Skip to main content
Glama

License Check

CI npm downloads OpenSSF Scorecard License: MIT

Can I use this dependency? License questions come up every time an agent adds a package, and models answer them from memory, which blurs the cases that matter: Apache-2.0 code may go into a GPL-3.0 project but not a GPL-2.0-only one; an MIT project cannot absorb GPL code; LGPL depends on how it is linked. License Check answers from authoritative data:

  • Compatibility of any license or SPDX expression (MIT OR GPL-3.0-only, GPL-2.0-only WITH Classpath-exception-2.0) with your project's license, from the OSADL license compatibility matrix with its reason: yes, no, or check (it depends on how the code is combined). For a proprietary project, by copyleft class. OR takes the option that works; AND needs every part.

  • Dependencies in one call: the declared licenses of up to 50 packages (npm, PyPI, crates.io, Go, Maven, NuGet) from deps.dev, checked against your license, copyleft ones flagged.

  • Identification: the SPDX id for "Apache License 2.0", "GPLv3", "New BSD" or a deprecated id, with OSI approval, FSF status, copyleft class and OSADL's obligations checklist.

Licenses outside OSADL's matrix (Creative Commons, source-available licenses such as BUSL and SSPL) are judged by their kind and say so. This is information, not legal advice. No key needed.

Built and maintained by Arhan Canli.

Install

Install in Cursor Install in VS Code Install in Goose

Needs Node.js 20 or newer. No account or key.

Claude Code

claude mcp add license-check -- npx -y license-check-mcp

Claude Desktop: download license-check-mcp-<version>.mcpb from the latest release and open it. The bundle is signed; verify it with gh attestation verify <file> --repo arhancanli/license-check-mcp.

Any other client (Windsurf, Zed, Cline, Continue and others), in its MCP config file:

{
  "mcpServers": {
    "license-check": {
      "command": "npx",
      "args": [
        "-y",
        "license-check-mcp"
      ]
    }
  }
}

Docker

docker build -t license-check-mcp https://github.com/arhancanli/license-check-mcp.git && docker run -i --rm license-check-mcp

Hosted (Streamable HTTP): node src/server.mjs --http serves stateless MCP at POST /mcp (port from PORT, default 3000).

Related MCP server: gridwork-license

Example

An agent calls check_compatibility with:

{
  "project": "GPL-2.0-only",
  "licenses": [
    "Apache-2.0",
    "MIT",
    "MIT OR GPL-3.0-only",
    "GPL-2.0-only WITH Classpath-exception-2.0",
    "LGPL-2.1-or-later",
    "Foo License"
  ]
}

and gets back (recorded from the live server on 2026-09-26):

{
  "project": "GPL-2.0-only",
  "counts": {
    "no": 1,
    "unknown": 1,
    "check": 1,
    "yes": 3
  },
  "results": [
    {
      "license": "Apache-2.0",
      "verdict": "no",
      "copyleft": "No",
      "reason": "Incompatibility of the Apache-2.0 license with the GPL-2.0-only license is explicitly stated in the GPL-2.0-only license checklist."
    },
    {
      "license": "Foo License",
      "verdict": "unknown",
      "reason": "\"Foo License\" is not a license SPDX lists; check its terms by hand."
    },
    {
      "license": "LGPL-2.1-or-later",
      "verdict": "check",
      "copyleft": "Yes (restricted)",
      "reason": "Depending compatibility of the LGPL-2.1-or-later license with the GPL-2.0-only license is explicitly stated in the GPL-2.0-only license checklist. Interpretation: LGPL-2.1-or-later licensed material must first be relicensed under GPL-2.0-only before compatibility with other GPL-2.0 licensed material can be established."
    },
    {
      "license": "MIT",
      "verdict": "yes",
      "copyleft": "No",
      "reason": "Compatibility of the MIT license with the GPL-2.0-only license is explicitly stated in the GPL-2.0-only license checklist."
    },
    {
      "license": "MIT OR GPL-3.0-only",
      "expression": "(MIT OR GPL-3.0-only)",
      "verdict": "yes",
      "via": "MIT",
      "reason": "Compatibility of the MIT license with the GPL-2.0-only license is explicitly stated in the GPL-2.0-only license checklist.",
      "note": "You may choose any of: MIT (yes), GPL-3.0-only (no)."
    },
    {
      "license": "GPL-2.0-only WITH Classpath-exception-2.0",
      "verdict": "yes",
      "copyleft": "Yes",
      "reason": "The same license.",
      "note": "GPL-2.0-only WITH Classpath-exception-2.0: the exception relaxes the license's conditions."
    }
  ],
  "note": "Not legal advice: verdicts follow OSADL's license compatibility matrix."
}

Tools

Tool

What it does

check_compatibility

Whether code under each of up to 100 licenses or SPDX expressions (MIT OR GPL-3.0-only, GPL-2.0-only WITH Classpath-exception-2.0) may be included in a project under yours (an SPDX id, or 'proprietary'): yes, no or check, with OSADL's reason. Worst first.

license_info

Identifies up to 20 licenses however they are written ("Apache License 2.0", "GPLv3", "New BSD", deprecated SPDX ids): SPDX id and name, OSI approved, FSF free, copyleft class and source-disclosure duty (OSADL), links to the text and OSADL's obligations checklist.

package_licenses

Looks up the licenses of up to 50 packages (npm, PyPI, crates.io, Go, Maven, NuGet; a version, or the latest) and, with project, whether each fits your license (yes, no, check). Copyleft ones are flagged. Worst first.

How it behaves

  • Read-only: no tool changes anything outside this process.

  • Network: HTTPS only, to the hosts listed in package.json under factory.allowHosts, with a deadline, a size cap and bounded retries. Nothing else is contacted, and nothing is logged except unexpected failures (to stderr, without your inputs).

  • The SPDX list and OSADL's data are downloaded once and kept for a day (OSADL's matrix with reasons is 3.5 MB, so the first call takes a few seconds).

  • Results are compact JSON with a matching output schema, worst verdict first.

Benchmark

Measured 2026-09-26 with gpt-5.4-mini, 9 fixed tasks graded by fixed checks (bench/tasks.json, raw results in bench/results/).

Server

Correct

Input tokens

Output tokens

Tool calls

Median time

This server

9/9

10760

342

9

2.5 s

mcp-server-fetch reading license sources (no license server exists; this is what agents use today)

6/9

75485

1686

42

17.7 s

Performance

Measured 2026-09-26 from Dubai, home connection against the live upstream, Node 24.19.0 (bench/perf.json, scripts/perf.mjs in the factory).

Call

First call

Repeat

Result size

check_compatibility: 6 licenses in a GPL-2.0-only project

2663 ms

0.3 ms

1,602 chars

check_compatibility: a proprietary project, copyleft and content licenses

5308 ms

0.5 ms

1,485 chars

license_info: 6 licenses written informally

2206 ms

0.5 ms

1,913 chars

package_licenses: 4 packages against MIT

3157 ms

0.3 ms

657 chars

First call: a fresh server process, including the TLS connection and the upstream's own time. Repeat: the same call again, answered from the in-process cache, so it shows this server's own overhead.

Tool definitions the model reads on every turn (name, description, input schema): 1,720 characters, against 1,105 for mcp-server-fetch reading license sources (no license server exists; this is what agents use today). The full tool list, with the output schemas and annotations clients use to validate results, is 2,963 characters (1,104 for the alternative).

Data sources

More MCP servers by Arhan Canli

  • Actions Check: Checks GitHub Actions workflows: outdated actions, old Node runtimes, retired runners, injection.

  • Cron Check: Explains cron expressions, lists next run times in any time zone, converts between cron dialects.

  • Domain Health: Email and domain checks: SPF lookup limits, DKIM keys, DMARC, DNS records, registration expiry.

  • End of Life: Is this version still supported? EOL dates, latest patch and upgrade target for 470+ products.

  • Internet Standards: RFC sections, status, obsoleted-by chains, errata and IANA registries for coding agents.

  • Package Truth: Checks packages exist before install: version, deprecation, vulnerabilities, licence. 7 ecosystems.

  • Release Notes: What changed between two versions of a package: breaking changes, deprecations, security fixes.

  • Citation Check: Verifies citations: finds fabricated or mismatched references and retractions, returns clean BibTeX.

  • The whole collection, 7 more

License

MIT, Copyright (c) 2026 Arhan Canli.

Available Tools

3 tools
check_compatibilityCan these licenses go in my project?A
Read-onlyIdempotent

Whether code under each of up to 100 licenses or SPDX expressions (MIT OR GPL-3.0-only, GPL-2.0-only WITH Classpath-exception-2.0) may be included in a project under yours (an SPDX id, or 'proprietary'): yes, no or check, with OSADL's reason. Worst first.

ParametersJSON Schema
NameRequiredDescriptionDefault
projectYesyour project's license
licensesYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
countsYes
projectYes
resultsYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only, open-world, idempotent, and non-destructive behavior. The description adds useful behavioral details beyond that: it accepts up to 100 licenses, returns yes/no/check with OSADL's reason, and orders results worst first. This gives the agent a clear picture of what the tool will do.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense sentence that front-loads the core purpose and packs in limits, examples, output values, and ordering. Every clause earns its place, with no redundant filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists and annotations cover safety and open-world behavior, the description covers the remaining essentials: input formats, cardinality, output categories, reason source, and ordering. An agent has enough to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 50%, but the description compensates by explaining both parameters: 'project' is an SPDX id or 'proprietary', and 'licenses' can include SPDX expressions with examples. This adds meaning beyond the schema, especially for the licenses array which lacks a schema description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: it checks whether code under each of up to 100 licenses may be included in a project under a given license, returning yes/no/check. This clearly distinguishes it from siblings like license_info and package_licenses by focusing on compatibility rather than information lookup or package scanning.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear context: use this when you need to evaluate whether multiple licenses or SPDX expressions are compatible with a project license. It does not explicitly name alternatives or state when not to use it, but the scenario is specific enough that an agent can infer the intended use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

license_infoIdentify licensesA
Read-onlyIdempotent

Identifies up to 20 licenses however they are written ("Apache License 2.0", "GPLv3", "New BSD", deprecated SPDX ids): SPDX id and name, OSI approved, FSF free, copyleft class and source-disclosure duty (OSADL), links to the text and OSADL's obligations checklist.

ParametersJSON Schema
NameRequiredDescriptionDefault
licensesYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultsYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only, open-world, idempotent, and non-destructive behavior. The description adds useful context beyond that: it accepts 'however they are written', including deprecated SPDX IDs, and caps at 20 licenses. It does not address invalid-input behavior, but the annotation coverage lowers the burden.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence that front-loads the core purpose and then lists output attributes compactly. There is no filler or repetition of schema details, every clause adds meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With one simple array parameter, a true output schema, and comprehensive annotations, the description provides all needed context for correct invocation. It covers input flexibility, capacity, and the scope of the returned information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides zero description for the 'licenses' parameter, so the description carries the full burden. It compensates effectively with concrete examples ('Apache License 2.0', 'GPLv3', 'New BSD') and clarifies that deprecated SPDX ids are accepted, making the semantics of the string array clear.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Identifies') and the resource ('up to 20 licenses'), and lists the specific output fields (SPDX id/name, OSI/FSF status, copyleft class, OSADL obligations). It signals the tool normalizes arbitrary license strings, which helps distinguish it from siblings, though it does not explicitly name them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this is the tool to use when you have license strings in varied or deprecated formats and need normalized identification. However, it gives no explicit guidance about when to use alternatives like check_compatibility or package_licenses, nor any exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

package_licensesLicenses of packagesA
Read-onlyIdempotent

Looks up the licenses of up to 50 packages (npm, PyPI, crates.io, Go, Maven, NuGet; a version, or the latest) and, with project, whether each fits your license (yes, no, check). Copyleft ones are flagged. Worst first.

ParametersJSON Schema
NameRequiredDescriptionDefault
projectNoyour project's license
packagesYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultsYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the agent knows it's a safe read. The description adds meaningful behavioral details beyond annotations: the limit of 50, the list of ecosystems, optional version handling, the yes/no/check compatibility result, copyleft flagging, and the 'worst first' ordering. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, dense sentence with no filler. It front-loads the core action and then lists specifics efficiently. Every clause adds information: the package count, ecosystems, version handling, compatibility check, copyleft flag, and sorting. No redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (multiple ecosystems, version logic, compatibility assessment, copyleft flagging, ordering), the description covers all essential behaviors an agent needs to call it correctly. The output schema exists, so return format is handled elsewhere. The only minor omission is the exact meaning of 'check' in the compatibility result, but that's likely defined in the output schema and does not impede correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 50% (project has a description, packages does not). The description compensates by explaining the ecosystem list and that a version is optional ('a version, or the latest'), which clarifies the packages parameter's sub-fields. However, it doesn't explicitly map each schema field (name, version, ecosystem) to their roles, but the structure is obvious from the schema. The added value is moderate and helpful.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Looks up'), a clear resource ('licenses of packages'), and enumerates supported ecosystems and the optional version or latest behavior. It also explains the compatibility check and sorting ('Worst first'), which clearly distinguishes it from sibling tools like license_info (which likely just returns license data) and check_compatibility (which might check specific compatibility rules).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context: up to 50 packages, which ecosystems, and that it checks compatibility against a project license when 'project' is provided. It implies when to use (when you need license compatibility screening) but does not explicitly name alternatives or exclusions. Sibling tools exist but are not referenced, so there's a slight gap in routing, but the context is strong enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updatesv0.1.0
    • First observedcheck_compatibility
    • First observedlicense_info
    • First observedpackage_licenses

TDQS

A4.5/5.0

Scored across 3 tools

Disambiguation5/5

Each tool has a distinct purpose: identifying license texts, checking license compatibility, and looking up package licenses. No overlap or ambiguity between them.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern: check_compatibility, license_info, package_licenses. The naming is predictable and clear.

Tool Count5/5

With only 3 tools, the server is tightly scoped to its purpose of license checking. Each tool is essential and there is no bloat or missing core functionality.

Completeness5/5

The three tools cover the full lifecycle of license checking: identifying licenses, verifying compatibility, and fetching package licenses. No obvious gaps for the stated domain.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    A
    quality
    D
    maintenance
    Analyzes software licenses using Scancode data to help users identify problematic licenses, affected files, and compliance issues through the Model Context Protocol.
    5
    -
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables lookup, search, and retrieval of open-source license information using the SPDX license list, with tools for finding licenses by ID or keyword and fetching full license text.
    1 npm
    MIT