AI-generated code · licensing
Point-in-time senior review of copyleft, GPL-family, and incompatible OSS risk in Copilot, Cursor, and Claude Code output. Including generated snippets a lockfile scan never sees. Written findings. Not legal advice. Not a scanner dump.
Software composition analysis reads declared packages. Assistants also paste functions that never become a dependency. Maxiom’s AI-generated code licensing review is a productized, point-in-time inspection of a defined scope: lockfiles, vendored files, headers, and generated helpers that a scanner cannot attribute. Named engineer. Read-only access. Client code stays in your environment. Counsel still owns compatibility. We write what is in the tree. The editorial on why this gap exists is Copilot does not check the license. If the questionnaire is SOC 2 change management rather than copyleft, use the SOC 2 AI code audit. Broader security and architecture still start at the AI Code Audit.
The problem
Lockfile licenses are not lineage. Generated snippets never show up as a package. Diligence still asks who looked at the function body.
Git blame points at a staff engineer. The staff engineer points at Copilot. There is no flag. There is a payments helper in main.
Generated docs survive because they sound finished. A buyer will ask for the header, the NOTICE file, and the product license. If those disagree, the document is the liability.
What we inspect
Engineers with 10-plus years of production experience. Scope agreed up front. Since 2002, $100M+ in contract value, 221+ clients, Clutch-reviewed. That is delivery history, not a claim we audited your SPDX file last year.
Manifests, lockfiles, and transitive copyleft a first-party package pulled in
Helpers that never became a named package, especially on payments, auth, and crypto paths
GPL-family headers inside a tree that claims MIT or Apache
Imports that later resolved to a registry identity nobody intended to take
NOTICE / LICENSE / README statements that disagree with what shipped
Severity, path, why a scanner missed it, what to do next. Named engineer.
Free resource
A practical review list for teams shipping with Copilot, Cursor, and other AI coding tools. Covering security, architecture, compliance, and code quality.
Counsel wants lineage, not a 40-page MIT/Apache dump. You need a senior pass on generated code before the next session.
A scanner flagged a file nobody remembers adding. Copilot was on. You need to know whether it is an isolated helper or a pattern.
A buyer asked how AI coding tools affect your license posture. “We review every PR” is not the exhibit.
Kickoff
We map the product license you claim to ship, which assistants are in use, and which repos the diligence folder actually cares about.
You get: agreed licensing scope
Least-privilege repository access. We do not upload your tree to a license-detection model.
You get: a bounded intake
Declared packages, generated snippets, headers, and notices against the license you say you ship.
You get: lineage notes, not a legal opinion
Written report, live walkthrough with engineering and counsel if they join, and a split between hygiene (keep scanning) and inspection (what the scanner missed).
You get: an artifact counsel can actually use
A fixed-scope senior inspection of whether Copilot, Cursor, Claude Code, or similar tools introduced copyleft, proprietary, or otherwise incompatible licensed material into your repository, including snippets that never appeared as a named package. Delivered as written findings, typically within 5–10 business days after read-only access.
No. Engineering findings. Counsel decides whether you can ship, what notices are required, and how to remediate. If you need an opinion letter, that is a law firm. We tell you what is in the tree.
Those tools are hygiene for declared dependencies. They do not read whether a generated helper is a close copy of GPL code that never became a package. Run the scanner. Do not hand it to a buyer as the license program.
Same inspection model, access, and timeline. An AI code audit covers security, architecture, compliance, tests, and licensing. This landing is for teams whose forcing function is the open-source folder in diligence, a GPL hit they cannot explain, or an OSS exhibit. Both can convert into the same senior review if the scope widens.
No. Client code stays in client environments. Inspection is a named senior engineer. Scanners you already run can stay in CI.
No. You have to stop pretending a “we do not use GPL” paragraph describes a year of unreviewed assistant output. Ban the tools if you want. Inspect the tree either way.
Copyleft and proprietary are the diligence magnets (GPL, LGPL, AGPL, and similar). Permissive licenses (MIT, Apache, BSD) still need notices. We report what we find against the licenses you say the product ships under. We do not invent a forbidden-license list for a stack we have not scoped.
Yes. Buyers ask how you know AI-assisted code did not introduce licenses you cannot ship. A severity-ranked findings report from a named engineer is the artifact. A policy PDF is not.
The copyleft question stays. The access model is not a generic SaaS review. Say PHI on the scoping call. Healthcare product work is Maxiom Labs (https://www.maxiomlabs.com/).
A 30-minute scoping call, then written scope and NDA. Read-only repository access. Initial findings typically within five business days after access, full report and debrief commonly inside 5–10 business days.
Most reviews deliver findings within 5–10 business days after access. Start with a 30-minute scoping call. We will say if a scanner export is enough, or if it is not.
Related services & resources
AI-generated code licensing
Response within 1 business day
