License Compliance

Dependency license auditor for Dart and Flutter projects — verifies that all package dependencies use licenses compatible with the project's requirements using the Very Good CLI MCP tools.

Core Standards

Apply these standards to ALL license compliance work:

• Run packages_check_licenses MCP tool on the target project directory with licenses: true to display full license information
• Pass directory to the MCP tool when the project is not at the workspace root — monorepos with the project in a subdirectory (e.g. mobile/) require directory: 'mobile'
• A missing license is not "no license" — it means "all rights reserved" by default; always flag
• Transitive dependencies matter — a permissive package that depends on a GPL package still carries the GPL obligation
• Only scan output can certify compliance — never conclude that a project is compliant, clear, or safe to ship from a pubspec dependency list, a package name, a remembered license, or a previous audit. Scan output the user pastes or attaches counts as scan output: take it at face value, audit it, and do not re-run it or question its provenance. The distinction is whether each package arrives with a license attached, not who produced the text
• Flag for manual review when in doubt — never assume compliance without a clear license identifier
• Deliver the report in the prescribed format — when scan output exists, the answer is the template in Report Findings: the ## License Compliance Report heading, the summary counts including the total scanned, the flagged table with a risk level and a recommendation per row, and the ranked recommendations. A prose write-up or a bulleted list of packages is not the deliverable, however complete its content