wip-license-hook
Detect license rug-pulls before they reach your codebase.
Commands
Initialize ledger for a project
wip-license-hook init --repo /path/to/repo
Scans all current dependencies and forks, records their licenses, creates
LICENSE-LEDGER.json.
Scan all dependencies
wip-license-hook scan --all
Checks every dependency and fork against the ledger. Updates
last_checked. Flags any changes.
Pre-merge gate
wip-license-hook gate --upstream <remote>
Fetches upstream without merging. Checks license. Returns exit code 0 (safe) or 1 (changed/blocked).
Use in git hooks or CI.
Generate report
wip-license-hook report
Outputs a human-readable license health report.
Generate dashboard
wip-license-hook dashboard --output ./docs
Creates a static HTML dashboard from the ledger. Deploy to GitHub Pages.
Daily Cron Usage
Add to HEARTBEAT.md or as a cron job:
CODEBLOCK5
If any license changed, sends alert via configured channel (email, iMessage, Discord).
What It Detects
- - LICENSE file content changes
- package.json license field changes
- SPDX header changes
- License removal (file deleted)
- License downgrade (permissive → restrictive)
What It Does NOT Do
- - It does not legal advice make
- It does not auto-merge anything ever
- It does not modify upstream code
Alert Levels
- - 🟢 Clean — license unchanged since adoption
- 🟡 Warning — license metadata inconsistency (e.g., LICENSE file says MIT but package.json says ISC)
- 🔴 Blocked — license changed from what was adopted. Merge blocked. Human review required.
MCP
Tools: license_scan, license_audit, license_gate, INLINECODE5
Add to .mcp.json:
CODEBLOCK6
技能名称: wip-license-hook
详细描述:
wip-license-hook
在许可证欺诈到达你的代码库之前将其检测出来。
命令
为项目初始化账本
bash
wip-license-hook init --repo /path/to/repo
扫描所有当前依赖项和分支，记录其许可证，创建 LICENSE-LEDGER.json。
扫描所有依赖项
bash
wip-license-hook scan --all
对照账本检查每个依赖项和分支。更新 last_checked。标记任何变更。
合并前门控
bash
wip-license-hook gate --upstream
在不合并的情况下获取上游。检查许可证。返回退出码 0（安全）或 1（已变更/已阻止）。
用于 git 钩子或 CI。
生成报告
bash
wip-license-hook report
输出一份人类可读的许可证健康报告。
生成仪表盘
bash
wip-license-hook dashboard --output ./docs
从账本创建一个静态 HTML 仪表盘。部署到 GitHub Pages。
每日定时任务用法
添加到 HEARTBEAT.md 或作为定时任务：
wip-license-hook scan --all --alert
如果任何许可证发生变更，通过配置的渠道（电子邮件、iMessage、Discord）发送警报。
它能检测什么
- - LICENSE 文件内容变更
- package.json 中 license 字段变更
- SPDX 头部变更
- 许可证移除（文件被删除）
- 许可证降级（宽松 → 严格）
它不做什么
- - 它不提供法律建议
- 它从不自动合并任何内容
- 它不修改上游代码
警报级别
- - 🟢 干净 — 自采用以来许可证未变更
- 🟡 警告 — 许可证元数据不一致（例如，LICENSE 文件显示 MIT 但 package.json 显示 ISC）
- 🔴 已阻止 — 许可证与最初采用时不同。合并被阻止。需要人工审查。
MCP
工具：licensescan、licenseaudit、licensegate、licenseledger
添加到 .mcp.json：
json
{
wip-license-hook: {
command: node,
args: [/path/to/tools/wip-license-hook/mcp-server.mjs]
}
}
