dsh-license-guard: An Open Source License Compliance Checker for DeepSeek Harness

What Does It Do?

License Guard is a DSH plugin for DeepSeek Harness that scans a project's dependency tree for open-source license compliance risks. Maintained by feely0208 (DeepWhale) under the MIT license, it surfaces GPL/AGPL copyleft contamination, unknown licenses, and missing LICENSE files before you ship, open-source, or face an audit. Instead of discovering a GPL obligation six months after distribution, you get a graded risk report in seconds, with an exit code you can wire into CI.

Core Features

• Dependency license scanning: reports risks in three tiers — high for GPL/AGPL strong copyleft, medium for unknown licenses or a missing project LICENSE, low for LGPL/MPL/EPL and a missing license field in package.json.
• Two-way self-check: looks not only at dependencies but also at your own project, flagging a missing LICENSE file or license field so downstream users can tell whether your code is usable.
• CI-friendly exit codes: results are reflected in the exit code, so the check can gate packaging and release pipelines automatically.
• HTML report output: exports scan results to an HTML report for archiving or handing to an auditor.
• Built-in demo mode: runs against bundled samples so you can see the report format before pointing it at a real project.

How to Use This Plugin?

After enabling it in DSH, run a scan against your current project directory to get a graded risk list; you can also use demo mode to preview the report on bundled samples, or write the output to an HTML file. It covers 5 rules spanning dependency-tree license risk and basic project files, and does not cover patent terms, trademarks, export controls, or non-SPDX custom licenses such as SSPL/BUSL. Declared license values may be wrong because maintainers mistype them, and the tool does not verify their accuracy. As a DSH plugin it can also run standalone as a plain CLI tool without the harness environment.

How to Troubleshoot This Plugin?

If scan results do not match expectations, first check whether the declared license values are accurate — a mistyped license field by a maintainer can cause false positives or missed findings, and the tool does not verify their truthfulness. If the report omits your own project's licensing issues, confirm that a LICENSE file exists at the project root and that package.json carries a license field, since both fall under the medium and low risk rules. If a risk item involves custom licenses such as SSPL/BUSL, or patent, trademark, or export-control matters, that is outside the tool's stated scope and needs separate manual review per the official documentation.