---

name: wip-license-hook description: License rug-pull detection. Scans dependencies and forks for license changes, gates upstream merges, maintains a license ledger, and generates a public compliance dashboard. license: MIT interface: [cli, module, mcp] metadata: display-name: "License Rug-Pull Detection" version: "1.0.0" homepage: "https://github.com/wipcomputer/wip-ai-devops-toolbox" author: "Parker Todd Brooks" category: dev-tools capabilities: - license-scanning - rug-pull-detection - compliance-gating - license-ledger requires: bins: [node, git, npm] openclaw: requires: bins: [node, git, npm] install: - id: node kind: node package: "@wipcomputer/wip-license-hook" bins: [wip-license-hook] label: "Install via npm" emoji: "🛡️" compatibility: Requires git, npm, node. Node.js 18+.

wip-license-hook

Detect license rug-pulls before they reach your codebase.

Commands

Initialize ledger for a project

wip-license-hook init --repo /path/to/repo

Scans all current dependencies and forks, records their licenses, creates LICENSE-LEDGER.json.

Scan all dependencies

wip-license-hook scan --all

Checks every dependency and fork against the ledger. Updates last_checked. Flags any changes.

Pre-merge gate

wip-license-hook gate --upstream <remote>

Fetches upstream without merging. Checks license. Returns exit code 0 (safe) or 1 (changed/blocked).

Use in git hooks or CI.

Generate report

wip-license-hook report

Outputs a human-readable license health report.

Generate dashboard

wip-license-hook dashboard --output ./docs

Creates a static HTML dashboard from the ledger. Deploy to GitHub Pages.

Daily Cron Usage

Add to HEARTBEAT.md or as a cron job:

wip-license-hook scan --all --alert

If any license changed, sends alert via configured channel (email, iMessage, Discord).

What It Detects

• LICENSE file content changes
• package.json license field changes
• SPDX header changes
• License removal (file deleted)
• License downgrade (permissive → restrictive)

What It Does NOT Do

• It does not legal advice make
• It does not auto-merge anything ever
• It does not modify upstream code

Alert Levels

• 🟢 Clean — license unchanged since adoption
• 🟡 Warning — license metadata inconsistency (e.g., LICENSE file says MIT but package.json says ISC)
• 🔴 Blocked — license changed from what was adopted. Merge blocked. Human review required.

MCP

Tools: license_scan, license_audit, license_gate, license_ledger

Add to .mcp.json:

{
  "wip-license-hook": {
    "command": "node",
    "args": ["/path/to/tools/wip-license-hook/mcp-server.mjs"]
  }
}