Skip to main content
Glama

LicenseGuard

Herramienta que determina si las licencias de las OSS dependientes generan obligaciones legales para tu modelo de distribución.

Producción: https://license-guard.rcc-aoki.workers.dev

En qué se diferencia

Los productos existentes de cumplimiento de licencias se dividen en dos categorías: "análisis profundo pero requiere negociación comercial (FOSSA / Black Duck)" o "autoservicio pero análisis superficial (Snyk)", y no existe ningún producto en esa intersección.

El núcleo de la diferenciación está en la capa de análisis. Incluso con la misma licencia, la conclusión puede ser completamente opuesta según el contexto.

Uso

Consecuencia de AGPL-3.0

Provisión externa como SaaS

Obligación de divulgación

Uso solo en sistemas internos

Sin obligación

Entrega o distribución al cliente

Obligación de divulgación

devDependency (no incluida en el artefacto)

Sin obligación

La última fila es decisiva. Muchas herramientas existentes emiten advertencias sin distinguir entre dev y runtime y, como el pastor mentiroso, acaban siendo ignoradas.

Related MCP server: gridwork-license

Uso desde agentes

Este producto se necesita no cuando se busca en el navegador, sino cuando se añade una dependencia. Por eso su primera ubicación no son los resultados de búsqueda, sino las herramientas del agente.

claude mcp add licenseguard --transport http https://license-guard.rcc-aoki.workers.dev/mcp

Streamable HTTP sin estado, sin autenticación. Herramientas proporcionadas:

Herramienta

Uso

check_dependency_license

Llamar antes de añadir una dependencia

check_manifest_licenses

Auditar todo el manifiesto

explain_license

Explicar qué exige la licencia en todos los modelos de distribución

La API JSON también devuelve el mismo análisis.

curl "https://license-guard.rcc-aoki.workers.dev/api/pkg/pypi/pyload-ng?model=saas"
# => {"license":"AGPL-3.0-only","verdict":"blocked", ...}

El punto de entrada para agentes está recopilado en /llms.txt.

Fase actual

Fase 0 (validación de la disposición a pagar) — Ya se han publicado el servidor MCP y la herramienta web gratuita. Como el campo de batalla principal no es la búsqueda sino el workflow de los agentes, la métrica de validación no es la tasa de clics en el CTA, sino el número de instalaciones de MCP y de llamadas recurrentes. La GitHub App (Fase 1) se abordará después de ver los resultados de la validación.

Ecosistemas compatibles: npm / PyPI / Go modules / crates.io (Rust)

Formato

Dependencias transitivas

Consulta externa

package-lock.json

○

No necesaria (incluye la licencia)

pnpm-lock.yaml / yarn.lock

○

Necesaria (disminuye con caché compartida)

go.sum

○

Necesaria

Cargo.lock / poetry.lock / uv.lock

○

Necesaria

package.json / requirements.txt / go.mod / Cargo.toml

✗ Solo dependencias directas

Necesaria

Al pasar un archivo de bloqueo, se pueden analizar incluso las dependencias transitivas (package-lock.json / pnpm-lock.yaml / yarn.lock). De estos, package-lock.json incluye la licencia, por lo que no requiere ninguna consulta externa. El archivo de bloqueo incluye la licencia, por lo que no requiere ninguna consulta externa, y la información de la versión que realmente se instalará se puede usar directamente. Las licencias problemáticas suelen colarse como dependencias de dependencias más que como dependencias añadidas directamente, por lo que aquí es donde está el verdadero valor.

curl -X POST https://license-guard.rcc-aoki.workers.dev/api/scan   -H 'content-type: application/json'   -d "$(jq -Rs '{content: ., distributionModel: "saas"}' package-lock.json)"

Desarrollo

npm install
npm test          # 全テスト
npm run typecheck
npm run smoke     # 実レジストリへの疎通確認
npm run e2e       # 本番に対する E2E 6種
                  #   ui          Playwright で実ブラウザ
                  #   a11y        アクセシビリティ
                  #   mcp         公式 MCP SDK クライアント
                  #   load        並列実行時の一貫性
                  #   adversarial 敵対的入力・境界値
                  #   correctness 既知の正解との突き合わせ
                  #   operational 経路間の一致・HTTP・キャッシュ
npm run dev       # http://localhost:8787

Aunque todas las pruebas unitarias pasen, hay defectos que no se encuentran hasta que se ejecutan con datos reales. smoke y e2e se ejecutan contra dependencias externas equivalentes a las de producción, así que asegúrate de que pasen antes del lanzamiento.

Despliegue:

npm run db:migrate
npm run deploy

Documentación

OSS dependientes

Por la naturaleza del tema que trata este producto, todas las dependencias se limitan a licencias tipo MIT / Apache-2.0. No se genera ninguna obligación de divulgación para el SaaS propio.

Rol

OSS

Licencia

Parseo de expresiones SPDX

spdx-expression-parse

MIT

Framework web

hono

MIT

Datos de licencias de Go

ClearlyDefined API

Apache-2.0

Lo que esta herramienta presenta es información basada en los textos de licencia publicados y en los manifiestos de dependencias, y no es asesoramiento legal. El uso de la herramienta no crea una relación abogado-cliente. El análisis se basa en la información de licencia declarada en el manifiesto y no cubre todas las obligaciones ni infracciones.

Available Tools

3 tools
check_dependency_licenseCheck one dependency for license obligationsAInspect

Determine whether adding or keeping a single open source dependency creates a legal obligation, given how this project ships. Call this BEFORE adding a new dependency to a project, and when auditing an existing one. A permissive result means no source-disclosure duty; a blocked result means the license obligates you and the dependency should be replaced or the shipping model reconsidered.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesPackage name as written in the manifest, e.g. "express", "requests", "github.com/gin-gonic/gin", or "serde".
scopeNoWhere the dependency sits. Use "dev", "build", or "test" for anything that does not end up in the shipped artifact — those carry no distribution obligation. Defaults to "runtime".
versionNoExact version if known. Omit to use the latest published version, which may differ from what is installed.
ecosystemYesPackage registry the dependency comes from.
distribution_modelYesHow the software incorporating this dependency reaches its users. This determines the answer: "saas" = users reach it over a network; "distributed-binary" = shipped as an app or binary; "on-prem-delivery" = installed in a customer environment; "internal-only" = never leaves your organization; "library-published" = released for others to depend on.

Output Schema

ParametersJSON Schema
NameRequiredDescription
licenseYes
verdictYes
rationaleYes
referenceNo
obligationsYes

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It explains the meaning of results ('A permissive result means no source-disclosure duty; a blocked result means...') but does not state whether the operation is read-only, has side effects, or any error conditions. This is adequate but not rich; a note about being non-destructive would improve it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose, and immediately provides usage timing. Every sentence adds value: the first defines what it does and when to use it; the second explains result interpretation. No fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 5 parameters (3 enums), an output schema, and no annotations, the description covers the key behavioral context: when to call, what question it answers, and how to interpret results. It ties the distribution_model to the shipping model. It does not mention error handling or edge cases, but the output schema likely handles that. Overall, it's complete for its complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already explains all parameters in detail (including enums and examples). The description adds no parameter-specific guidance beyond the schema, which meets the baseline for high coverage. It does hint at the importance of distribution_model by referencing 'how this project ships', but this is not about parameter syntax.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Determine whether adding or keeping a single open source dependency creates a legal obligation.' It also contextualizes it with 'given how this project ships' and explicitly says to call it BEFORE adding a dependency, which distinguishes it from broader checks like check_manifest_licenses.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit guidance: 'Call this BEFORE adding a new dependency to a project, and when auditing an existing one.' It also explains what a permissive vs. blocked result means, giving actionable next steps. However, it does not mention when NOT to use this tool (e.g., for multiple dependencies) or name alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_manifest_licensesCheck a whole manifestAInspect

Scan an entire dependency manifest and report every dependency whose license creates an obligation for this shipping model. Use when reviewing a project as a whole, preparing for due diligence, or after a large dependency change. Pass a package-lock.json when one exists: problematic licenses usually arrive as transitive dependencies rather than ones you added directly, and only a lockfile reveals those.

ParametersJSON Schema
NameRequiredDescriptionDefault
contentYesFull text of a lockfile or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, package.json, requirements.txt, go.mod, Cargo.toml. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups.
distribution_modelYesHow the software incorporating this dependency reaches its users. This determines the answer: "saas" = users reach it over a network; "distributed-binary" = shipped as an app or binary; "on-prem-delivery" = installed in a customer environment; "internal-only" = never leaves your organization; "library-published" = released for others to depend on.

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses the tool's behavior (scans manifest, reports dependencies with obligations), notes automatic format detection, and explains that package-lock.json embeds licenses, avoiding registry lookups. It implies a read-only operation but does not explicitly state absence of side effects. Minor gap, but context is sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise (three sentences) and front-loaded: the first sentence defines purpose, the second covers usage, and the third adds actionable input guidance. Every sentence earns its place with no fluff, and the structure flows logically.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given only two parameters, no output schema, and no annotations, the description fully covers the tool's purpose, when to use it, and how to provide input effectively. It also addresses the distinction from siblings, making it complete for the context. No gaps are evident.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds significant value by advising to pass a lockfile for transitive dependencies and explaining why package-lock.json is best (embeds licenses, no lookups). It also lists accepted formats implicitly through schema, but the description reinforces the preferred format and rationale, going beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb-resource pair: 'Scan an entire dependency manifest and report every dependency whose license creates an obligation for this shipping model.' It clearly distinguishes from sibling tools check_dependency_license (single dependency) and explain_license (license explanation) by focusing on a whole manifest and filtering based on the shipping model.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit usage context is given: 'Use when reviewing a project as a whole, preparing for due diligence, or after a large dependency change.' It also provides actionable advice to pass a lockfile (package-lock.json) and explains why it's preferred, covering when to use this tool over alternatives. This exceeds the requirement for clear context and exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

explain_licenseExplain what a license requiresAInspect

Given an SPDX license identifier or expression, explain what it requires across every shipping model at once. Use when the question is about the license itself rather than a specific package — for example when comparing AGPL-3.0 against GPL-3.0 for a hosted service, or deciding what a project may safely depend on.

ParametersJSON Schema
NameRequiredDescriptionDefault
licenseYesSPDX identifier or expression, e.g. "AGPL-3.0-only", "Apache-2.0", or "(MIT OR GPL-2.0-only)".
linkageNoHow the dependency is linked. Matters for LGPL-family licenses. Compiled languages such as Go and Rust normally link statically. Defaults to "dynamic".

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the transparency burden. It discloses that the tool covers all shipping models at once, which is a useful behavioral trait, but it does not describe return format, side effects, or assumptions about the linkage parameter. The description offers some insight but lacks a broader behavioral picture.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with purpose and followed by usage context. No redundant words or filler. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description gives enough for an agent to know when and how to invoke the tool. It clearly differentiates from siblings and describes the input. It could briefly mention what the output entails (e.g., per-shipping-model breakdown), but the missing details are not critical for invoking correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters thoroughly. The tool description does not add extra meaning beyond the schema – it merely mentions the input in passing. Baseline of 3 applies because the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('explain') and the resource (SPDX license identifier/expression), and specifies the scope ('what it requires across every shipping model at once'). It further distinguishes the tool from sibling tools by noting it is for the license itself 'rather than a specific package', with concrete examples.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly provides a condition for use: 'Use when the question is about the license itself rather than a specific package'. Examples (comparing AGPL vs GPL, deciding what a project may depend on) clarify the intended scenario, and the phrasing implicitly contrasts with dependency-checking tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updates
    • First observedcheck_dependency_license
    • First observedcheck_manifest_licenses
    • First observedexplain_license

TDQS

A4.2/5.0

Scored across 3 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: explain_license focuses on understanding a license itself, check_dependency_license evaluates a single dependency in context, and check_manifest_licenses scans an entire manifest. There is no overlap or ambiguity between them.

Naming Consistency4/5

All tool names follow a consistent verb_noun pattern (explain_license, check_dependency_license, check_manifest_licenses). The only minor deviation is that two tools start with 'check' while the third uses 'explain', but this is justified by the different action types.

Tool Count4/5

With only 3 tools, the server is slightly on the lean side, but each tool covers a distinct and essential aspect of license management (understanding, single-dependency check, full-manifest scan). The count is appropriate for a focused utility server.

Completeness4/5

The tool surface covers the core workflows: understanding licenses, checking individual dependencies, and scanning entire manifests. A minor gap is the lack of a tool to handle bulk license explanations or compare multiple licenses directly, but the existing tools cover the primary use cases well.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers