闭源商用、融资尽调、企业客户的安全审查——这三件事都会问同一个问题：你的依赖里有没有 AGPL/SSPL/GPL，有没有压根没写协议的包。这个工具把清单里的每个包都拿去 npm registry 或 PyPI 的公开接口实查，按传染性分级列出，并说明每一级到底意味着什么。刻意不让模型凭记忆回答——包在版本之间改协议是常事，记错一个就是错误的安全感。免费层查前 30 个直接依赖；点数模式解锁全量（含传递依赖）、NOTICE 归属文件生成、替代包建议，以及一页纸给法务或投资人的说明。Closed-source commercial use, a funding diligence pass, or an enterprise security review all ask the same thing: do you ship AGPL, SSPL or GPL code, and do you ship packages with no licence at all? This looks up every package in your manifest against the official npm or PyPI API, grades them by copyleft strength, and explains what each grade actually obliges you to do. It deliberately never answers from memory — packages relabel their licence between versions, and one wrong recall is false confidence. Free: your first 30 direct dependencies. Credits unlock the full tree, a generated NOTICE file, replacement suggestions, and a one-page summary for counsel or investors.
全量依赖（含传递依赖的处理方法）+ 可直接交付的 NOTICE / 归属文件 + 高风险包的替代方案（含迁移代价）+ 一页纸给法务或投资人的说明。The full dependency set, a ready-to-ship NOTICE and attribution file, replacement options for the risky packages with migration cost, and a one-page summary for counsel or investors.
本工具做许可证检索与风险分级，不是法律意见，不能替代律师审查。协议数据取自 npm registry / PyPI 公开接口的最新版本元数据，可能与你 lockfile 中锁定的版本不同，也可能与仓库里的 LICENSE 文件不一致；本工具只查直接依赖，不展开传递依赖树。任何具体的合规决定请交给律师。你粘贴的内容不入库。This retrieves and grades licences; it is not legal advice and does not replace review by counsel. Data comes from the latest-version metadata in the public npm/PyPI APIs, which may differ from the version pinned in your lockfile and from the LICENSE file in the repository. Only direct dependencies are resolved. Take compliance decisions to a lawyer. Nothing you paste is stored.