# How do I check the licenses of all my npm dependencies before shipping?

**Short answer:** Generate the full list of packages you ship, including transitive ones, group it by license, and look closely at anything copyleft (GPL, AGPL, LGPL), non-commercial, source-available, unknown or missing. npm 10 can write that list for you with npm sbom; each package's declared license is in its package.json. Permissive licenses (MIT, ISC, BSD, Apache-2.0) only ask you to keep their notices, while a package with no license grants you no permission at all.

## Checklist
1. Install from the lockfile (npm ci) so you check exactly what you ship.
2. List production packages with their licenses: npm sbom --sbom-format spdx --omit dev > sbom.spdx.json (or npm ls --all --omit dev for the tree).
3. Group by license and flag: GPL, AGPL and LGPL; CC BY-NC and other non-commercial terms; BUSL, Elastic and SSPL; UNLICENSED, "SEE LICENSE IN" and missing licenses.
4. Read SPDX expressions carefully: "MIT OR Apache-2.0" lets you choose one; "MIT AND CC-BY-4.0" means both apply.
5. Open the LICENSE file of every flagged package: declared metadata can be wrong or differ from the file.
6. Check what your bundler actually pulls into the shipped output; a package listed as a dev dependency can still end up in it.
7. Collect the notices permissive licenses require into a third-party notices file, and re-run the check in CI whenever the lockfile changes.

## License checks (computed)
Yes means the license grants the use, on the duties listed. Duties such as source_disclosure, share_alike and network_source_offer are the ones that conflict with keeping a product closed-source.

- **An MIT package shipped in an app you sell: Yes.** [MIT License](https://opensource.org/license/mit) (`MIT`) Duties: attribution, license_notice. Every use you described is granted by MIT, and nothing you described is prohibited.
- **An LGPL-3.0 package shipped in an app you sell: Yes.** [GNU Lesser General Public License v3.0](https://www.gnu.org/licenses/lgpl-3.0.html) (`LGPL-3.0-only`) Duties: attribution, license_notice, share_alike, source_disclosure. Every use you described is granted by LGPL 3.0, and nothing you described is prohibited.
- **A GPL-3.0 package, modified and shipped in an app you sell: Yes.** [GNU General Public License v3.0](https://www.gnu.org/licenses/gpl-3.0.html) (`GPL-3.0-only`) Duties: attribution, license_notice, state_changes, share_alike, source_disclosure. Every use you described is granted by GPL 3.0, and nothing you described is prohibited.

## Ask Rightshold (free, no key)
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code (one-click setup: https://www.rightshold.com/start?ref=seo), then ask: "Is every npm package in this project OK for a commercial app?"

```json
{
  "tool": "check_rights_batch",
  "arguments": {
    "intended_use": {
      "commercial_use": true,
      "redistribution": true
    },
    "items": [
      {
        "ref": "react",
        "license": "MIT"
      },
      {
        "ref": "some-lgpl-lib",
        "license": "LGPL-3.0-only"
      }
    ]
  }
}
```
- No editor? Run curl -fsSL https://www.rightshold.com/check.mjs | node - in your project folder. It checks the direct dependencies in package.json and sends only license ids, never your code or file names.
- license_compatibility checks whether the licenses can be combined in one product and which duties apply together.

## Sources
- [npm sbom](https://docs.npmjs.com/cli/v10/commands/npm-sbom)
- [npm ls](https://docs.npmjs.com/cli/v10/commands/npm-ls)
- [package.json license field](https://docs.npmjs.com/cli/v10/configuring-npm/package-json#license)
- [SPDX license expressions](https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/)

## Related
- [How do I check the license of one npm or PyPI package?](https://www.rightshold.com/answers/how-to-check-an-npm-or-pypi-package-license)
- [Can I use an npm package in a commercial product?](https://www.rightshold.com/answers/can-i-use-an-npm-package-in-a-commercial-product)
- [MIT, GPL or AGPL code in a closed-source SaaS](https://www.rightshold.com/answers/can-i-use-mit-gpl-or-agpl-code-in-a-closed-source-saas)

_Not legal advice. Updated 2026-10-28. JSON: https://www.rightshold.com/answers/how-to-check-licenses-of-all-npm-dependencies-before-shipping.json_