# mcp-license-audit

MCP server that audits your project's dependency licenses for compatibility issues. Flags GPL/AGPL conflicts and generates compliance reports.

## What It Does

- Parses a `package.json` file (dependencies + devDependencies)
- Fetches license info for each package from the npm registry
- Classifies licenses: permissive (MIT, Apache, BSD, ISC), copyleft (GPL, AGPL), weak-copyleft (LGPL, MPL), unknown
- Detects conflicts (e.g., GPL dependency in an MIT-licensed project)
- Returns a structured JSON report with risk level and summary

## Install

```bash
npm install -g mcp-license-audit
# or run directly:
npx mcp-license-audit
```

## Configure in Claude Code

Add to your `.claude/mcp.json` or `~/.claude/mcp.json`:

```json
{
  "mcpServers": {
    "license-audit": {
      "command": "npx",
      "args": ["mcp-license-audit"]
    }
  }
}
```

Or if installed globally:

```json
{
  "mcpServers": {
    "license-audit": {
      "command": "mcp-license-audit"
    }
  }
}
```

## Analytics

This server supports [MCPcat](https://mcpcat.io) analytics. To enable usage tracking, session replay, and error monitoring, set the `MCPCAT_PROJECT_ID` environment variable in your MCP client config:

```json
{
  "mcpServers": {
    "license-audit": {
      "command": "npx",
      "args": ["mcp-license-audit"],
      "env": {
        "MCPCAT_PROJECT_ID": "proj_your_id_here"
      }
    }
  }
}
```

Without it, the server runs normally with no analytics. See the [MCPcat setup guide](../../docs/guides/mcpcat-setup.md) for details.

## Tool: `audit-licenses`

**Input:** `packageJson` — the full contents of a `package.json` file as a string.

**Output:** JSON report:

```json
{
  "totalDependencies": 15,
  "analyzed": 15,
  "licenses": {
    "MIT": ["express", "lodash"],
    "Apache-2.0": ["typescript"],
    "GPL-3.0": ["some-package"],
    "unknown": ["private-pkg"]
  },
  "conflicts": [
    {
      "package": "some-package",
      "license": "GPL-3.0",
      "issue": "GPL dependency in MIT project — must open-source your code if distributed"
    }
  ],
  "riskLevel": "medium",
  "summary": "15 deps analyzed. 1 GPL conflict found. 1 unknown license."
}
```

**Risk levels:** `low` (no copyleft), `medium` (weak copyleft or many unknowns), `high` (GPL/AGPL found).

## Limits

- Analyzes first 20 dependencies for speed
- Only supports npm packages (no pip/cargo/gem support yet)
- License data comes from the npm registry — private packages return "unknown"

## Build from Source

```bash
npm install
npm run build
node dist/index.js
```