Skip to main content
Glama

LicenseGuard

用于判断所依赖的 OSS 许可证是否会对你的分发模式产生法律义务的工具。

生产环境: https://license-guard.rcc-aoki.workers.dev

有何不同

现有的许可证合规产品被分为两类:“判定深入但必须商谈(FOSSA / Black Duck)”或“自助式但判定较浅(Snyk)”,而两者的交汇处没有产品存在。

差异化的核心在于判定层。即使是相同的许可证,结论也会因上下文而完全相反。

使用方式

AGPL-3.0 的后果

作为 SaaS 对外提供

有披露义务

仅用于内部系统

无义务

向客户交付、分发

有披露义务

devDependency(不包含在交付物中)

无义务

最后一行是关键。现有工具大多不区分 dev 与 runtime 就发出警告,导致狼来了效应而被忽视。

Related MCP server: gridwork-license

供智能体使用

需要这个产品的时候,不是在浏览器里搜索时,而是在添加依赖时。因此首要的部署位置不是搜索结果,而是智能体的工具。

claude mcp add licenseguard --transport http https://license-guard.rcc-aoki.workers.dev/mcp

无状态的 Streamable HTTP,无需认证。提供的工具:

工具

用途

check_dependency_license

在添加一个依赖之前调用

check_manifest_licenses

审计整个清单文件

explain_license

说明许可证本身在所有分发模式下要求什么

JSON API 也返回相同的判定结果。

curl "https://license-guard.rcc-aoki.workers.dev/api/pkg/pypi/pyload-ng?model=saas"
# => {"license":"AGPL-3.0-only","verdict":"blocked", ...}

面向智能体的入口已汇总在 /llms.txt。

当前阶段

Phase 0(支付意愿验证) — 已发布 MCP 服务器和免费 Web 工具。由于主战场不是搜索而是智能体的工作流,因此验证指标不是 CTA 点击率,而是 MCP 的接入数和持续调用次数。GitHub App(Phase 1)将在看到验证结果后再着手。

支持的生态系统: npm / PyPI / Go modules / crates.io(Rust)

格式

传递依赖

外部查询

package-lock.json

○

不需要(包含许可证)

pnpm-lock.yaml / yarn.lock

○

需要(借助共享缓存递减)

go.sum

○

需要

Cargo.lock / poetry.lock / uv.lock

○

需要

package.json / requirements.txt / go.mod / Cargo.toml

✗ 仅直接依赖

需要

传入锁文件即可判定到传递依赖(package-lock.json / pnpm-lock.yaml / yarn.lock)。 其中 package-lock.json 包含许可证,因此完全不需要外部查询。 锁文件 因包含许可证而完全不需要外部查询,实际安装的版本信息 可以直接使用。有问题的许可证比起直接添加的依赖,更多是作为依赖的依赖 混入的,因此这里才是实质上的重点。

curl -X POST https://license-guard.rcc-aoki.workers.dev/api/scan   -H 'content-type: application/json'   -d "$(jq -Rs '{content: ., distributionModel: "saas"}' package-lock.json)"

开发

npm install
npm test          # 全テスト
npm run typecheck
npm run smoke     # 実レジストリへの疎通確認
npm run e2e       # 本番に対する E2E 6種
                  #   ui          Playwright で実ブラウザ
                  #   a11y        アクセシビリティ
                  #   mcp         公式 MCP SDK クライアント
                  #   load        並列実行時の一貫性
                  #   adversarial 敵対的入力・境界値
                  #   correctness 既知の正解との突き合わせ
                  #   operational 経路間の一致・HTTP・キャッシュ
npm run dev       # http://localhost:8787

即使单元测试全部通过,也有不用真实数据跑一遍就发现不了的缺陷。 smoke 和 e2e 针对与生产环境相当的外部依赖执行,因此发布前务必全部通过。

部署:

npm run db:migrate
npm run deploy

文档

所依赖的 OSS

鉴于本产品自身所处理对象的性质,所有依赖都限定为 MIT / Apache-2.0 系。自有 SaaS 不会产生披露义务。

角色

OSS

许可证

SPDX 表达式解析

spdx-expression-parse

MIT

Web 框架

hono

MIT

Go 的许可证数据

ClearlyDefined API

Apache-2.0

免责声明

本工具所展示的是基于公开的许可证条款和依赖清单的信息,并非法律建议。使用本工具不构成律师与委托人关系。判定基于清单中声明的许可证信息,并不涵盖所有义务或违规。

Available Tools

3 tools
check_dependency_licenseCheck one dependency for license obligationsAInspect

Determine whether adding or keeping a single open source dependency creates a legal obligation, given how this project ships. Call this BEFORE adding a new dependency to a project, and when auditing an existing one. A permissive result means no source-disclosure duty; a blocked result means the license obligates you and the dependency should be replaced or the shipping model reconsidered.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesPackage name as written in the manifest, e.g. "express", "requests", "github.com/gin-gonic/gin", or "serde".
scopeNoWhere the dependency sits. Use "dev", "build", or "test" for anything that does not end up in the shipped artifact — those carry no distribution obligation. Defaults to "runtime".
versionNoExact version if known. Omit to use the latest published version, which may differ from what is installed.
ecosystemYesPackage registry the dependency comes from.
distribution_modelYesHow the software incorporating this dependency reaches its users. This determines the answer: "saas" = users reach it over a network; "distributed-binary" = shipped as an app or binary; "on-prem-delivery" = installed in a customer environment; "internal-only" = never leaves your organization; "library-published" = released for others to depend on.

Output Schema

ParametersJSON Schema
NameRequiredDescription
licenseYes
verdictYes
rationaleYes
referenceNo
obligationsYes

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It explains the meaning of results ('A permissive result means no source-disclosure duty; a blocked result means...') but does not state whether the operation is read-only, has side effects, or any error conditions. This is adequate but not rich; a note about being non-destructive would improve it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose, and immediately provides usage timing. Every sentence adds value: the first defines what it does and when to use it; the second explains result interpretation. No fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 5 parameters (3 enums), an output schema, and no annotations, the description covers the key behavioral context: when to call, what question it answers, and how to interpret results. It ties the distribution_model to the shipping model. It does not mention error handling or edge cases, but the output schema likely handles that. Overall, it's complete for its complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already explains all parameters in detail (including enums and examples). The description adds no parameter-specific guidance beyond the schema, which meets the baseline for high coverage. It does hint at the importance of distribution_model by referencing 'how this project ships', but this is not about parameter syntax.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Determine whether adding or keeping a single open source dependency creates a legal obligation.' It also contextualizes it with 'given how this project ships' and explicitly says to call it BEFORE adding a dependency, which distinguishes it from broader checks like check_manifest_licenses.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit guidance: 'Call this BEFORE adding a new dependency to a project, and when auditing an existing one.' It also explains what a permissive vs. blocked result means, giving actionable next steps. However, it does not mention when NOT to use this tool (e.g., for multiple dependencies) or name alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_manifest_licensesCheck a whole manifestAInspect

Scan an entire dependency manifest and report every dependency whose license creates an obligation for this shipping model. Use when reviewing a project as a whole, preparing for due diligence, or after a large dependency change. Pass a package-lock.json when one exists: problematic licenses usually arrive as transitive dependencies rather than ones you added directly, and only a lockfile reveals those.

ParametersJSON Schema
NameRequiredDescriptionDefault
contentYesFull text of a lockfile or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, package.json, requirements.txt, go.mod, Cargo.toml. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups.
distribution_modelYesHow the software incorporating this dependency reaches its users. This determines the answer: "saas" = users reach it over a network; "distributed-binary" = shipped as an app or binary; "on-prem-delivery" = installed in a customer environment; "internal-only" = never leaves your organization; "library-published" = released for others to depend on.

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses the tool's behavior (scans manifest, reports dependencies with obligations), notes automatic format detection, and explains that package-lock.json embeds licenses, avoiding registry lookups. It implies a read-only operation but does not explicitly state absence of side effects. Minor gap, but context is sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise (three sentences) and front-loaded: the first sentence defines purpose, the second covers usage, and the third adds actionable input guidance. Every sentence earns its place with no fluff, and the structure flows logically.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given only two parameters, no output schema, and no annotations, the description fully covers the tool's purpose, when to use it, and how to provide input effectively. It also addresses the distinction from siblings, making it complete for the context. No gaps are evident.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds significant value by advising to pass a lockfile for transitive dependencies and explaining why package-lock.json is best (embeds licenses, no lookups). It also lists accepted formats implicitly through schema, but the description reinforces the preferred format and rationale, going beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb-resource pair: 'Scan an entire dependency manifest and report every dependency whose license creates an obligation for this shipping model.' It clearly distinguishes from sibling tools check_dependency_license (single dependency) and explain_license (license explanation) by focusing on a whole manifest and filtering based on the shipping model.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit usage context is given: 'Use when reviewing a project as a whole, preparing for due diligence, or after a large dependency change.' It also provides actionable advice to pass a lockfile (package-lock.json) and explains why it's preferred, covering when to use this tool over alternatives. This exceeds the requirement for clear context and exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

explain_licenseExplain what a license requiresAInspect

Given an SPDX license identifier or expression, explain what it requires across every shipping model at once. Use when the question is about the license itself rather than a specific package — for example when comparing AGPL-3.0 against GPL-3.0 for a hosted service, or deciding what a project may safely depend on.

ParametersJSON Schema
NameRequiredDescriptionDefault
licenseYesSPDX identifier or expression, e.g. "AGPL-3.0-only", "Apache-2.0", or "(MIT OR GPL-2.0-only)".
linkageNoHow the dependency is linked. Matters for LGPL-family licenses. Compiled languages such as Go and Rust normally link statically. Defaults to "dynamic".

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the transparency burden. It discloses that the tool covers all shipping models at once, which is a useful behavioral trait, but it does not describe return format, side effects, or assumptions about the linkage parameter. The description offers some insight but lacks a broader behavioral picture.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with purpose and followed by usage context. No redundant words or filler. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description gives enough for an agent to know when and how to invoke the tool. It clearly differentiates from siblings and describes the input. It could briefly mention what the output entails (e.g., per-shipping-model breakdown), but the missing details are not critical for invoking correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters thoroughly. The tool description does not add extra meaning beyond the schema – it merely mentions the input in passing. Baseline of 3 applies because the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('explain') and the resource (SPDX license identifier/expression), and specifies the scope ('what it requires across every shipping model at once'). It further distinguishes the tool from sibling tools by noting it is for the license itself 'rather than a specific package', with concrete examples.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly provides a condition for use: 'Use when the question is about the license itself rather than a specific package'. Examples (comparing AGPL vs GPL, deciding what a project may depend on) clarify the intended scenario, and the phrasing implicitly contrasts with dependency-checking tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updates
    • First observedcheck_dependency_license
    • First observedcheck_manifest_licenses
    • First observedexplain_license

TDQS

A4.2/5.0

Scored across 3 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: explain_license focuses on understanding a license itself, check_dependency_license evaluates a single dependency in context, and check_manifest_licenses scans an entire manifest. There is no overlap or ambiguity between them.

Naming Consistency4/5

All tool names follow a consistent verb_noun pattern (explain_license, check_dependency_license, check_manifest_licenses). The only minor deviation is that two tools start with 'check' while the third uses 'explain', but this is justified by the different action types.

Tool Count4/5

With only 3 tools, the server is slightly on the lean side, but each tool covers a distinct and essential aspect of license management (understanding, single-dependency check, full-manifest scan). The count is appropriate for a focused utility server.

Completeness4/5

The tool surface covers the core workflows: understanding licenses, checking individual dependencies, and scanning entire manifests. A minor gap is the lack of a tool to handle bulk license explanations or compare multiple licenses directly, but the existing tools cover the primary use cases well.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers