Answers · npm licenses

How do I check the licenses of all my npm dependencies before shipping?

Short answer: Generate the full list of packages you ship, including transitive ones, group it by license, and look closely at anything copyleft (GPL, AGPL, LGPL), non-commercial, source-available, unknown or missing. npm 10 can write that list for you with npm sbom; each package's declared license is in its package.json. Permissive licenses (MIT, ISC, BSD, Apache-2.0) only ask you to keep their notices, while a package with no license grants you no permission at all.

Checklist

1. Install from the lockfile (npm ci) so you check exactly what you ship.
2. List production packages with their licenses: npm sbom --sbom-format spdx --omit dev > sbom.spdx.json (or npm ls --all --omit dev for the tree).
3. Group by license and flag: GPL, AGPL and LGPL; CC BY-NC and other non-commercial terms; BUSL, Elastic and SSPL; UNLICENSED, "SEE LICENSE IN" and missing licenses.
4. Read SPDX expressions carefully: "MIT OR Apache-2.0" lets you choose one; "MIT AND CC-BY-4.0" means both apply.
5. Open the LICENSE file of every flagged package: declared metadata can be wrong or differ from the file.
6. Check what your bundler actually pulls into the shipped output; a package listed as a dev dependency can still end up in it.
7. Collect the notices permissive licenses require into a third-party notices file, and re-run the check in CI whenever the lockfile changes.

License checks (computed)

Yes means the license grants the use, on the duties listed. Duties such as source_disclosure, share_alike and network_source_offer are the ones that conflict with keeping a product closed-source.

Ask Rightshold (free, no key)

Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Is every npm package in this project OK for a commercial app?”

One-click setup

{
  "tool": "check_rights_batch",
  "arguments": {
    "intended_use": {
      "commercial_use": true,
      "redistribution": true
    },
    "items": [
      {
        "ref": "react",
        "license": "MIT"
      },
      {
        "ref": "some-lgpl-lib",
        "license": "LGPL-3.0-only"
      }
    ]
  }
}

• No editor? Run curl -fsSL https://www.rightshold.com/check.mjs | node - in your project folder. It checks the direct dependencies in package.json and sends only license ids, never your code or file names.
• license_compatibility checks whether the licenses can be combined in one product and which duties apply together.

Sources

• npm sbom
• npm ls
• package.json license field
• SPDX license expressions

Related

• How do I check the license of one npm or PyPI package?
• Can I use an npm package in a commercial product?
• MIT, GPL or AGPL code in a closed-source SaaS

Not legal advice. Updated 2026-10-28. JSON · Markdown · All answers

curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_...   # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
  -H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'