License Check

Can I use this dependency? License questions come up every time an agent adds a package, and models answer them from memory, which blurs the cases that matter: Apache-2.0 code may go into a GPL-3.0 project but not a GPL-2.0-only one; an MIT project cannot absorb GPL code; LGPL depends on how it is linked. License Check answers from authoritative data:

• Compatibility of any license or SPDX expression (MIT OR GPL-3.0-only, GPL-2.0-only WITH Classpath-exception-2.0) with your project's license, from the OSADL license compatibility matrix with its reason: yes, no, or check (it depends on how the code is combined). For a proprietary project, by copyleft class. OR takes the option that works; AND needs every part.

• Dependencies in one call: the declared licenses of up to 50 packages (npm, PyPI, crates.io, Go, Maven, NuGet) from deps.dev, checked against your license, copyleft ones flagged.

• Identification: the SPDX id for "Apache License 2.0", "GPLv3", "New BSD" or a deprecated id, with OSI approval, FSF status, copyleft class and OSADL's obligations checklist.

Licenses outside OSADL's matrix (Creative Commons, source-available licenses such as BUSL and SSPL) are judged by their kind and say so. This is information, not legal advice. No key needed.

Built and maintained by Arhan Canli.

Install

Needs Node.js 20 or newer. No account or key.

Claude Code

claude mcp add license-check -- npx -y license-check-mcp

Claude Desktop: download license-check-mcp-<version>.mcpb from the latest release and open it. The bundle is signed; verify it with gh attestation verify <file> --repo arhancanli/license-check-mcp.

Any other client (Windsurf, Zed, Cline, Continue and others), in its MCP config file:

{
  "mcpServers": {
    "license-check": {
      "command": "npx",
      "args": [
        "-y",
        "license-check-mcp"
      ]
    }
  }
}

Docker

docker build -t license-check-mcp https://github.com/arhancanli/license-check-mcp.git && docker run -i --rm license-check-mcp

Hosted (Streamable HTTP): node src/server.mjs --http serves stateless MCP at POST /mcp (port from PORT, default 3000).

Related MCP server: mcp-licenses

Example

An agent calls check_compatibility with:

{
  "project": "GPL-2.0-only",
  "licenses": [
    "Apache-2.0",
    "MIT",
    "MIT OR GPL-3.0-only",
    "GPL-2.0-only WITH Classpath-exception-2.0",
    "LGPL-2.1-or-later",
    "Foo License"
  ]
}

and gets back (recorded from the live server on 2026-09-26):

{
  "project": "GPL-2.0-only",
  "counts": {
    "no": 1,
    "unknown": 1,
    "check": 1,
    "yes": 3
  },
  "results": [
    {
      "license": "Apache-2.0",
      "verdict": "no",
      "copyleft": "No",
      "reason": "Incompatibility of the Apache-2.0 license with the GPL-2.0-only license is explicitly stated in the GPL-2.0-only license checklist."
    },
    {
      "license": "Foo License",
      "verdict": "unknown",
      "reason": "\"Foo License\" is not a license SPDX lists; check its terms by hand."
    },
    {
      "license": "LGPL-2.1-or-later",
      "verdict": "check",
      "copyleft": "Yes (restricted)",
      "reason": "Depending compatibility of the LGPL-2.1-or-later license with the GPL-2.0-only license is explicitly stated in the GPL-2.0-only license checklist. Interpretation: LGPL-2.1-or-later licensed material must first be relicensed under GPL-2.0-only before compatibility with other GPL-2.0 licensed material can be established."
    },
    {
      "license": "MIT",
      "verdict": "yes",
      "copyleft": "No",
      "reason": "Compatibility of the MIT license with the GPL-2.0-only license is explicitly stated in the GPL-2.0-only license checklist."
    },
    {
      "license": "MIT OR GPL-3.0-only",
      "expression": "(MIT OR GPL-3.0-only)",
      "verdict": "yes",
      "via": "MIT",
      "reason": "Compatibility of the MIT license with the GPL-2.0-only license is explicitly stated in the GPL-2.0-only license checklist.",
      "note": "You may choose any of: MIT (yes), GPL-3.0-only (no)."
    },
    {
      "license": "GPL-2.0-only WITH Classpath-exception-2.0",
      "verdict": "yes",
      "copyleft": "Yes",
      "reason": "The same license.",
      "note": "GPL-2.0-only WITH Classpath-exception-2.0: the exception relaxes the license's conditions."
    }
  ],
  "note": "Not legal advice: verdicts follow OSADL's license compatibility matrix."
}

Tools

How it behaves

• Read-only: no tool changes anything outside this process.

• Network: HTTPS only, to the hosts listed in package.json under factory.allowHosts, with a deadline, a size cap and bounded retries. Nothing else is contacted, and nothing is logged except unexpected failures (to stderr, without your inputs).

• The SPDX list and OSADL's data are downloaded once and kept for a day (OSADL's matrix with reasons is 3.5 MB, so the first call takes a few seconds).

• Results are compact JSON with a matching output schema, worst verdict first.

Benchmark

Measured 2026-09-26 with gpt-5.4-mini, 9 fixed tasks graded by fixed checks (bench/tasks.json, raw results in bench/results/).

Performance

Measured 2026-09-26 from Dubai, home connection against the live upstream, Node 24.19.0 (bench/perf.json, scripts/perf.mjs in the factory).

First call: a fresh server process, including the TLS connection and the upstream's own time. Repeat: the same call again, answered from the in-process cache, so it shows this server's own overhead.

Tool definitions the model reads on every turn (name, description, input schema): 1,720 characters, against 1,105 for mcp-server-fetch reading license sources (no license server exists; this is what agents use today). The full tool list, with the output schemas and annotations clients use to validate results, is 2,963 characters (1,104 for the alternative).

Data sources

• SPDX License List (CC0).

• OSADL Open Source License Checklists: compatibility matrix with explanations, copyleft classification, source-disclosure duties. CC BY 4.0, "A project by the Open Source Automation Development Lab (OSADL) eG".

• deps.dev for package licenses.

More MCP servers by Arhan Canli

• Actions Check: Checks GitHub Actions workflows: outdated actions, old Node runtimes, retired runners, injection.

• Config Check: Validates config files against their official schemas: tsconfig, compose, workflows, 1,400+ more.

• Cron Check: Explains cron expressions, lists next run times in any time zone, converts between cron dialects.

• Dockerfile Check: Checks Dockerfiles: build-breaking mistakes, base image tags that exist, digests, platforms, EOL.

• Domain Health: Email and domain checks: SPF lookup limits, DKIM keys, DMARC, DNS records, registration expiry.

• End of Life: Is this version still supported? EOL dates, latest patch and upgrade target for 470+ products.

• Internet Standards: RFC sections, status, obsoleted-by chains, errata and IANA registries for coding agents.

• Kube Check: Checks Kubernetes manifests for your version: removed APIs, unknown fields, Pod Security, risks.

• The whole collection, 12 more

License

MIT, Copyright (c) 2026 Arhan Canli.