Licence-safe code reuse for agencies: why attribution matters when agents write the code
2026-10-27 · JustClaw-It
Agencies have always reused open-source code. What has changed is who does the copying. A coding agent can paste a webhook handler from a public repository into a client's codebase in seconds, and the copyright notice that the licence requires usually doesn't come along. Multiply that by every feature in every project, and the code you hand over contains material nobody can trace.
This post explains why that matters, what the common licences actually ask of you, and a practical workflow that keeps agent-driven reuse clean. It is general information, not legal advice; for a specific contract or dispute, talk to a lawyer.
Why agencies feel this more than anyone
- You hand the code over. Your contract probably says you deliver code the client may use, and often that you have the right to deliver it. Unattributed third-party code makes that promise hard to keep.
- Clients get audited. Funding rounds, acquisitions and enterprise sales often include an open-source review. Scanners match code against public repositories; a match with no licence record becomes a question for whoever wrote the code, often you, months after the project closed.
- You work across many codebases. One unclear snippet is easy to fix. A habit repeated across fifty client projects is not.
- The obligation is usually small. For most permissive licences, compliance is keeping a notice. The cost of doing it right is tiny; the cost of reconstructing it later is not.
What the common licences ask
| licence | what you must do when you reuse and ship the code |
|---|---|
| MIT | Include the copyright notice and the permission notice in all copies or substantial portions of the software. |
| BSD-2/BSD-3 | Keep the copyright notice, the conditions and the disclaimer in source; reproduce them in documentation for binary distributions. BSD-3 also bars using the authors' names to endorse your product. |
| Apache-2.0 | Give recipients a copy of the licence, mark files you changed, keep existing copyright, patent and attribution notices, and include the contents of any NOTICE file. It also includes an express patent licence. |
| MPL-2.0 (weak copyleft) | File-level: modified MPL files stay under MPL and their source must be available to people you distribute to. Your own files can be under any licence. |
| GPL (strong copyleft) | If you distribute a work based on GPL code, the whole work must be offered under the GPL, with source. Usually incompatible with closed client deliverables. |
| AGPL (network copyleft) | Like GPL, and users who interact with it over a network must be able to get the source. Very hard to use in client SaaS. |
| No licence | Default copyright: you have no permission to reuse it at all, however public the repository. |
Two takeaways. First, for permissive licences attribution is the obligation: keep the notice, ship the licence text. Second, the dangerous cases (strong copyleft, no licence) are the ones an agent can't tell apart from the safe ones by reading the code.
Where agents go wrong
- They copy the function, not the file header. The licence and copyright usually live at the top of a file or in a
LICENSEat the root of the repository. A snippet carries neither. - They don't check the licence first. Code-search results and web pages rarely state the licence of the code they show. Unless your agent is told to look, it won't.
- They mix sources silently. One file can end up with code from three repositories under three licences.
- Nobody records it. Even when a human notices, the source rarely makes it into a
THIRD_PARTY_LICENSESfile.
A workflow that keeps reuse clean
1. Write a licence policy, one paragraph long. For example: "Permissive licences (MIT, BSD, Apache-2.0, ISC) are allowed with attribution. Weak copyleft (MPL-2.0) only as separate, unmodified or clearly marked files. No GPL/AGPL or unlicensed code in client deliverables without sign-off." Put it in your agent instructions (CLAUDE.md, AGENTS.md, Cursor rules).
2. Filter at the source, before the agent reads code. The cheapest compliance step is never pulling code you can't ship. If your search tool can filter by licence, make the agent use it.
3. Keep the notice with the code. Every file that contains reused code keeps a header naming the source, licence and copyright holder. Agents are far more likely to keep a header that arrives with the code and that their instructions tell them to keep.
**4. Keep a THIRD_PARTY_LICENSES (or NOTICE) file per project.** One entry per reused component: source URL, licence, copyright holder. Apache-2.0 NOTICE contents go here too. This file is what you hand to an auditor.
5. Check at review time. Add one item to your pull-request checklist: "New third-party code is listed in THIRD_PARTY_LICENSES and keeps its header." If you use GitHub Copilot, its code referencing feature can also flag suggestions that match public code.
6. Cover dependencies separately. Packages from npm or PyPI are a different problem, best handled by your package manager's licence tooling and an SBOM. This workflow is about code that gets copied in, which those tools don't see.
7. Hand over the trail. Include the THIRD_PARTY_LICENSES file and your licence policy in the handover pack. It turns an audit question into a one-page answer.
How JustClaw-It helps, and where it stops
JustClaw-It was built around this workflow:
- Licence on every result. Each of the 1,459,645 components carries its SPDX licence, a copyleft flag, the copyright holder and the source repository, so the agent sees the licence before it pulls.
- Filtering up front.
license: "permissive"returns permissive code only. Strong copyleft and code with no clear licence are excluded from the public library altogether. - The header travels with the code. Pulled source starts with an attribution header; for weak-copyleft files it also says that changes stay under the original licence.
- A ready-made list.
list_licenses(and /licenses) lists every source repository, licence and copyright holder. - Skills that follow the workflow. The
justclaw-it-pullskill tells the agent to check the licence first, keep the header and record the component inTHIRD_PARTY_LICENSES.
And the limits, plainly:
- Licence data is collected automatically from each repository's licence files and metadata. It is usually right, but not guaranteed, and a repository can change its licence.
- You remain responsible for compliance in what you ship; JustClaw-It passes the licence and attribution on, it doesn't grant rights in the code (terms).
- It covers copied code, not your dependencies. Use your usual licence and SBOM tooling for packages.
- It is not a scanner for code your agent writes from scratch. A licence-cleared source of components reduces the problem; it doesn't audit everything else.
The one-line version
When an agent reuses open-source code, make it choose code whose licence you can ship, keep the notice the licence requires, and write down where it came from. That's most of licence compliance for agency work, and with the right tools it costs almost nothing.
Try JustClaw-It free (search is free, no card), or read Licences & attribution in the docs.