCP Server

Your whole stack, covered

Scan in seconds, act immediately

Your rules.
Your project.

Understand your exposure at a glance

Three steps to compliance

Install

Scan

Enforce

License violations
inline on every MR.

Talk to your AI.
Let it check licenses.

Start in 30 seconds

Know every licensein your project

Everything you need for license compliance

Zero-config Detection

Online Registry Enrichment

Flexible Policy Engine

Full SPDX Support

Four Output Formats

GitLab CI Integration

Workspace Scanning

MCP Server

Your whole stack, covered

Scan in seconds, act immediately

Your rules.Your project.

Understand your exposure at a glance

Three steps to compliance

Install

Scan

Enforce

License violationsinline on every MR.

Talk to your AI.Let it check licenses.

Start in 30 seconds

Know every license
in your project

Your rules.
Your project.

License violations
inline on every MR.

Talk to your AI.
Let it check licenses.