The evidence, not a summary of it
Every dependency, every license, every role
Apache-2.0, and every engine underneath it is BSD, MIT, Apache or MPL. Nothing AGPL or GPL is on the call graph. This is the full 31-package inventory the home page's licensing summary is computed from, not a rewording of it.
The mechanism. The guarantee is a CI job and a unit test, not a promise in a README: the license gate fails the build on any AGPL, GPL or LGPL package in the distributed closure, and a source-level test walks every file under src/ for forbidden imports and subprocess shell-outs. The realistic leak in a PDF tool is a convenience shell-out, which a package-level license scan structurally cannot see.
The derivation. The table below is website/src/data/licenses.json, generated by make licenses against a pinned Linux/CPython measurement environment and diffed in CI on every pull request. The default install closure computed from it is 21 packages, the optional [html] extra adds 10 more, 31 in total, not the 22 and 11 a naive cross-platform dependency export would suggest. colorama (Windows-only, pulled in by typer/click) and brotlicffi (non-CPython only) do not resolve on the platform pdf-tooling’s own supported-platform classifiers name, so the count computed from what actually resolves is the honest one. See website/README.md for the full derivation.
The caveat this page names rather than rounds away. Nothing in the default install carries a GPL-family license at all, and the single row in the whole inventory that names one, pyphen 0.18.1, is optional (the [html] extra) and is tri-licensed: GPLv2+, LGPLv2+ or MPL 1.1, a taker's choice.
Pygments
Version 2.21.0
License BSD-2-Clause
Tier default install
Role pulled in by rich
annotated-doc
Version 0.0.5
License MIT
Tier default install
Role pulled in by typer
brotli
Version 1.2.1
License MIT
Tier optional · [html] extra
Role pulled in by fonttools
cffi
Version 2.1.1
License MIT-0
Tier default install
Role pulled in by cryptography, weasyprint
charset-normalizer
Version 3.5.1
License MIT
Tier default install
Role pulled in by pdfminer.six, reportlab
cryptography
Version 50.0.1
License Apache-2.0 OR BSD-3-Clause
Tier default install
Role AES-256 encryption backing pypdf[crypto]
cssselect2
Version 0.9.0
License BSD License
Tier optional · [html] extra
Role pulled in by weasyprint
fonttools
Version 4.63.0
License MIT
Tier optional · [html] extra
Role pulled in by weasyprint
lxml
Version 6.1.2
License BSD-3-Clause
Tier default install
Role pulled in by pikepdf
markdown-it-py
Version 4.2.0
License MIT License
Tier default install
Role pulled in by rich
mdurl
Version 0.1.2
License MIT License
Tier default install
Role pulled in by markdown-it-py
packaging
Version 26.3
License Apache-2.0 OR BSD-2-Clause
Tier default install
Role pulled in by pikepdf, pytesseract
pdfminer.six
Version 20260107
License MIT
Tier default install
Role layout analysis engine behind pdfplumber
pdfplumber
Version 0.11.10
License MIT License
Tier default install
Role layout-aware text, tables
pikepdf
Version 10.17.0
License MPL-2.0
Tier default install
Role repair, linearize, object-stream compression, robust encryption
pillow
Version 13.0.0
License MIT-CMU
Tier default install
Role image plumbing, downsampling for compression
pycparser
Version 3.0
License BSD-3-Clause
Tier default install
Role pulled in by cffi
pydyf
Version 0.12.1
License BSD License
Tier optional · [html] extra
Role pulled in by weasyprint
pypdf
Version 6.21.2
License BSD-3-Clause
Tier default install
Role merge, split, reorder, rotate, metadata, bookmarks, watermark overlay, encrypt/decrypt
pypdfium2
Version 5.14.0
License BSD-3-Clause, Apache-2.0, dependency licenses
Tier default install
Role PDF to images, page rendering, fast plain-text extraction
pyphen
Version 0.18.1
License GNU General Public License v2 or later (GPLv2+); GNU Lesser General Public License v2 or later (LGPLv2+); Mozilla Public License 1.1 (MPL 1.1)
Tier optional · [html] extra
Role pulled in by weasyprint
pytesseract
Version 0.3.13
License Apache Software License
Tier default install
Role OCR driver for the tesseract binary
reportlab
Version 5.0.1
License BSD License
Tier default install
Role create PDFs from scratch, images to PDF (lossless DCTDecode embed)
rich
Version 15.0.0
License MIT License
Tier default install
Role pulled in by typer
shellingham
Version 1.5.4
License ISC License (ISCL)
Tier default install
Role pulled in by typer
tinycss2
Version 1.5.1
License BSD License
Tier optional · [html] extra
Role pulled in by cssselect2, weasyprint
tinyhtml5
Version 2.1.0
License MIT License
Tier optional · [html] extra
Role pulled in by weasyprint
typer
Version 0.27.3
License MIT
Tier default install
Role CLI surface
weasyprint
Version 70.0
License BSD License
Tier optional · [html] extra
Role optional HTML/Markdown to PDF ([html] extra, Phase 2)
webencodings
Version 0.6.1
License BSD License
Tier optional · [html] extra
Role pulled in by cssselect2, tinycss2, tinyhtml5
zopfli
Version 0.4.3
License Apache Software License
Tier optional · [html] extra
Role pulled in by fonttools
Tier is which install pulls a package in. Role answers "why is this package here": a direct dependency names what it does for pdf-tooling; a transitive one names what pulls it in.
Audit it yourself
Clone the repository, run make licenses, and diff the result against this page's own source data. That diff is the same one CI's license-gate job runs on every pull request. The complete pip-licenses output is tracked at the repository root as THIRD_PARTY_LICENSES.