Below is one real production Rails Gemfile.lock — 344 dependencies, not edited between the two runs.
Only the shipping model changed.
Internal use, or hosted SaaS
0 dependencies
Nothing here obliges you to put your own code under someone else's license.
Delivered binary, or on-premise install
3 dependencies
Each one obliges the work you deliver, as a whole, to carry the same copyleft licence — with source.
diff-lcs arrives through RSpec. rdoc ships inside Ruby itself. Nobody chose either of them,
and they are three lines out of 344. Ship the same tree and the count of dependencies demanding your whole work
under their licence goes from none to three. That is what this checks — not which licences are present,
but which ones your delivery method actually triggers.
Paste a manifest. No signup, no account. Tell it how you ship first — that is the input that decides the answer.
The same license produces different obligations for each of these. Most scanners ignore the distinction.
Paste a lockfile if you have one. It covers transitive dependencies — where problematic licenses usually arrive — and carries exact versions. npm, PyPI, Go, and Rust are supported. What you paste is not stored. Names that resolve to a public-registry license are cached as name → license, with no record of who asked; names that do not resolve — which is what an internal package looks like — are never written.
Want this as an audit-ready PDF — the kind of thing due diligence and procurement ask for?
This does not exist yet. I am working out whether it is worth building, and the honest way to find out is to ask. Leave an address and I will tell you when it ships — and ask what you would actually need from it. No list, no marketing.
AGPL-3.0 is the clearest case. Its section 13 obligation attaches when users interact with the software over a network, so a hosted SaaS triggers it while purely internal use does not. GPL works the opposite way: its obligations attach to distribution, so hosting is fine and shipping a binary is not. A scanner that reports "AGPL detected" without knowing which of these you are doing is telling you almost nothing.
The same applies to build-time dependencies. A tool that never ends up in your artifact cannot impose distribution obligations on it, yet most scanners warn about them anyway — which is how teams learn to ignore the warnings.
AGPL-3.0-only section 13 requires that users interacting with a modified version over a network be offered the corresponding source of the whole work. Your distribution model is hosted SaaS, which triggers that obligation. This is the clause that makes AGPL behave differently from GPL for hosted services.
GPL-3.0-only triggers its obligations on distribution. Your distribution model is hosted SaaS, which is not distribution, so no obligation arises today. Shipping this software later — on-premises delivery, a binary, or a published library — would trigger whole-work source disclosure.
GPL-3.0-only appears as a dev dependency, so it is not part of the artifact you ship. Distribution-triggered obligations do not arise. Tools that emit code into your output, such as code generators, are a separate case worth checking individually.
MIT requires retaining the copyright notice and the license text. There is no source-disclosure obligation.
License obligations attach to events, not to code. The GPL attaches to distribution, so hosting triggers nothing and shipping a binary does. The AGPL adds an obligation that attaches to network interaction, so hosting triggers it. Until you say how the software reaches its users, no license name has a single correct answer.
License data last reviewed .
LicenseGuard reports information derived from published license texts and dependency manifests. It is not legal advice and using it does not create an attorney-client relationship. Results reflect license metadata as declared; they do not identify every obligation or violation. Consult qualified counsel for decisions that matter.
Listed in the official MCP registry, on Glama and on Smithery. Source on GitHub (Apache-2.0).