Acquirer counsel finds the GPL-licensed dep buried six levels deep in your transitive tree six weeks into the deal. RepoWarden surfaces it the day someone adds it.
It's a lawyer problem until it's a fire. Procurement asks. Auditors ask. Engineering doesn't have time to police the SPDX field on every transitive dep — RepoWarden does.
AGPL inside a closed-source SaaS surfaces during diligence, slashes valuation, and forces a six-week refactor under deal pressure.
Enterprise buyers ask for a software bill of materials with licenses. "We don't track that" is a stalled deal.
A maintainer changes their licence from MIT to BUSL — the npm registry lets it through. RepoWarden flags the change between versions as a high-priority finding.
RepoWarden walks every direct dependency, normalises the license to a canonical SPDX identifier, and evaluates it against the license your project ships under.
Example license report
Tell us once whether the repo is proprietary, MIT, Apache, GPL, or AGPL — RepoWarden picks the right matrix. Need a different rule? Compliance-tier customers can override the verdict on any SPDX id without writing a custom checker.
A breakdown chart of every license in your tree, a filterable dependency table grouped by ruling, and inline change tracking when a dep flips license between scans.
Conflicts land in the same kanban as CVEs and dependency updates. Severity is tuned to your declared project license — AGPL inside a proprietary repo is always Critical.
Connect a repo, declare its license, and get a per-dependency verdict on the next scan. No agents, no CI changes.