Composer License & Copyleft Checker
Screen PHP dependency graphs for GPL, AGPL, OSL, LGPL, and MPL signals. Exact lockfile analysis, transparent scope notes, and no automatic legal conclusions.
Composer License Metadata vs. Dependency Reality: 10,000 Packages Screened
A package license only covers its author's code. Read how 320 packages pulled transitive copyleft code, including PayPal's server SDK and WPForms Lite.
Read the Full Investigation →Frequently Asked Questions
Why can an MIT package still need a license review?
The MIT declaration normally covers the package author's own code. Dependencies retain their own licenses, so distribution, linking, notices, and derivative-work questions must be checked separately.
What is the difference between GPL and OSL-3.0?
OSL-3.0 includes an External Deployment condition for the Original Work or a Derivative Work. Whether a particular integration is a derivative work is context-specific and cannot be decided from a dependency edge alone.
Is using an LGPL library like HTMLPurifier permitted in proprietary PHP code?
Often, but the answer depends on the LGPL version and how the library is combined and distributed. Preserve notices and verify replacement, relinking, and source-offer requirements for the exact release.
Can AI coding assistants detect these license conflicts automatically?
AI can identify dependency and metadata signals, but it cannot replace source inspection or legal analysis. This tool supplies evidence paths and explicit uncertainty for a human review.