License MCP Server - The Hard Way

Build an MCP server that answers "what licenses are my dependencies under, and can I ship this?" from a project's lockfiles, mostly offline. You write the SPDX parser, the installed-package readers, the lockfile parsers, the messy-string normaliser, the compatibility table and the policy engine yourself, then put MCP in front of them and test the whole thing over real stdio.

At the end you will have built a minimal version of license-mcp and you will understand the parts most "dependency checker" tutorials skip:

• where a license answer really comes from (installed metadata beats lockfile beats network) and why a report must say which one it used;

• what "unknown" means and why it must never be guessed into "MIT";

• how to make an ambiguity visible instead of silently resolving it;

• how to design a compatibility table you can defend (ordered rules with reasons, not a mystery matrix);

• how to design verdicts (ok / needs review / violation) so that every one has a reason.

Who this is for

Developers who have built a "hello world" MCP server and want a real one; anyone who has been asked "are we allowed to ship this?" and wants an agent that can answer with evidence.

Prerequisites: Python 3.10+ and pip install -r requirements.txt. Nothing else: no network, no QEMU, no external tools. (Module 03 reads lockfiles that were generated with uv and npm; they are committed in fixtures/.)

Related MCP server: license-guardian

Modules

Each module contains:

• README.md: the concepts and the design decisions

• main.py: working, commented code that checks its own results with assert

• break-it.md: challenges that break your code, with hints

How to use this course

Build along: read a module, run its main.py, do the break-it challenges. Reference: jump to a module; modules 04-07 load the earlier main.py files by path, so keep the directory together.

Run everything the way CI does:

pip install -r requirements.txt
python verify.py          # all modules
python verify.py 03 05    # just these

verify.py runs each main.py as a child process (with PYTHONIOENCODING=utf-8, so Windows consoles do not crash on non-ASCII) and fails if any assertion fails. CI runs it on Ubuntu and Windows.

License

MIT