· ReadyStack
Worked example
Real numbers from this tool, line by line.
A sample .csproj for a .NET 8 web API gives 6 licence flags, 5 errors and 1 warning: that is the result for .NET developers and tech leads in the US, UK and EU who ship closed-source software and have not pinned their NuGet versions since 2025.
The six lines look ordinary. AutoMapper 15.1.0. MediatR 13.0.0. FluentAssertions with a floating * version. MassTransit.RabbitMQ 9.1.0. EPPlus 7.5.2. QuestPDF 2024.12.3. Nothing fails to build, nothing fails to restore, and no test goes red. The change is in the licence file inside each package.
Here is what the NuGet registration API says, version by version. AutoMapper was MIT up to 14.0.0; from 15.0.0 (July 2025) the licence is RPL-1.5, a reciprocal licence that asks you to release your own source, or a Lucky Penny Software commercial licence. MediatR was Apache-2.0 up to 12.5.0 and changed at 13.0.0 on 2 July 2025. FluentAssertions was Apache-2.0 up to 7.2.2; from 8.0.0 on 14 January 2025 it ships under the Xceed Community License for non-commercial use only. MassTransit was Apache-2.0 up to 8.5.10 and moved to the Massient licence at 9.0.0 on 6 January 2026. EPPlus has been Polyform Noncommercial since version 5, and 4.5.3.3 is the last LGPL build.
Two more depend on who you are. SixLabors.ImageSharp 3.0.0 and later use the Six Labors Split License: Apache-2.0 for open source, transitive use, or a for-profit direct user under 1M USD annual gross revenue, commercial otherwise. QuestPDF 2023.4.0 and later need a commercial licence for closed-source use by a for-profit company over 1M USD annual gross revenue. Every Duende.IdentityServer version is under Duende's own terms, and itext7 is AGPL.
Why does this slip through? NuGet.org shows a licence link on each version page, not a warning. dotnet add package without --version installs the newest release. AI coding assistants write the newest version they know. A floating * in a PackageReference restores the newest release on every clean build, so a project that was fine last year can cross the line without a single commit to the .csproj.
NuGet License Gate is a VS Code extension with 10 rules. It reads PackageReference, PackageVersion, VersionOverride, packages.config and the multi-line <Version> form. It follows NuGet's own range rule: [12.0.0,) restores the lowest allowed version, so it is judged by 12.0.0; a * restores the newest, so it is flagged. Each flag names the licence, the date of the change and the last open-source version to pin: AutoMapper 14.0.0, MediatR 12.5.0, FluentAssertions 7.2.2, MassTransit 8.5.10, EPPlus 4.5.3.3.
On a Directory.Packages.props sample it gives 5 flags: ImageSharp 3.1.5, Duende.IdentityServer 7.0.8, itext7 8.0.5, a floating MediatR 12.* and AutoMapper 16.0.0 in packages.config. The clean .csproj, with every package on its last open-source version, gives 0.
The free part is complete on its own: open one file in VS Code, or paste it into the web page, and you get every flag with its pin. There is no key, no limit and no sign-up. The paid part is scope: one sweep over every project file in the workspace and a Markdown licence report you can attach to an audit or a customer security questionnaire.
For scale: the DOJ Fitzpatrick Matrix for billing year 2026 rates a 15-year litigator at $851 an hour. The lint does not replace that lawyer. It tells the lawyer which six lines to read.
15 seconds — what it actually does
Questions people ask
What does NuGet License Gate check in a .csproj file?
NuGet License Gate reads PackageReference, PackageVersion and packages.config lines and flags NuGet versions past their licence line: AutoMapper 15.0.0+, MediatR 13.0.0+, FluentAssertions 8.0.0+, MassTransit 9.0.0+, EPPlus 5.0.0+, plus revenue-dependent ImageSharp 3+ and QuestPDF 2023.4.0+, every Duende.IdentityServer and AGPL itext7. Each flag names the licence and the last open-source version to pin. It ships 10 rules.
Who needs a NuGet commercial licence check?
.NET developers and tech leads at companies that ship closed-source software, in the US, UK, EU or anywhere else, before a customer security questionnaire, an acquisition due diligence or an open-source licence audit. It matters most when a project was scaffolded by an AI assistant or by dotnet add package, because both take the newest version, and the newest AutoMapper or MediatR is no longer MIT or Apache-2.0.
Why is NuGet.org or a chatbot not enough to catch a commercial NuGet version?
NuGet.org shows a licence link on each version page, not a warning, and dotnet add package without --version installs the newest release. MassTransit changed from Apache-2.0 to the Massient licence at 9.0.0 on 6 January 2026, after many chatbot training cutoffs. This check reads the exact version string in your file, including floating * versions that restore the newest release.
What is free in NuGet License Gate and what needs a licence key?
Free, with no key: the open file in VS Code or the web page, every flag, the licence name and the last open-source version to pin, for .csproj, .fsproj, .vbproj, Directory.Packages.props and packages.config. The licence key ($29 once, one key per person or team seat) adds a sweep of every project file in the workspace and a Markdown licence report for the audit file.
How much does a manual NuGet licence review cost?
A lawyer reading licence files by the hour is the usual alternative. The DOJ Fitzpatrick Matrix for billing year 2026 rates a 15-year litigator at $851 per hour. NuGet License Gate checks the open file for free and the workspace sweep with a Markdown report costs $29 once. It does not replace legal advice; it shows which lines a lawyer needs to look at.
Why not just ask ChatGPT or another AI chat?
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. NuGet License Gate: AutoMapper, MediatR checks the file you open against 10 rules from a rule set dated 2026-09-27, and points at the exact line. For a filing, an audit or a client you need that dated result on your own files.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.