spdx-policy
SPDX license expression parse and policy check — Parses up to 50 SPDX license expressions (AND, OR, WITH exceptions, + or-later, LicenseRef) and evaluates each against a caller policy (allow list, deny list, allowed exceptions, OSI/FSF flags, copyleft tier) for agents vetting dependency licenses. Returns the canonical expression, per-license flags from the pinned SPDX License List, the verdict, and which licenses satisfy an OR. Does not detect l
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"expressions": "<expressions>"
},
"name": "spdx-policy"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| deny | No | SPDX ids that always fail. | |
| allow | No | If non-empty, only these SPDX ids pass (GPL-2.0-only and GPL-2.0 are the same entry; GPL-2.0+ means or-later and must be listed as such). | |
| expressions | Yes | SPDX expressions, e.g. 'MIT OR (GPL-2.0-only WITH Classpath-exception-2.0)'. | |
| denyCopyleft | No | Id-family heuristic: strong = GPL/AGPL/SSPL/EUPL/OSL/CC-BY-SA; any adds LGPL/MPL/EPL/CDDL and similar. | |
| allowDeprecated | No | Default true: deprecated ids only add a witness. false: they fail. | |
| allowExceptions | No | If non-empty, only these WITH exception ids pass. | |
| requireFsfLibre | No | Fail licenses without isFsfLibre in the SPDX list. | |
| allowLicenseRefs | No | LicenseRef-* ids the caller has reviewed; other refs yield unknown. | |
| requireOsiApproved | No | Fail licenses without isOsiApproved in the SPDX list. |