A no copyleft clause has no single technical meaning. Engineers should ask the contract owner which license families it names, whether it covers distributed code or hosted services too, and then turn the answer into a scan rule. This is general information, not legal advice.
Start with what copyleft is
Copyleft licenses ask for source sharing or the same terms when you distribute a work that includes covered code, and they differ in strength. The MPL FAQ describes a file level copyleft. The LGPL has rules for Combined Works. The GPL applies to the covered work when conveyed. The AGPL adds an obligation tied to remote network interaction. A clause that says "no copyleft" without a list leaves all of that open.
Questions to ask the contract owner
- Which licenses are named, or is there a definition?
- Does the clause cover only code we deliver to the customer, or also our hosted service?
- Does it cover build tools and test tools?
- Is weak copyleft such as MPL or LGPL included?
- Is there an exception process?
Write the answers next to the contract in your records.
Turn answers into a rule
| Contract wording | Likely technical rule |
|---|---|
| No GPL in delivered software | Deny GPL families in shipped artifacts |
| No copyleft of any kind | Deny GPL, LGPL, AGPL, MPL and similar in shipped artifacts, review hosted |
| No AGPL in hosted code | Deny AGPL in the service repositories |
| Silent on dev tools | Allow build only, document the reading |
The table is an illustration, not a standard interpretation. Your counsel and the customer define the real scope.
Why shipped versus hosted matters
The GPLv3 text says to convey a work means any propagation that enables other parties to make or receive copies, and that mere interaction with a user through a computer network, with no transfer of a copy, is not conveying. The AGPL changes this for modified programs by requiring that remote users be offered the source. So a hosted service that runs unmodified GPL code is a different case from one that modifies AGPL code. Which license is involved changes the answer.
Evidence for the customer
Offer the shipped inventory with licenses, the rule you enforce, and the scan result. A customer reviewing a clause usually wants proof of process more than a promise. See answering open source license questions in security questionnaires.
Enforce it where it counts
A rule that runs on pull requests catches the problem before release. Safeguard policies and gates can block a merge on a license rule, with SBOM and dependency scanning supplying the component data. Interpreting the clause itself stays with counsel.
Quick check
Does no copyleft include LGPL?
Only if the contract says so or defines it that way. Ask. LGPL is a copyleft family, but contracts differ.
Does a hosted service count as delivery?
Under the GPLv3 text, network interaction alone is not conveying, but the AGPL has a separate network clause. The contract wording decides what counts, so confirm it.
Sources
- Open Source Initiative, GPL 3.0 text
- Open Source Initiative, AGPL 3.0 text
- Open Source Initiative, LGPL 3.0 text
- Mozilla, MPL 2.0 FAQ
Last reviewed: 19 October 2026.
