Open source license compatibility checker
Pick the license your project ships under, then list its components or paste a CycloneDX SBOM. The checker flags the combinations the FSF, the Apache Software Foundation and Mozilla describe as incompatible or conditional, and links the source for each. It runs in your browser; nothing is uploaded.
This is not legal advice. It is a quick first pass based on published positions, and it can't see how a component is used: linking, bundling and running code as a network service can change the answer. Ask a lawyer before you rely on a result.
| Component | License | Result | Why | Source |
|---|---|---|---|---|
| [email protected] | GPL-3.0-or-later | Incompatible | The work as a whole must be licensed under the GPL, so it can't ship under a proprietary license. | GNU GPL FAQ: If a library is released under the GPL… |
| [email protected] | none | Check by hand | No license declared. Code without a license is under exclusive copyright by default: you may not have the right to use it. | FSF license list: No license choosealicense.com: No License |
| [email protected] | CDDL-1.0 | Conditions apply | Weak copyleft: changes to its own files have to stay under its license. | FSF license list: Common Development and Distribution License 1.0 |
| [email protected] | Apache-2.0 | Compatible | Permissive; compatible with GPL version 3. Keep its notices and NOTICE file. | FSF license list: Apache License 2.0 |
| [email protected] | MIT | Compatible | A permissive license the FSF lists as GPL-compatible. Keep any notice it asks you to keep. | FSF license list: Expat (MIT) license |
| [email protected] | (MIT OR GPL-2.0-only) | Compatible | Choosing MIT: A permissive license the FSF lists as GPL-compatible. Keep any notice it asks you to keep. | FSF license list: Expat (MIT) license |
Not legal advice. The rules summarize the sources linked in each row.
How it decides
- Your project's license is the outbound license. The question for each component is whether its license lets the combined work be distributed under yours. "Proprietary" means you don't publish the source.
- Strong copyleft spreads to the whole. The GNU GPL FAQ says that when a program links a GPL library, "the work as a whole must be licensed under the GPL" (source). So a GPL or AGPL component is flagged as incompatible in a proprietary, permissive or weak-copyleft project.
- GPL versions matter. GPL-2.0-only and GPL-3.0 can't be combined, but "version 2 or later" code can be used under version 3 (source). Apache-2.0 and LGPL-3.0 work with GPL-3.0 but not with GPL-2.0-only.
- Weak copyleft stays with its files. MPL 2.0, EPL, CDDL and CPL let you combine their code with yours, as long as their own files keep their license. The FSF lists MPL 1.1, EPL 1.0, EPL 2.0 without a GPL secondary license, CDDL 1.0 and CPL 1.0 as incompatible with the GPL.
- The LGPL comes with relinking duties. In a proprietary or permissive project it's marked "conditions apply": users must be able to relink a modified library, and its source must be available when you ship it (source).
- No license isn't permission. A component without a license is under exclusive copyright by default (source), so it's marked for review.
- Deprecated SPDX IDs are read as today's:
GPL-2.0asGPL-2.0-only,GPL-2.0+asGPL-2.0-or-later, and the same for LGPL and AGPL.
The rules at a glance
Rows are a component's license; columns are your project's. Each cell is what the checker answers; the reasons and sources are in the results above when you check a component.
| Component \ Project | Proprietary | MIT | MPL-2.0 | GPL-2.0-only | GPL-2.0-or-later | GPL-3.0-only | AGPL-3.0-only |
|---|---|---|---|---|---|---|---|
MIT | Compatible | Compatible | Compatible | Compatible | Compatible | Compatible | Compatible |
Apache-2.0 | Compatible | Compatible | Compatible | Incompatible | Conditions apply | Compatible | Compatible |
BSD-4-Clause | Conditions apply | Conditions apply | Conditions apply | Incompatible | Incompatible | Incompatible | Incompatible |
LGPL-2.1-only | Conditions apply | Conditions apply | Conditions apply | Compatible | Compatible | Compatible | Compatible |
LGPL-3.0-only | Conditions apply | Conditions apply | Conditions apply | Incompatible | Conditions apply | Compatible | Compatible |
MPL-2.0 | Conditions apply | Conditions apply | Conditions apply | Conditions apply | Conditions apply | Conditions apply | Conditions apply |
MPL-1.1 | Conditions apply | Conditions apply | Conditions apply | Incompatible | Incompatible | Incompatible | Incompatible |
CDDL-1.0 | Conditions apply | Conditions apply | Conditions apply | Incompatible | Incompatible | Incompatible | Incompatible |
EPL-1.0 | Conditions apply | Conditions apply | Conditions apply | Incompatible | Incompatible | Incompatible | Incompatible |
EPL-2.0 | Conditions apply | Conditions apply | Conditions apply | Check by hand | Check by hand | Check by hand | Check by hand |
GPL-2.0-only | Incompatible | Incompatible | Incompatible | Compatible | Conditions apply | Incompatible | Incompatible |
GPL-2.0-or-later | Incompatible | Incompatible | Incompatible | Compatible | Compatible | Compatible | Conditions apply |
GPL-3.0-only | Incompatible | Incompatible | Incompatible | Incompatible | Conditions apply | Compatible | Conditions apply |
AGPL-3.0-only | Incompatible | Incompatible | Incompatible | Incompatible | Conditions apply | Conditions apply | Compatible |
Sources
- GNU GPL FAQ: If a library is released under the GPL…
- GNU GPL FAQ: Is GPLv3 compatible with GPLv2?
- GNU GPL FAQ: LGPL requirements for static and dynamic linking
- GNU GPL FAQ: What counts as interacting remotely (AGPLv3)
- FSF license list: Apache License 2.0
- Apache Software Foundation: Apache License v2.0 and GPL compatibility
- FSF license list: GNU GPL version 2
- FSF license list: GNU GPL version 3
- FSF license list: GNU LGPL version 2.1
- FSF license list: GNU LGPL version 3
- FSF license list: GNU AGPL version 3
- FSF license list: Mozilla Public License 2.0
- Mozilla: MPL 2.0 FAQ
- FSF license list: Mozilla Public License 1.1
- FSF license list: Common Development and Distribution License 1.0
- FSF license list: Eclipse Public License 1.0
- FSF license list: Eclipse Public License 2.0
- FSF license list: Common Public License 1.0
- FSF license list: Original (4-clause) BSD license
- FSF license list: No license
- choosealicense.com: No License
- SPDX License List (deprecated identifiers)
Rules last checked against these sources on 2026-10-24.
License policy in AI CodeOps
The release check your CI calls can deny a change when the project's latest SBOM contains a license you've listed as disallowed. The match is exact and ignores case, so list every identifier you mean, for example both GPL-3.0-only and GPL-3.0-or-later. See Security and SBOM and SBOM and security. To see what changed between two SBOMs, use the SBOM diff; for the background, read What is software supply chain security?
Cite this
AI CodeOps (2026). Open source license compatibility checker. https://aicodeops.dev/tools/license-checker
The data and charts on this page are licensed CC BY 4.0: reuse them anywhere, with a link back to this page.
Embed it
<iframe src="https://aicodeops.dev/tools/license-checker?embed=1" title="Open source license compatibility checker" width="100%" height="640" style="border:0" loading="lazy"></iframe> <p><a href="https://aicodeops.dev/tools/license-checker">Open source license compatibility checker</a> by <a href="https://aicodeops.dev/">AI CodeOps</a></p>
Frequently asked questions
Is this legal advice?
No. It summarizes what the Free Software Foundation, the Apache Software Foundation and Mozilla have published about combining licenses, with a link to each source. Whether a combination is allowed can depend on how the code is used, linked and distributed. Ask a lawyer before you rely on it.
Is my SBOM or component list uploaded?
No. Everything is checked in your browser, and the page sends no request with your input. Nothing is stored.
What do the four results mean?
Compatible: the sources say the combination is fine. Conditions apply: allowed, with obligations such as relinking for the LGPL or distributing the whole under GPL-3.0. Check by hand: the answer depends on something the checker can't see, such as an exception or a missing license. Incompatible: the sources say the combination can't be distributed under your project's license.
How are license expressions handled?
With OR you may pick any option, so the best one counts. With AND every part applies, so the worst one counts. A WITH exception, such as the Classpath exception, marks the result for review unless the base license is already fine. A component with several license entries is checked as all of them together.
Why is a license I use marked Check by hand?
The checker only has rules for licenses its sources cover: common permissive licenses, the GNU licenses, MPL, EPL, CDDL, CPL and the original BSD license. Anything else, including names that aren't SPDX IDs, is left for you to review.