Skip to main content
Glama

LicenseGuard

by io.github.rccaoki-wq
OverviewAdmin

Check a whole manifest

check_manifest_licenses
Read-onlyIdempotent

Scan an entire dependency manifest and report every dependency whose license creates an obligation for this shipping model. Use when reviewing a project as a whole, preparing for due diligence, or after a large dependency change. Pass a package-lock.json when one exists: problematic licenses usually arrive as transitive dependencies rather than ones you added directly, and only a lockfile reveals those.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
contentYesFull text of a lockfile, SBOM, or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, Gemfile.lock, packages.lock.json, CycloneDX (JSON), SPDX (JSON), package.json, requirements.txt, go.mod, Cargo.toml, .csproj, Directory.Packages.props, packages.config. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups. An SBOM covers several ecosystems in one document, but its licenses are read from the document rather than looked up, so they are only as current as the document.
distribution_modelYesHow the software incorporating this dependency reaches its users. This determines the answer: "saas" = users reach it over a network; "distributed-binary" = shipped as an app or binary; "on-prem-delivery" = installed in a customer environment; "internal-only" = never leaves your organization; "library-published" = released for others to depend on.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
summaryYesCounts by verdict. total is every dependency found, not only the ones that were resolved.
findingsYes
ecosystemNo
limitationsYesWhat this scan could not establish. Never empty when anything was left unresolved. Read it before treating a result as clean.
distributionModelNo

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Changed2 schema fields changed
    • changedInput schema / properties / content / description
      Previous value: -"Full text of a lockfile or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, Gemfile.lock, packages.lock.json, package.json, requirements.txt, go.mod, Cargo.toml, .csproj, Directory.Packages.props, packages.config. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups."New value: +"Full text of a lockfile, SBOM, or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, Gemfile.lock, packages.lock.json, CycloneDX (JSON), SPDX (JSON), package.json, requirements.txt, go.mod, Cargo.toml, .csproj, Directory.Packages.props, packages.config. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups. An SBOM covers several ecosystems in one document, but its licenses are read from the document rather than looked up, so they are only as current as the document."
    • changedOutput schema / properties / findings / items / properties / resolvedFrom / description
      Previous value: -"Where the license came from. \"lockfile\" is exact; \"registry\" and \"deps-dev\" are the pinned version as published; \"registry-latest\" means the pinned version could not be read and the latest release was used instead; \"not-checked\" means the lookup budget ran out and this dependency was never resolved; \"not-published\" means it is a git dependency, a member of the scanned workspace, or from a private registry, so no public registry has license data for it — re-scanning will not resolve those."New value: +"Where the license came from. \"lockfile\" is exact; \"sbom\" means it was written in the SBOM you pasted rather than looked up, so it is only as current as that document; \"registry\" and \"deps-dev\" are the pinned version as published; \"registry-latest\" means the pinned version could not be read and the latest release was used instead; \"not-checked\" means the lookup budget ran out and this dependency was never resolved; \"not-published\" means it is a git dependency, a member of the scanned workspace, or from a private registry, so no public registry has license data for it — re-scanning will not resolve those."
  2. Changed1 schema field changed
    • changedInput schema / properties / content / description
      Previous value: -"Full text of a lockfile or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, Gemfile.lock, package.json, requirements.txt, go.mod, Cargo.toml. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups."New value: +"Full text of a lockfile or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, Gemfile.lock, packages.lock.json, package.json, requirements.txt, go.mod, Cargo.toml, .csproj, Directory.Packages.props, packages.config. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups."
  3. Changed1 schema field changed
    • changedInput schema / properties / content / description
      Previous value: -"Full text of a lockfile or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, package.json, requirements.txt, go.mod, Cargo.toml. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups."New value: +"Full text of a lockfile or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, Gemfile.lock, package.json, requirements.txt, go.mod, Cargo.toml. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups."
  4. Changed1 schema field changed
    • changedOutput schema / properties / findings / items / properties / resolvedFrom / description
      Previous value: -"Where the license came from. \"lockfile\" is exact; \"registry\" and \"deps-dev\" are the pinned version as published; \"registry-latest\" means the pinned version could not be read and the latest release was used instead; \"not-checked\" means the lookup budget ran out and this dependency was never resolved."New value: +"Where the license came from. \"lockfile\" is exact; \"registry\" and \"deps-dev\" are the pinned version as published; \"registry-latest\" means the pinned version could not be read and the latest release was used instead; \"not-checked\" means the lookup budget ran out and this dependency was never resolved; \"not-published\" means it is a git dependency, a member of the scanned workspace, or from a private registry, so no public registry has license data for it — re-scanning will not resolve those."
  5. Changed1 schema field changed
    • changedOutput schema / properties / findings / items / properties / resolvedFrom / description
      Previous value: -"Where the license came from. \"lockfile\" is exact; \"registry-latest\" means the pinned version could not be read and the latest release was used instead; \"not-checked\" means the lookup budget ran out and this dependency was never resolved."New value: +"Where the license came from. \"lockfile\" is exact; \"registry\" and \"deps-dev\" are the pinned version as published; \"registry-latest\" means the pinned version could not be read and the latest release was used instead; \"not-checked\" means the lookup budget ran out and this dependency was never resolved."
  6. Changed1 schema field changed
    • changedOutput schema / (root)
      Previous value: -nullNew value: +{
+  "properties": {
+    "distributionModel": {
+      "type": "string"
+    },
+    "ecosystem": {
+      "type": "string"
+    },
+    "findings": {
+      "items": {
+        "properties": {
+          "ecosystem": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "obligations": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "rationale": {
+            "type": "string"
+          },
+          "resolvedFrom": {
+            "description": "Where the license came from. \"lockfile\" is exact; \"registry-latest\" means the pinned version could not be read and the latest release was used instead; \"not-checked\" means the lookup budget ran out and this dependency was never resolved.",
+            "type": "string"
+          },
+          "scope": {
+            "enum": [
+              "runtime",
+              "dev",
+              "build",
+              "test",
+              "optional"
+            ],
+            "type": "string"
+          },
+          "spdxExpression": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "verdict": {
+            "enum": [
+              "allowed",
+              "review",
+              "blocked"
+            ],
+            "type": "string"
+          },
+          "version": {
+            "type": [
+              "string",
+              "null"
+            ]
+          }
+        },
+        "required": [
+          "ecosystem",
+          "name",
+          "scope",
+          "verdict",
+          "obligations",
+          "rationale"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "limitations": {
+      "description": "What this scan could not establish. Never empty when anything was left unresolved. Read it before treating a result as clean.",
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "summary": {
+      "description": "Counts by verdict. total is every dependency found, not only the ones that were resolved.",
+      "properties": {
+        "allowed": {
+          "type": "number"
+        },
+        "blocked": {
+          "type": "number"
+        },
+        "review": {
+          "type": "number"
+        },
+        "total": {
+          "type": "number"
+        }
+      },
+      "required": [
+        "total",
+        "allowed",
+        "review",
+        "blocked"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "summary",
+    "findings",
+    "limitations"
+  ],
+  "type": "object"
+}
  7. Changed1 schema field changed
    • changedInput schema / properties / content / description
      Previous value: -"Full text of a package-lock.json, package.json, requirements.txt, or go.mod. The format is detected automatically. Prefer package-lock.json: it covers transitive dependencies, carries exact versions, and needs no registry lookups."New value: +"Full text of a lockfile or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, package.json, requirements.txt, go.mod, Cargo.toml. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups."
  8. First observed

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and non-destructive behavior. The description adds useful behavioral context beyond that: it reports every problematic dependency, depends on the shipping model, and highlights that transitive dependencies are only visible via lockfiles.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each earning its place: the first defines the action, the second gives usage scenarios, and the third adds a high-value parameter recommendation. The main action is front-loaded and no words are wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has a rich input schema, clear annotations, an output schema, and a description that covers purpose, usage timing, and parameter preferences. Nothing essential for an agent to select and invoke the tool correctly appears to be missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds practical guidance beyond the schema by recommending package-lock.json as the preferred content format and explaining why lockfiles are superior for exposing transitive dependencies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Scan an entire dependency manifest and report every dependency whose license creates an obligation for this shipping model.' It clearly differentiates from the likely single-dependency sibling check_dependency_license by emphasizing whole-manifest scope and 'every dependency.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit use contexts: 'reviewing a project as a whole, preparing for due diligence, or after a large dependency change.' It also advises passing a package-lock.json when available and explains why. However, it does not explicitly state when not to use it or name an alternative tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All LicenseGuard toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources