Loading page
About this tool
Review license metadata declared in a local package.json or package-lock.json, including missing fields and cautious text-based review cues.
The Dependency License Scanner reads the license strings already written into a package.json or package-lock.json and sorts every package into four buckets: declared, review cue, unresolved declaration, and missing field. It flags text matches for AGPL, GPL/LGPL/EUPL/MPL, SSPL/BUSL/Commons Clause/PolyForm/Elastic, non-commercial wording, and UNLICENSED so you know which entries need a human to look at them. It is for engineers preparing an open-source review who need a first-pass inventory of what their lockfile actually declares — not a legal opinion.
Open Dependency License Scanner on AltFTool — it loads instantly in your browser.
Paste your manifest into JSON source, or use Choose JSON to load a .json file within the 2,000,000-character limit.
Press Review declared licenses to bucket each package as Declared text, Review cue, Unresolved declaration or Missing field.
Filter the findings by status, then use Download local JSON to save dependency-license-declared-metadata-report.json.
Separates declared text, review cues, unresolved values and missing fields instead of pretending a string match is a compliance verdict.
Parses npm lockfileVersion inventories up to 2,000,000 characters and 12,000 components, deduplicating packages and recording every path an entry appears at.
Downloads a structured JSON report with per-package declared licence, version, scope, occurrence count and the limitations that apply to it.
No — it reports what the JSON declares and flags text patterns worth reviewing, and it explicitly is not SPDX validation, a compatibility decision, or legal advice. Use the output as an inventory to bring to whoever handles licensing at your organisation.
Five cue groups: AGPL as network copyleft; GPL, LGPL, EUPL and MPL as copyleft; SSPL, BUSL, Commons Clause, PolyForm and Elastic License as source-available or additional-terms; non-commercial wording such as CC-BY-NC; and UNLICENSED or 'SEE LICENSE IN' as package-specific declarations.
It means that package's entry in your JSON has no license value — it does not prove the package is unlicensed. Check the package's distributed LICENSE files and its authoritative registry metadata before drawing any conclusion.
Up to 2,000,000 bytes per file and 12,000 components, with dependency nesting followed to 40 levels. If input is truncated or anything is skipped the report is marked incomplete and lists the warnings.