Wip License Hook

License rug-pull detection. Scans dependencies and forks for license changes, gates upstream merges, maintains a license ledger, and generates a public compl...

Detect license rug-pulls before they reach your codebase.

Commands

Initialize ledger for a project

wip-license-hook init --repo /path/to/repo

Scans all current dependencies and forks, records their licenses, creates LICENSE-LEDGER.json.

Scan all dependencies

wip-license-hook scan --all

Checks every dependency and fork against the ledger. Updates last_checked. Flags any changes.

Pre-merge gate

wip-license-hook gate --upstream <remote>

Fetches upstream without merging. Checks license. Returns exit code 0 (safe) or 1 (changed/blocked).

Use in git hooks or CI.

Generate report

wip-license-hook report

Outputs a human-readable license health report.

Generate dashboard

wip-license-hook dashboard --output ./docs

Creates a static HTML dashboard from the ledger. Deploy to GitHub Pages.

Daily Cron Usage

Add to HEARTBEAT.md or as a cron job:

wip-license-hook scan --all --alert

If any license changed, sends alert via configured channel (email, iMessage, Discord).

What It Detects

• LICENSE file content changes
• package.json license field changes
• SPDX header changes
• License removal (file deleted)
• License downgrade (permissive → restrictive)

What It Does NOT Do

• It does not legal advice make
• It does not auto-merge anything ever
• It does not modify upstream code

Alert Levels

• 🟢 Clean — license unchanged since adoption
• 🟡 Warning — license metadata inconsistency (e.g., LICENSE file says MIT but package.json says ISC)
• 🔴 Blocked — license changed from what was adopted. Merge blocked. Human review required.

MCP

Tools: license_scan, license_audit, license_gate, license_ledger

Add to .mcp.json:

{
  "wip-license-hook": {
    "command": "node",
    "args": ["/path/to/tools/wip-license-hook/mcp-server.mjs"]
  }
}