# Audit Open Source Licenses in a Rust Project

Yes. An agent resolves your Cargo.lock graph in a sandbox and writes licenses.csv plus licenses.md flagging GPL, AGPL, LGPL, SSPL or unknown licenses.

[Run this on Rush](https://cloud.getrush.ai/run/license-audit/rust/).

## What the agent does

The agent clones the workspace into its sandbox. On a repository like rust-lang/mdBook it finds a Cargo workspace (`edition = "2024"`, `rust-version = "1.88.0"`, workspace license `MPL-2.0`) with the root package `mdbook` at version `0.5.4` and crates under `crates/` (`mdbook-core`, `mdbook-driver`, `mdbook-html`, `mdbook-markdown`, `mdbook-preprocessor`, `mdbook-renderer`, `mdbook-summary`, …). `Cargo.lock` lists on the order of 270 package entries. The `mdbook-html` crate's own `Cargo.toml` declares a compound license line (`MPL-2.0 AND Apache-2.0 AND BSD-3-Clause AND CC-BY-4.0 AND MIT AND OFL-1.1`) because of bundled assets; the agent records that as written.

It runs `cargo fetch` (or `cargo metadata`) against the lockfile so crates.io sources are available, then inventories each package: name, version, license field from the crate metadata, whether it is a direct dependency of a workspace member or only transitive, and a path from a workspace package to that crate. Tools such as `cargo-license` or `cargo deny` list adapters are fine as long as the CSV columns match the prompt.

Workspace members are roots for the path column: a crate used only by `mdbook-html` is marked transitive relative to the `mdbook` binary unless another member also depends on it directly. Examples under `examples/` and helper crates such as `guide/guide-helper` are included when they appear in the workspace membership list, and skipped only if the prompt asks for the main binary graph alone.

It writes `licenses.csv` for the full graph and `licenses.md` summarizing GPL, AGPL, LGPL, SSPL and unknown licenses, naming which workspace member or direct dependency introduces each flagged crate. Dual-licensed crates (`MIT OR Apache-2.0`) are recorded with both options, not treated as unknown. Crates with an empty license field are unknown.

No Rust source or lockfile is modified, and no publish runs. The reports are sandbox artifacts only.

## Start it with one API call

`POST https://api.prix.dev/o/{org}/sessions`

```json
{
  "agent": "claude",
  "input": "Clone https://github.com/rust-lang/mdBook, resolve its full dependency tree from the lockfile, and write licenses.csv (package, version, license, direct or transitive, path from the root) plus licenses.md summarizing any GPL, AGPL, LGPL, SSPL or unknown license and which top-level dependency brings it in."
}
```

1. **Get an API key.** In the console, open Settings, then API keys, and create a key for your org. Send it in the Authorization header as a Bearer token.
2. **Send the request.** POST the body in request.json to https://api.prix.dev/o/{org}/sessions, with your repository as the resources URL. The run starts in its own cloud sandbox.
3. **Read what came back.** Follow the run on its live stream or wait for the run.completed webhook, then read the result and its trajectory.

## What comes back

What comes back is `licenses.csv` and `licenses.md` as session artifacts. The CSV mirrors `Cargo.lock`; the Markdown lists only flagged licenses with the workspace dependency path that pulls each one in.

A reviewer compares flagged rows to the project's redistribution policy (mdBook itself is MPL-2.0) and checks compound license lines on crates that bundle fonts or JS. The transcript keeps `cargo metadata` / license-tool output for audit.

## Run it on every Cargo.lock change

On pull requests that update `Cargo.lock`, start this run against the PR commit. The new inventory shows whether a bump added a copyleft or unknown crate before merge.

When the run finishes, the key's webhook can comment on the PR with a link to `licenses.md` if the flagged section is non-empty.

## Why run it on Rush?

Auditing a Rust workspace locally means fetching crates into your user-wide cargo registry and scanning hundreds of LICENSE files by hand or with a one-off tool. Rush does the fetch inside a sandbox and returns CSV and Markdown you can attach to a release checklist.

Independent sandboxes mean you can inventory several workspaces at once without fighting over `CARGO_HOME`. Every claim in the report traces to a command in the session transcript.

mdBook redistributes HTML, fonts and JS with a compound license on `mdbook-html`; a flat SPDX guess would be wrong. Recording the crate's declared license line verbatim keeps lawyers aligned with what Cargo published.

## Frequently asked questions

### Does it include build-dependencies and dev-dependencies?

Yes by default, because they appear in `Cargo.lock`. Ask for "production dependencies only" in the prompt if you want `cargo metadata` filtered to normal dependencies of the binary crates.

### How are dual licenses shown?

As the crate declares them, for example `MIT OR Apache-2.0`. They are not flagged as copyleft. Only GPL-family, SSPL and missing licenses go into the summary section of `licenses.md`.

### Will it change Cargo.toml or Cargo.lock?

No. It only fetches and reads metadata. Fixing a flagged crate is a separate change you review in a pull request.

### What about the OFL font license in mdbook-html?

It appears on that crate's license line in the CSV. It is not GPL, so it stays out of the copyleft summary unless you ask the prompt to flag OFL or CC licenses too.

### Do proc-macro crates count?

Yes. They are normal packages in `Cargo.lock` and appear in the CSV. They are not flagged differently from runtime crates unless their license is in the copyleft set.