Paste a manifest. No signup. The answer depends on how you ship your software, so tell it that first.
The same license produces different obligations for each of these. Most scanners ignore the distinction.
Paste a package-lock.json if you have one. It covers transitive dependencies — where problematic licenses usually arrive — and carries exact versions. Pasted content is used to look up licenses and is not stored.
Want this as an audit-ready PDF — the kind of thing due diligence and procurement ask for?
This does not exist yet. I am working out whether it is worth building, and the honest way to find out is to ask. Leave an address and I will tell you when it ships — and ask what you would actually need from it. No list, no marketing.
AGPL-3.0 is the clearest case. Its section 13 obligation attaches when users interact with the software over a network, so a hosted SaaS triggers it while purely internal use does not. GPL works the opposite way: its obligations attach to distribution, so hosting is fine and shipping a binary is not. A scanner that reports "AGPL detected" without knowing which of these you are doing is telling you almost nothing.
The same applies to build-time dependencies. A tool that never ends up in your artifact cannot impose distribution obligations on it, yet most scanners warn about them anyway — which is how teams learn to ignore the warnings.
LicenseGuard reports information derived from published license texts and dependency manifests. It is not legal advice and using it does not create an attorney-client relationship. Results reflect license metadata as declared; they do not identify every obligation or violation. Consult qualified counsel for decisions that matter.