Take control of your dependencies, before the license changes

The Problem

Open-source library licenses can be changed silently at any time, and developers receive no notification. History has seen multiple large-scale "license surprise" events — Terraform, Elasticsearch, Redis — each catching dependent projects off guard, forcing emergency legal reviews or rushed forks.

The core pain point: no existing tool tells you "one of your dependencies changed its license from MIT to BSL yesterday."

What LicenseWatch Does

LicenseWatch is a lightweight scanner that reads your package.json and checks the current license of every dependency. It flags risks before they become problems.

Who It's For

• Indie developers shipping commercial products
• Small-team tech leads managing dependency hygiene
• Open-source maintainers who care about compliance

Current Stage

We're in the validation phase: confirming that developers actually want a quick, zero-setup way to audit their dependency licenses. Feedback is welcome — reach us at huangfen625@gmail.com.

Last updated: April 23, 2026

Information We Collect

LicenseWatch does not require registration or login. We do not intentionally collect any personally identifiable information.

Package Data

When you paste a package.json and click "Analyze," the package names are sent to our API to query license information. We do not store your package.json content or the list of packages on our servers. Each request is processed in memory and discarded immediately.

Server Logs

Our hosting provider (Vercel) may collect standard HTTP logs such as IP address, browser type, and request timestamps for operational and security purposes. These logs are retained according to Vercel's data policies.

Cookies & Tracking

We use Google Analytics to understand aggregate usage (e.g., how many people use the scan feature). This involves a small cookie placed by Google. You can block this via your browser settings.

Third-Party APIs

License queries are sent to the npm Registry API and optionally the GitHub API. These services have their own privacy policies.

Contact

If you have questions about this policy, email huangfen625@gmail.com.

Last updated: April 23, 2026

1. Acceptance

By using LicenseWatch, you agree to these Terms. If you do not agree, please do not use the service.

2. The Service

LicenseWatch is a free, experimental tool that scans npm dependency licenses. It is provided "as is" without warranties of any kind.

3. Accuracy

License detection relies on public npm and GitHub data. Results may be incomplete, outdated, or incorrect. You should always verify critical license information independently.

4. Limitation of Liability

LicenseWatch and its creators are not liable for any damages, losses, or legal issues arising from your use of the tool or reliance on its output.

5. Changes

We may modify or discontinue the service at any time without notice.

6. Governing Law

These terms are governed by the laws of the jurisdiction where the service operator resides.

LicenseWatch is for reference only and does not constitute legal advice.

License classification and risk ratings are automated heuristics based on publicly available data. They are not reviewed by legal professionals.

Before making business or legal decisions based on license information, please:

• Consult a qualified attorney familiar with software licensing law
• Review the actual license text in the dependency's repository
• Verify the current SPDX identifier with the package maintainer

The creators of LicenseWatch accept no responsibility for compliance decisions made using this tool.

Add GitHub repositories to monitor. License changes will trigger email alerts.