License Compliance Checker for Contract Dependencies

WHAT IT DOES

License Compliance Checker for Contract Dependencies is a security and compliance-focused tool that scans npm package.json files to check the license compatibility of Web3 contract dependencies. It parses the package.json dependencies, optionally resolves exact versions from package-lock.json, and checks each package against a curated license database. The tool identifies licenses for common Web3 packages including ethers, web3.js, @openzeppelin/contracts, hardhat, @chainlink/contracts, @uniswap/v2-core, @uniswap/v3-core, @aave/core-v3, and many others. For each dependency, the tool reports the license type, compatibility status (compatible, restricted, incompatible, or unknown), and provides a visual status indicator. The tool also accepts optional Solidity source code to identify which dependencies are actually used in the contract, providing context for license compliance prioritization.

HOW TO USE

Paste your package.json into the "package.json" text area. Optionally paste your package-lock.json for exact version resolution, and your Solidity source code for context. Click "Check license compliance" to analyze the dependencies. The tool will display a summary with total packages scanned, and counts by compatibility status: compatible, restricted, incompatible, and unknown. A detailed license report shows each package with its version, license type, compatibility status, and whether it is used in the contract source. Packages detected in the Solium source are marked as "Used in contract source" for prioritization.

TECHNICAL NOTE: LICENSE DETECTION AND COMPATIBILITY CLASSIFICATION

The tool uses a curated license database that maps common Web3 and JavaScript packages to their primary licenses and compatibility classifications. The database includes MIT, GPL-2.0, GPL-3.0, LGPL-3.0, Apache-2.0, BSD-2-Clause, BSD-3-Clause, and ISC licenses. Compatibility is classified as: compatible (permissive licenses like MIT, Apache, BSD), restricted (copyleft licenses like GPL, LGPL that may impose obligations), incompatible (licenses that conflict with common commercial use), and unknown (license not in the database). The tool resolves exact versions from package-lock.json when provided, and extracts import statements from Solidity source code to identify which packages are actually used in the contract.

WHAT IT CANNOT SEE

The tool cannot automatically detect licenses without package.json or lock files. It is limited to the accuracy of the license database; it may not include all packages or license variations. It cannot detect licenses for private or unpublished packages. It cannot verify that declared licenses match the actual license terms in the package source. The tool cannot check license compatibility for non-npm dependencies such as Git submodules or local packages. It is limited to the accuracy of version resolution from lock files. It cannot detect license changes in transitive dependencies without a full lock file. It cannot check licenses for non-EVM chains.

PLEASE NOTE

This tool is designed exclusively for npm packages used in Web3 and Solidity development on EVM-compatible chains. The license database is curated and may not be comprehensive. License compatibility depends on your project's specific compliance requirements, including commercial use, distribution, and derivative works. The tool provides no warranty that the license check results are complete or accurate; users are responsible for verifying license information with official sources and consulting legal counsel when necessary.