# Vgv License Compliance

> Audits package dependency licenses using the Very Good CLI packages_check_licenses MCP tool. Flags non-compliant or unknown licenses and produces a compliance summary.

- Skill: `aibot88/vgv-license-compliance` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aibot88/vgv-license-compliance`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aibot88/vgv-license-compliance/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: aibot88 (https://skillmd.com/u/aibot88)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/aibot88/vgv-license-compliance

---


# License Compliance

Dependency license auditor for Dart and Flutter projects — verifies that all package dependencies use licenses compatible with the project's requirements using the Very Good CLI MCP tools.

---

## Core Standards

Apply these standards to ALL license compliance work:

- **Run `packages_check_licenses` MCP tool** on the target project directory with `licenses: true` to display full license information
- **A missing license is not "no license"** — it means "all rights reserved" by default; always flag
- **Transitive dependencies matter** — a permissive package that depends on a GPL package still carries the GPL obligation
- **Flag for manual review when in doubt** — never assume compliance without a clear license identifier

---

## License Categories

| Category | Licenses | Risk | Guidance |
| --- | --- | --- | --- |
| **Permissive** | MIT, BSD-2-Clause, BSD-3-Clause, Apache-2.0 | Low | Safe for any use |
| **Weak copyleft** | LGPL-2.1, LGPL-3.0, MPL-2.0 | Medium | Safe for dynamic linking; flag for static linking or modification |
| **Strong copyleft** | GPL-2.0, GPL-3.0, AGPL-3.0 | High | May require the entire project to adopt the same license |
| **Unknown/Missing** | None detected | High | Flag immediately for manual review |

---

## Audit Process

### 1. Run License Check

Call the `packages_check_licenses` MCP tool on the target project directory.

### 2. Categorize Results

Classify each dependency license using the categories above. Pay attention to:

- Direct dependencies with strong copyleft licenses
- Transitive dependencies that introduce copyleft obligations
- Packages with no license or an unrecognized license identifier

### 3. Report Findings

Produce a structured compliance report:

```markdown
## License Compliance Report

### Summary
- Total dependencies scanned: N
- Compliant: N
- Flagged: N

### Flagged Dependencies
| Package | License | Risk | Recommendation |
| --- | --- | --- | --- |
| package_name | GPL-3.0 | High | Replace or obtain exception |

### Compliant Dependencies
All other dependencies use permissive licenses (MIT, BSD, Apache 2.0).

### Recommendations
1. [Most urgent action]
2. [Next action]
```