Answers · vibe coding
How do I check if AI-generated code copied open-source code?
Last updated
TL;DR: Use the matching feature your assistant has, and scan the code yourself before you ship. GitHub Copilot can block suggestions that match public code on GitHub, or show you the matching repos and their licenses (it compares a suggestion plus about 150 characters of surrounding code). Amazon Q Developer logs accepted suggestions that resemble open-source code, with the license, in a code reference log. Many other assistants show nothing, so run a snippet scanner such as SCANOSS over the repo: it finds files and fragments that match known open-source code and reports their licenses. When you find a match, read that project's license: permissive code needs its notice kept, copyleft code may oblige you to release your source, and you can always rewrite or remove it.
What should I check, step by step?
1. Copilot: in Copilot settings on GitHub, set Suggestions matching public code to Block (individual plans), or ask your org admin (Business and Enterprise seats inherit the org policy). If you set Allow, open the code references for matches before accepting.
- Amazon Q Developer: keep Show Code With References on and check the code reference log, which lists the license and the referenced source for each accepted suggestion.
- For any other tool, or for agent-written code, scan before release: scanoss-py scan -o scan-output.json . flags full-file and snippet matches with the matched component and license.
- Treat each match by license: MIT, BSD, ISC, Apache-2.0 means keep the copyright and license notice (and Apache's NOTICE); GPL, LGPL, AGPL or MPL means check whether its source duties fit your product; no license found means you have no permission to copy it.
- Fix or document: add the attribution, isolate the code under its license, or have it rewritten from a description of what it does, not from the matched code.
- Re-scan in CI on each release, since agents keep writing code after the first check.
- Keep the scan output with the release; it shows what you checked and when.
What Copilot's public-code check covers, and what it doesn't
GitHub's docs say the check compares a suggestion and about 150 characters of surrounding code against an index of public code on GitHub.com. The index doesn't include private repos or code hosted outside GitHub, and it's refreshed periodically, so it can miss new code.
- For inline suggestions, Copilot only checks accepted, unchanged suggestions. GitHub says matches typically occur in less than one percent of inline suggestions.
- On GitHub, chat responses can show a reference beneath the output, and Copilot cloud agent session logs link to details when a delegated task generated matching code.
- It finds near-verbatim text, not code that does the same thing in a different way. Absence of a match is not proof the code is original.
Does turning the filter on change indemnity?
Not since April 3, 2026. Microsoft's Customer Copyright Commitment page says GitHub offerings have no additional required mitigations and the Duplicate Detection filter is no longer required for coverage. It remains available to use.
- Older advice (and GitHub's 2024 Copilot terms) said the filter had to be set to Blocked to keep GitHub's defense obligations. Those Copilot Product Specific Terms were deprecated on March 5, 2026 for new subscriptions and renewals. Check which terms your plan is on.
How snippet scanners work
SCANOSS fingerprints each file locally (winnowing hashes of overlapping code fragments) and sends the fingerprints, not the source, to its knowledge base, which returns full-file or snippet matches with component, license and line ranges.
- The default public API needs no key. The fingerprint file includes your file paths, so review it if paths are sensitive. SCANOSS also documents an offline fingerprint-then-scan flow.
- ScanCode Toolkit is a different job: it detects license texts, notices and copyrights already present in your files and dependencies. Use it to find licenses you already pulled in, and a snippet scanner to find copied code with no notice.
What do the license checks say?
Yes means the license grants the use, on the duties listed. Duties such as source_disclosure, share_alike and network_source_offer are the ones that conflict with keeping a product closed-source.
| Use | Answer | Why |
|---|---|---|
| A matched MIT snippet, edited, in an app you sell (MIT) | Yes | Every use you described is granted by MIT, and nothing you described is prohibited. Duties: attribution, license_notice. |
| A matched GPL-3.0 snippet, edited, in an app you sell (GPL-3.0-only) | Yes | Every use you described is granted by GPL 3.0, and nothing you described is prohibited. Duties: attribution, license_notice, state_changes, share_alike, source_disclosure. |
How do I ask Rightshold about this (free, no key)?
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “My scanner says this function matches code in a GitHub repo. What license does that repo declare, and can I keep the code in a commercial closed-source app?”
{
"tool": "check_license",
"arguments": {
"source_url": "https://github.com/expressjs/express",
"intended_use": {
"commercial_use": true,
"modification": true,
"redistribution": true
}
}
}- Free, no key. Pass the matched repo's GitHub page (or its npm or PyPI page) as source_url; Rightshold reads the license it declares and returns the verdict and the duties for your use. No license found answers needs_review, which means you have no grant to rely on.
- attribution_string writes the credit line a license asks for once you decide to keep the code.
- check_rights_batch checks up to 100 matched sources at once.
Rightshold doesn't scan your code or detect copying. It reads the license the matched project declares and tells you what that license allows and requires. Use a matching tool (your assistant's or a snippet scanner) to find matches first.
What are the sources?
- GitHub Docs: References to matching public code
- GitHub Docs: Managing Copilot policies as an individual subscriber (block or allow matching public code)
- Microsoft: Customer Copyright Commitment required mitigations (GitHub offerings, April 3, 2026)
- GitHub: Copilot Product Specific Terms (deprecated March 5, 2026)
- AWS: Amazon Q Developer, Using code references
- SCANOSS docs: How scanning works (fingerprints, not files)
- SCANOSS docs: Scanning a file or directory (full vs snippet matches)
- SCANOSS docs: Fingerprint-only scanning
- scanoss-py (default API needs no key)
- ScanCode Toolkit
Related
- Who owns code written by an AI coding agent?
- Can I use code from GitHub in my product?
- Can I use GPL code in proprietary software?
- How to stop an AI coding agent from installing hallucinated packages
Not legal advice. JSON · Markdown · All answers
Get a free API key in one call
No card and no email needed. 100 free credits; the license and policy checks stay free without a key.
curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_... # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
-H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'