Open Source License Compliance Reviewer

A dependency added in a hurry can put your whole codebase under obligations no one read - a copyleft license that forces you to open-source proprietary code, a component incompatible with licenses already in your product, or one used with no attribution where the terms demand it. This assistant checks each open-source dependency against your license policy, flags what creates distribution or compliance risk, and recommends approve, approve with conditions, or block.

Category: Technology

How it works

1. A new dependency comes in for review - the package and version, its license (MIT, Apache-2.0, BSD, GPL, LGPL, AGPL, MPL, or a custom one), how it's incorporated (dynamically linked, bundled, or modified), and whether your product is distributed or offered as a hosted service.
2. It checks the license against your policy and the licenses already in your product, then screens for risk - a strong-copyleft or network-copyleft license, an incompatible license combination, missing attribution or NOTICE files, a non-OSI custom license, and a version bump that changed the license.
3. It returns a decision - approve, approve with conditions, or block - with a compliance-risk read, each flag tied to the license clause or policy rule it fails, and the obligations you'd take on.
4. Each dependency lands as one row in a review queue for engineering or legal to clear before it's merged.

Key benefits

• Catch a copyleft or AGPL license that would force you to open-source proprietary code before it ships
• Flag license combinations that are incompatible with what's already in your product
• Surface missing attribution, NOTICE files, and non-OSI custom terms before release
• Apply your license policy consistently to every dependency, not just the obvious ones

Use cases

• Engineering and platform teams adding open-source dependencies
• Open-source program offices and legal teams owning license policy
• Security and compliance teams preparing for an audit, M&A, or due diligence
• CTOs and engineering leads at companies that distribute software or ship SaaS

Good to know

No external connection - your dependency manifests, source, and license policy stay in your workspace. The assistant checks each dependency against your policy and the licenses already in your product, flags what creates distribution or compliance risk, and recommends approve, conditions, or block; it never merges a dependency, changes a license, or ships a release on its own. Engineering or legal clears every flagged dependency before it's merged.

Frequently asked questions

Does this assistant automatically block dependencies from being merged?

No, it flags risks and recommends approve, approve with conditions, or block, but a human (engineering or legal) must clear each dependency before it's merged.

Which open-source licenses does it check against?

It checks standard licenses like MIT, Apache-2.0, BSD, GPL, LGPL, AGPL, MPL, and custom ones, comparing them against your policy and existing licenses in your product.

Can I use this without connecting any external tools?

Yes, it works entirely within your Gaia workspace-no external connections needed, as your dependency manifests, source, and license policy stay local.

How does it handle a dependency that changes its license between versions?

It flags a version bump that changed the license as a risk, so you can review whether the new terms are compatible with your product.

Does it automatically add attribution or fix license files?

No, it only surfaces missing attribution or NOTICE files as flags; you must handle those obligations manually before release.