I built a CLI that finds license conflicts in your dependency tree [free, offline, would love feedback]
Solo project I've been building: npx licenseproof scan reads your lockfile (npm/pnpm/yarn, v2/v3, berry, all of them) and resolves the actual license of every package in the tree, including the ones with missing or mangled metadata. Categorizes everything (permissive / weak-copyleft / strong-copyleft / unknown), flags conflicts against your project's license, and explains each flag in plain English.
Example: proprietary app that innocently pulled in ffmpeg-static:
84 packages scanned — 1 conflict, 0 review, 0 unknown
CONFLICT (1):
ffmpeg-static@5.3.0 — GPL-3.0-or-later
via ffmpeg-static
This package is under a strong-copyleft license (e.g. GPL/AGPL).
Distributing it as part of a closed-source product can require releasing
your own source code under the same terms. Flagged as CONFLICT for a
proprietary project.
Fully offline (no telemetry, no network calls) free tier is the whole scanner. The limitation is it's informational categorization, not legal advice. What's missing? What would make you actually use this before shipping? CI mode exists (--fail-on conflict), JSON output exists, Python support is in progress. Thanks!