Abstract editorial illustration in deep blue, slate and warm neutral tones (description pending review)

How to Check an Open-Source Project’s License Before You Use Its Code

by
Tested by TNT Review — record TNT-TEST-2026-10-05-012, 5 October 2026. We ran the checker below against two real, live repos, and the surprising real result is in Verification.

The problem

“It’s on GitHub, it’s probably fine to use” is not the same as actually having permission. Every public repo has some license status, but assuming it’s permissive without checking is how projects end up using code they technically shouldn’t.

Expected outcome

By the end of this guide you will have a script that checks what license GitHub’s own detector sees for any public repo, in under a second — and you’ll understand a real gotcha in how that detection actually works, demonstrated with a genuine surprising example.

Requirements and costs

  • Node.js (version 18 or newer, for its built-in fetch).
  • Cost: free. GitHub’s public API needs no account or API key at this request volume.

Step-by-step implementation

  1. Download the checker from the link below.
  2. Run it against any public repo: 
    node check-license.js expressjs/express
  3. If it says “recognized: false,” open the repo’s actual LICENSE file on GitHub and read it yourself — don’t assume “unrecognized” means “no license.”

A real example

$ node check-license.js expressjs/express
{ "repo": "expressjs/express", "spdx_id": "MIT", "name": "MIT License", "recognized": true, "note": null }

$ node check-license.js lodash/lodash
{ "repo": "lodash/lodash", "spdx_id": "NOASSERTION", "name": "Other", "recognized": false,
  "note": "GitHub could not confidently classify this repo's license from its LICENSE file..." }

That second result is genuinely surprising: lodash is one of the most widely used MIT-licensed JavaScript libraries there is, yet GitHub’s own API currently reports its license as “Other”/unrecognized. This is the exact failure mode worth knowing about — GitHub’s detection can miss a real, valid license, so “unrecognized” is a prompt to go look, never a conclusion on its own.

Verification and troubleshooting

What we tested, on 5 October 2026 (record TNT-TEST-2026-10-05-012): the checker run against expressjs/express (correctly recognized as MIT) and lodash/lodash (recognized: false, reported as “Other”/NOASSERTION despite lodash genuinely being MIT-licensed) — both real, live API responses, not constructed examples. This confirms the checker correctly surfaces GitHub’s real classification, including its real limitations.

Troubleshooting:

  • “GitHub API returned 404.” Check the spelling of owner/repo — this is the exact case-sensitive path from the repo’s GitHub URL.
  • It says “recognized: false” for a repo you’re sure has a clear license. That’s the gotcha this guide exists to flag — open the LICENSE file directly and read it; GitHub’s automatic detection genuinely does miss some valid licenses.
  • “GitHub API returned 403.” You’ve hit GitHub’s unauthenticated rate limit (60 requests/hour per IP) — wait before checking more repos.

Limitations and alternatives

This reports GitHub’s own automatic classification, which (as shown above) can say “unrecognized” for a repo with a perfectly valid, common license. It cannot interpret a license’s actual legal terms for your specific use case — for anything commercially significant, read the license text yourself or ask someone qualified to.

Free resources

The download contains the full checker.

Download the license checker (ZIP, 1 KB)

Is there a paid version?

Not yet. This is the complete method. TNT Review has sold nothing to date and has no checkout, so any price we discuss in future should be read as a hypothesis, not an offer.

Leave a comment