/license-compliance

name: license-compliance
description: >
  Audits Dart and Flutter package dependency licenses using the Very Good CLI
  packages_check_licenses MCP tool, flags non-compliant or unknown licenses, and produces a
  compliance summary report. Use when the user says "check licenses", "license audit", "check
  dependency licenses", "license compliance", "review package licenses", "are our dependencies
  compliant", "scan for license issues", or "pre-release license check". Use it especially
  when the request asks for a compliance verdict without a scan, as in "read the licenses off
  this pubspec", "confirm we're compliant", "just tell me if these packages are safe to ship",
  "I'd rather not run anything", or "which of these are GPL", because refusing to certify
  compliance from a dependency list is the call this skill governs. A pasted pubspec is a
  trigger, not a substitute for the audit.
argument-hint: "[project-directory]"
allowed-tools: Read Glob Grep mcp__very-good-cli__packages_check_licenses
effort: medium

License Compliance

Dependency license auditor for Dart and Flutter projects — verifies that all package dependencies use licenses compatible with the project's requirements using the Very Good CLI MCP tools.

> **Cross-harness fallback.** On Claude Code the `packages_check_licenses` MCP tool is the execution path. On a host without this plugin's Bash hooks and without the Very Good CLI MCP server connected, run `very_good packages check licenses <project-directory>` directly (the target path is positional and defaults to `.`; add `--dependency-type direct-main,transitive` so transitive obligations are covered) and read its output the same way — never block on a missing MCP server.

---

Core Standards

Apply these standards to all license compliance work:

• **Run `packages_check_licenses` MCP tool** on the target project directory with `licenses: true` to display full license information
• **Pass `directory` to the MCP tool when the project is not at the workspace root** — monorepos with the project in a subdirectory (e.g. `mobile/`) require `directory: 'mobile'`
• **A missing license is not "no license"** — it means "all rights reserved" by default; always flag
• **Transitive dependencies matter** — a permissive package that depends on a GPL package still carries the GPL obligation
• **Only scan output can certify compliance** — never conclude that a project is compliant, clear, or safe to ship from a pubspec dependency list, a package name, a remembered license, or a previous audit. Scan output the user pastes or attaches counts as scan output: take it at face value, audit it, and do not re-run it or question its provenance. The distinction is whether each package arrives with a license attached, not who produced the text
• **Flag for manual review when in doubt** — never assume compliance without a clear license identifier
• **Deliver the report in the prescribed format** — when scan output exists, the answer is the template in [Report Findings](#3-report-findings): the `## License Compliance Report` heading, the summary counts including the total scanned, the flagged table with a risk level and a recommendation per row, and the ranked recommendations. A prose write-up or a bulleted list of packages is not the deliverable, however complete its content

---

License Categories

| Category | Licenses | Risk | Guidance | | --- | --- | --- | --- | | **Permissive** | MIT, BSD-2-Clause, BSD-3-Clause, Apache-2.0 | Low | Safe for any use | | **Weak copyleft** | LGPL-2.1, LGPL-3.0, MPL-2.0 | Medium | Safe for dynamic linking; flag for static linking or modification | | **Strong copyleft** | GPL-2.0, GPL-3.0, AGPL-3.0 | High | May require the entire project to adopt the same license | | **Unknown/Missing** | None detected | High | Flag immediately for manual review |

---

Audit Process

1. Run License Check

Call the `packages_check_licenses` MCP tool on the target project directory. When the project lives in a subdirectory of the workspace (e.g. `mobile/` in a monorepo), pass that path via the `directory` parameter.

2. Categorize Results

Classify each dependency license using the categories above. Pay attention to:

• Direct dependencies with strong copyleft licenses
• Transitive dependencies that introduce copyleft obligations
• Packages with no license or an unrecognized license identifier

3. Report Findings

Write the report from whatever scan output you have, including output the user pasted into the request. That text is the input to this step, not something to verify first. Report what it says, flag what it flags, and note as its own line that transitive dependencies outside the scanned set are not covered — a caveat inside the report, never a reason to withhold the report.

The report below is a fixed format, not an illustration. Copy the four headings verbatim, keep the `- Total dependencies scanned: N` line even when nothing is flagged, and keep all four table columns including `Recommendation` as its own column. A reader attaches this to a release ticket and diffs it against the previous audit, which only works when every run has the same shape.

## License Compliance Report

### Summary
- Total dependencies scanned: N
- Compliant: N
- Flagged: N

### Flagged Dependencies
| Package | License | Risk | Recommendation |
| --- | --- | --- | --- |
| package_name | GPL-3.0 | High | Replace or obtain exception |

### Compliant Dependencies
All other dependencies use permissive licenses (MIT, BSD, Apache 2.0).

### Recommendations
1. [Most urgent action]
2. [Next action]

One row per flagged package, one recommendation per row.

---

When the Request Is to Skip the Scan

This section applies to one situation only: the request supplies package **names** with no licenses attached, usually a pubspec `dependencies` block, and asks for a verdict anyway. If each package arrives with a license beside it, that is scan output and the an