license-sentinel
Server Quality Checklist
Latest release: v0.1.0
- Disambiguation5/5
Each tool targets a distinct stage: audit_project scans an existing project, check_package evaluates individual license strings or packages before install, and generate_notices produces an attribution file. The descriptions explicitly clarify the boundary between audit_project and check_package, so an agent is unlikely to select the wrong tool.
Naming Consistency5/5All three tools follow the same verb_noun snake_case pattern: audit_project, check_package, generate_notices. The naming is predictable and immediately conveys the action and target of each tool.
Tool Count5/5Three tools is a well-scoped count for a focused license-compliance server. Each tool covers a non-overlapping, meaningful workflow step without unnecessary bloat or missing core functionality.
Completeness4/5The toolset covers the main license compliance lifecycle: audit a project, check new dependencies, and generate notices. Minor gaps exist around policy configuration/allowlisting and detailed reporting on all permissive dependencies, but agents can work around these using the provided outputs.
Average 4/5 across 3 of 3 tools scored.
See the Tool Scores section below for per-tool breakdowns.
- No community issues in the last 6 months
- 6 commits in the last 12 weeks
- No stable releases found
- No critical vulnerability alerts
- No high-severity vulnerability alerts
- No code scanning findings
- CI status not available
This repository is licensed under MIT License.
This repository includes a README.md file.
No tool usage detected in the last 30 days. Usage tracking helps demonstrate server value.
Tip: use the "Try in Browser" feature on the server page to seed initial usage.
This repository includes a glama.json configuration file.
This server has been verified by its author.
Add related servers to improve discoverability.
How to sync the server with GitHub?
Servers are automatically synced at least once per day, but you can also sync manually at any time to instantly update the server profile.
To manually sync the server, click the "Sync Server" button in the MCP server admin interface.
How is the quality score calculated?
The overall quality score combines two components: Tool Definition Quality (70%) and Server Coherence (30%).
Tool Definition Quality measures how well each tool describes itself to AI agents. Every tool is scored 1–5 across six dimensions: Purpose Clarity (25%), Usage Guidelines (20%), Behavioral Transparency (20%), Parameter Semantics (15%), Conciseness & Structure (10%), and Contextual Completeness (10%). The server-level definition quality score is calculated as 60% mean TDQS + 40% minimum TDQS, so a single poorly described tool pulls the score down.
Server Coherence evaluates how well the tools work together as a set, scoring four dimensions equally: Disambiguation (can agents tell tools apart?), Naming Consistency, Tool Count Appropriateness, and Completeness (are there gaps in the tool surface?).
Tiers are derived from the overall score: A (≥3.5), B (≥3.0), C (≥2.0), D (≥1.0), F (<1.0). B and above is considered passing.
Tool Scores
- Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must carry the full burden. It does disclose that the tool writes an output file, scans a project directory, resolves relative output paths against the path, and returns the absolute path plus dependency count. However, it does not mention overwrite behavior, destructive potential, required project state, or failure modes, leaving meaningful gaps for a file-writing tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact, front-loaded with the primary purpose, and organized with Args and Returns sections. Every sentence contributes useful information, and there is no redundant filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity—two optional parameters and an output schema available—the description covers purpose, arguments, and return value well. It could be more complete about the side effects of writing the output file or the exact nature of the dependency scan, but for an agent selecting and invoking this tool, the essentials are present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does: 'path' is defined as the project directory to scan, and 'output' is defined as the output file with relative path resolution behavior. This adds meaning not present in the bare input schema, although it could offer more detail about output formatting or scanning scope.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear, specific action: 'Write a THIRD-PARTY-NOTICES.md attribution document for client hand-off.' It identifies the verb, resource, and purpose, making the tool's role obvious. However, it does not explicitly differentiate this tool from its siblings audit_project or check_package, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'for client hand-off' gives reasonable context for when the tool might be used, and the description clearly implies a dependency-scanning/writing task. There is no explicit guidance on when to choose this tool over audit_project or check_package, nor any exclusions or alternative conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
- Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It states that the tool scans and reports licensing risk and describes the return content, but it does not explicitly mention whether it modifies anything, needs network access, or has other side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well organized with a one-line summary, clearly labeled Args, and Returns. Every sentence is useful, and the most important information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description provides enough detail to call the tool correctly: both parameters are explained, defaults are given, and the return shape is summarized. Missing guidance about alternatives and side effects is a minor gap given the tool's read-only-looking nature.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds substantial meaning beyond the input schema, which has no parameter descriptions and zero schema coverage. It explains the path parameter's default and the full semantic meaning of each context value, including what each distribution model means.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool scans a project's dependencies and reports licensing risk, using a specific verb and resource. It does not explicitly differentiate itself from sibling tools like check_package or generate_notices, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5Does the description explain when to use this tool, when not to, or what alternatives exist?
The use case is implied: use this when you need to audit a project's dependency licensing. However, there is no explicit guidance about when to prefer audit_project over check_package or generate_notices, and no stated exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
- Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the safety and behavior burden. It discloses output form ('One line per input with its verdict and the reason') and clarifies that the tool does not perform package lookups or project audits, which is important behavioral context. It doesn't explicitly list side effects or auth needs, but the operation is a non-mutating check and the main behavioral boundaries are stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the purpose, then neatly organized into Args and Returns. Every sentence adds value, and the examples are compact rather than bloated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The required names parameter is fully specified and the output schema covers return values, so an agent can make a default call. The main gap is the context parameter, whose valid values are only referenced through audit_project rather than described here. This keeps the definition from being fully self-contained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema coverage is 0%, the description compensates thoroughly for names with concrete accepted forms, SPDX-style expressions, and comma-separated/array variants. Context is only cross-referenced to audit_project rather than fully explained, but the schema's default and type still apply.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb/resource pair and timeframe ('Check ... before installing'), then sharpens the scope by stating inputs are license strings, not package lookups, and names audit_project as the installed-project alternative. This makes the tool's role unambiguous relative to its siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines5/5Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use the tool ('before installing them') and when not to (for actual installed-package audits, 'use audit_project'). The exclusion of project-directory lookups is direct, leaving no inference needed. generate_notices is not mentioned, but the main decision boundary is covered.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
GitHub Badge
Glama performs regular codebase and documentation scans to:
- Confirm that the MCP server is working as expected.
- Confirm that there are no obvious security issues.
- Evaluate tool definition quality.
Our badge communicates server capabilities, safety, and installation instructions.
Card Badge
Copy to your README.md:
Score Badge
Copy to your README.md:
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/wgd5678/license-sentinel'
If you have feedback or need assistance with the MCP directory API, please join our Discord server