Shipping software means shipping its dependencies' licenses too — and most of the risk isn't a specific forbidden license, it's not knowing what's actually in your tree. DepWarden is a free license compliance checker: paste a manifest or lockfile and get every dependency's real SPDX license, classified by obligation, with a generated NOTICE file ready for legal review — no account.
A license compliance check isn't a pass/fail gate against one banned license — it's knowing, for every direct and transitive dependency, what license it carries and what that license actually requires of you (attribution, source disclosure, patent grant, nothing at all). The risk is concentrated in the dependencies nobody reads the license for: a transitive package four levels deep pulling in a copyleft license changes your obligations even though it never appears in your package.json.
Each component's real SPDX identifier is resolved from actual package registry/deps.dev metadata, not guessed from a filename — including compound expressions like MIT OR Apache-2.0 or (MIT AND BSD-3-Clause), parsed correctly rather than flattened to one label. Every license is then classified into one of five categories: permissive (MIT, Apache-2.0, BSD, ISC — attribution only), weak copyleft (LGPL, MPL, EPL — obligations scoped to the library itself), strong copyleft (GPL, AGPL — whole-work obligations that can require source disclosure), proprietary/custom, or unknown (no resolvable SPDX id — worth checking manually, since this is exactly where real risk hides).
Attribution is the one obligation almost every open-source license shares. DepWarden generates a NOTICE/attribution file listing every dependency and its license, ready to ship alongside your product or hand to legal — the single most common compliance task, done automatically from the same scan that finds your vulnerabilities.
This is a compliance *checker*, not a compliance *lawyer* — it tells you what license each dependency carries and flags copyleft risk so you know where to look closer, not whether your specific combination and distribution model is legally compliant. For genuinely ambiguous cases (dual-licensed packages, an AND'd combination of copyleft and proprietary terms), read our guide to what each license actually requires and involve counsel before shipping.
Usage: paste any supported manifest or lockfile at depwarden.in, or connect a repo branch for scheduled scans — license categorisation and the NOTICE file are generated on every scan, at every plan tier. Related: software composition analysis, what is an SBOM?, free vulnerability scanner.