Skip to main content
Glama

LicenseGuard

의존 OSS 라이선스가 당신의 배포 모델에 대해 법적 의무를 발생시키는지 판정하는 도구.

프로덕션: https://license-guard.rcc-aoki.workers.dev

무엇이 다른가

기존 라이선스 컴플라이언스 제품은 "판정은 깊지만 상담 필수(FOSSA / Black Duck)" 또는 "셀프서비스지만 판정이 얕은(Snyk)"으로 양분되어 있으며, 그 교차점에는 제품이 존재하지 않습니다.

차별화의 핵심은 판정 레이어에 있습니다. 같은 라이선스라도 문맥에 따라 결론이 정반대로 갈립니다.

사용 방식

AGPL-3.0의 귀결

SaaS로 외부 제공

공개 의무 있음

사내 시스템에서만 이용

의무 없음

고객에게 납품·배포

공개 의무 있음

devDependency(산출물에 미포함)

의무 없음

마지막 행이 결정적입니다. 기존 도구 대부분은 dev와 runtime을 구분하지 않고 경고를 내보내며, 양치기 소년화되어 무시됩니다.

Related MCP server: gridwork-license

에이전트에서 사용

이 제품이 필요해지는 때는 브라우저에서 검색하고 있을 때가 아니라 의존성을 추가하고 있을 때입니다. 그래서 첫 번째 배치는 검색 결과가 아니라 에이전트의 도구입니다.

claude mcp add licenseguard --transport http https://license-guard.rcc-aoki.workers.dev/mcp

스테이트리스한 Streamable HTTP, 인증 불필요. 제공하는 도구:

도구

용도

check_dependency_license

의존성을 1개 추가하기 전에 호출

check_manifest_licenses

매니페스트 전체를 감사

explain_license

라이선스 자체가 무엇을 요구하는지 전체 배포 모델로 설명

JSON API도 동일한 판정을 반환합니다.

curl "https://license-guard.rcc-aoki.workers.dev/api/pkg/pypi/pyload-ng?model=saas"
# => {"license":"AGPL-3.0-only","verdict":"blocked", ...}

에이전트용 진입점은 /llms.txt에 정리되어 있습니다.

현재 페이즈

Phase 0(지불 의사 검증) — MCP 서버와 무료 Web 도구를 공개 완료. 주 전장은 검색이 아니라 에이전트의 workflow이므로, 검증 지표는 CTA 클릭률이 아니라 MCP 도입 수와 지속 호출 수입니다. GitHub App(Phase 1)은 검증 결과를 보고 착수합니다.

대응 에코시스템: npm / PyPI / Go modules / crates.io(Rust)

형식

전이적 의존

외부 조회

package-lock.json

○

불필요(라이선스 내포)

pnpm-lock.yaml / yarn.lock

○

필요(공유 캐시로 감소)

go.sum

○

필요

Cargo.lock / poetry.lock / uv.lock

○

필요

package.json / requirements.txt / go.mod / Cargo.toml

✗ 직접 의존만

필요

락 파일을 전달하면 전이적 의존까지 판정할 수 있습니다(package-lock.json / pnpm-lock.yaml / yarn.lock). 이 중 package-lock.json은 라이선스를 내포하고 있어 외부 조회가 전혀 필요 없습니다. 락 파일은 라이선스를 내포하고 있어 외부 조회가 전혀 필요 없으며, 실제로 도입되는 버전의 정보가 그대로 사용됩니다. 문제가 있는 라이선스는 직접 추가한 의존보다 의존의 의존으로 섞여 들어오는 경우가 더 많기 때문에, 여기가 실질적인 본진입니다.

curl -X POST https://license-guard.rcc-aoki.workers.dev/api/scan   -H 'content-type: application/json'   -d "$(jq -Rs '{content: ., distributionModel: "saas"}' package-lock.json)"

개발

npm install
npm test          # 全テスト
npm run typecheck
npm run smoke     # 実レジストリへの疎通確認
npm run e2e       # 本番に対する E2E 6種
                  #   ui          Playwright で実ブラウザ
                  #   a11y        アクセシビリティ
                  #   mcp         公式 MCP SDK クライアント
                  #   load        並列実行時の一貫性
                  #   adversarial 敵対的入力・境界値
                  #   correctness 既知の正解との突き合わせ
                  #   operational 経路間の一致・HTTP・キャッシュ
npm run dev       # http://localhost:8787

유닛 테스트가 모두 통과해도 실제 데이터를 흘려보내기 전에는 발견되지 않는 결함이 있습니다. smoke와 e2e는 프로덕션 상당의 외부 의존에 대해 실행하므로, 릴리스 전에 반드시 통과시킬 것.

배포:

npm run db:migrate
npm run deploy

문서

의존 OSS

본 제품 자체가 다루는 소재의 특성상, 의존은 모두 MIT / Apache-2.0 계열로 한정하고 있습니다. 자사 SaaS에 공개 의무는 발생하지 않습니다.

역할

OSS

라이선스

SPDX식 파싱

spdx-expression-parse

MIT

Web 프레임워크

hono

MIT

Go 라이선스 데이터

ClearlyDefined API

Apache-2.0

면책

본 도구가 제시하는 것은 공개된 라이선스 조문과 의존 매니페스트에 기반한 정보이며, 법적 조언이 아닙니다. 이용으로 인해 변호사·의뢰인 관계는 성립하지 않습니다. 판정은 매니페스트에 선언된 라이선스 정보에 기반한 것이며, 모든 의무나 위반을 망라하는 것은 아닙니다.

Available Tools

3 tools
check_dependency_licenseCheck one dependency for license obligationsAInspect

Determine whether adding or keeping a single open source dependency creates a legal obligation, given how this project ships. Call this BEFORE adding a new dependency to a project, and when auditing an existing one. A permissive result means no source-disclosure duty; a blocked result means the license obligates you and the dependency should be replaced or the shipping model reconsidered.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesPackage name as written in the manifest, e.g. "express", "requests", "github.com/gin-gonic/gin", or "serde".
scopeNoWhere the dependency sits. Use "dev", "build", or "test" for anything that does not end up in the shipped artifact — those carry no distribution obligation. Defaults to "runtime".
versionNoExact version if known. Omit to use the latest published version, which may differ from what is installed.
ecosystemYesPackage registry the dependency comes from.
distribution_modelYesHow the software incorporating this dependency reaches its users. This determines the answer: "saas" = users reach it over a network; "distributed-binary" = shipped as an app or binary; "on-prem-delivery" = installed in a customer environment; "internal-only" = never leaves your organization; "library-published" = released for others to depend on.

Output Schema

ParametersJSON Schema
NameRequiredDescription
licenseYes
verdictYes
rationaleYes
referenceNo
obligationsYes

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It explains the meaning of results ('A permissive result means no source-disclosure duty; a blocked result means...') but does not state whether the operation is read-only, has side effects, or any error conditions. This is adequate but not rich; a note about being non-destructive would improve it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose, and immediately provides usage timing. Every sentence adds value: the first defines what it does and when to use it; the second explains result interpretation. No fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 5 parameters (3 enums), an output schema, and no annotations, the description covers the key behavioral context: when to call, what question it answers, and how to interpret results. It ties the distribution_model to the shipping model. It does not mention error handling or edge cases, but the output schema likely handles that. Overall, it's complete for its complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already explains all parameters in detail (including enums and examples). The description adds no parameter-specific guidance beyond the schema, which meets the baseline for high coverage. It does hint at the importance of distribution_model by referencing 'how this project ships', but this is not about parameter syntax.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Determine whether adding or keeping a single open source dependency creates a legal obligation.' It also contextualizes it with 'given how this project ships' and explicitly says to call it BEFORE adding a dependency, which distinguishes it from broader checks like check_manifest_licenses.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit guidance: 'Call this BEFORE adding a new dependency to a project, and when auditing an existing one.' It also explains what a permissive vs. blocked result means, giving actionable next steps. However, it does not mention when NOT to use this tool (e.g., for multiple dependencies) or name alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_manifest_licensesCheck a whole manifestAInspect

Scan an entire dependency manifest and report every dependency whose license creates an obligation for this shipping model. Use when reviewing a project as a whole, preparing for due diligence, or after a large dependency change. Pass a package-lock.json when one exists: problematic licenses usually arrive as transitive dependencies rather than ones you added directly, and only a lockfile reveals those.

ParametersJSON Schema
NameRequiredDescriptionDefault
contentYesFull text of a lockfile or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, package.json, requirements.txt, go.mod, Cargo.toml. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups.
distribution_modelYesHow the software incorporating this dependency reaches its users. This determines the answer: "saas" = users reach it over a network; "distributed-binary" = shipped as an app or binary; "on-prem-delivery" = installed in a customer environment; "internal-only" = never leaves your organization; "library-published" = released for others to depend on.

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses the tool's behavior (scans manifest, reports dependencies with obligations), notes automatic format detection, and explains that package-lock.json embeds licenses, avoiding registry lookups. It implies a read-only operation but does not explicitly state absence of side effects. Minor gap, but context is sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise (three sentences) and front-loaded: the first sentence defines purpose, the second covers usage, and the third adds actionable input guidance. Every sentence earns its place with no fluff, and the structure flows logically.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given only two parameters, no output schema, and no annotations, the description fully covers the tool's purpose, when to use it, and how to provide input effectively. It also addresses the distinction from siblings, making it complete for the context. No gaps are evident.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds significant value by advising to pass a lockfile for transitive dependencies and explaining why package-lock.json is best (embeds licenses, no lookups). It also lists accepted formats implicitly through schema, but the description reinforces the preferred format and rationale, going beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb-resource pair: 'Scan an entire dependency manifest and report every dependency whose license creates an obligation for this shipping model.' It clearly distinguishes from sibling tools check_dependency_license (single dependency) and explain_license (license explanation) by focusing on a whole manifest and filtering based on the shipping model.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit usage context is given: 'Use when reviewing a project as a whole, preparing for due diligence, or after a large dependency change.' It also provides actionable advice to pass a lockfile (package-lock.json) and explains why it's preferred, covering when to use this tool over alternatives. This exceeds the requirement for clear context and exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

explain_licenseExplain what a license requiresAInspect

Given an SPDX license identifier or expression, explain what it requires across every shipping model at once. Use when the question is about the license itself rather than a specific package — for example when comparing AGPL-3.0 against GPL-3.0 for a hosted service, or deciding what a project may safely depend on.

ParametersJSON Schema
NameRequiredDescriptionDefault
licenseYesSPDX identifier or expression, e.g. "AGPL-3.0-only", "Apache-2.0", or "(MIT OR GPL-2.0-only)".
linkageNoHow the dependency is linked. Matters for LGPL-family licenses. Compiled languages such as Go and Rust normally link statically. Defaults to "dynamic".

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the transparency burden. It discloses that the tool covers all shipping models at once, which is a useful behavioral trait, but it does not describe return format, side effects, or assumptions about the linkage parameter. The description offers some insight but lacks a broader behavioral picture.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with purpose and followed by usage context. No redundant words or filler. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description gives enough for an agent to know when and how to invoke the tool. It clearly differentiates from siblings and describes the input. It could briefly mention what the output entails (e.g., per-shipping-model breakdown), but the missing details are not critical for invoking correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters thoroughly. The tool description does not add extra meaning beyond the schema – it merely mentions the input in passing. Baseline of 3 applies because the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('explain') and the resource (SPDX license identifier/expression), and specifies the scope ('what it requires across every shipping model at once'). It further distinguishes the tool from sibling tools by noting it is for the license itself 'rather than a specific package', with concrete examples.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly provides a condition for use: 'Use when the question is about the license itself rather than a specific package'. Examples (comparing AGPL vs GPL, deciding what a project may depend on) clarify the intended scenario, and the phrasing implicitly contrasts with dependency-checking tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updates
    • First observedcheck_dependency_license
    • First observedcheck_manifest_licenses
    • First observedexplain_license

TDQS

A4.2/5.0

Scored across 3 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: explain_license focuses on understanding a license itself, check_dependency_license evaluates a single dependency in context, and check_manifest_licenses scans an entire manifest. There is no overlap or ambiguity between them.

Naming Consistency4/5

All tool names follow a consistent verb_noun pattern (explain_license, check_dependency_license, check_manifest_licenses). The only minor deviation is that two tools start with 'check' while the third uses 'explain', but this is justified by the different action types.

Tool Count4/5

With only 3 tools, the server is slightly on the lean side, but each tool covers a distinct and essential aspect of license management (understanding, single-dependency check, full-manifest scan). The count is appropriate for a focused utility server.

Completeness4/5

The tool surface covers the core workflows: understanding licenses, checking individual dependencies, and scanning entire manifests. A minor gap is the lack of a tool to handle bulk license explanations or compare multiple licenses directly, but the existing tools cover the primary use cases well.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers