mcpField
L
license-compliance

license-compliance

Local
github.com/bighippomanLegal & Government0Updated 34w ago
Repository

About license-compliance

license-compliance is an MCP server for checking npm dependency licenses against preset or custom SPDX policies. It traces problematic packages through dependency chains and produces a severity-grouped report.

Key features

  1. 01Check npm dependencies against license policies
  2. 02Use preset policies or custom SPDX expressions
  3. 03Trace dependency chains for flagged packages
  4. 04Generate severity-grouped Markdown reports
  5. 05Explain SPDX license terms and risks

Use cases

  1. 01Review npm projects for license policy violations
  2. 02Trace how a flagged license entered a project
  3. 03Understand permissions and limitations of an SPDX license

MCP support

Exposes `check-licenses` and `explain-license` tools to MCP clients. The first scans a project path and reports policy compliance; the second explains an SPDX license.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "bighippoman-license-compliance": {
      "command": "npx",
      "args": [
        "-y",
        "license-compliance-mcp"
      ]
    }
  }
}
Run commandnpx -y license-compliance-mcp

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npmlicense-compliance-mcp1.0.2

Tools

2

Saved tool list · updated 2w ago

ParameterTypeRequiredDescription
pathstringYesAbsolute path to the project root (must contain package.json and node_modules)
policystringNoPolicy preset ("permissive", "weak-copyleft", "copyleft") or a custom SPDX expression like "(MIT OR Apache-2.0)"

Details

From the project README

license-compliance-mcp

MCP server that scans npm project dependencies for license compliance issues. Catch GPL contamination before code ships.

Tools

check-licenses

Scan a project's npm dependencies against a license policy and get a detailed compliance report.

Parameters:

  • path (required) — Absolute path to the project root
  • policy (optional, default: "permissive") — Policy preset or custom SPDX expression
    • "permissive" — Only MIT, ISC, BSD, Apache-2.0, etc.
    • "weak-copyleft" — Adds LGPL, MPL-2.0, EPL-2.0
    • "copyleft" — Adds GPL, AGPL
    • Custom: "(MIT OR Apache-2.0)" — Any valid SPDX expression
explain-license

Get a plain-language explanation of any SPDX license — permissions, conditions, limitations, compatibility, and gotchas.

Parameters:

  • license (required) — SPDX identifier (e.g., "MIT", "GPL-3.0-only", "Apache-2.0")

Install

Claude Code
claude mcp add license-compliance -- npx -y license-compliance-mcp
Claude Desktop / Cursor

Add to your config (claude_desktop_config.json or .cursor/mcp.json):

{
  "mcpServers": {
    "license-compliance": {
      "command": "npx",
      "args": ["-y", "license-compliance-mcp"]
    }
  }
}

How It Works

  1. Scans node_modules using license-checker-rseidelsohn
  2. Normalizes license strings to valid SPDX using spdx-correct
  3. Evaluates each package against the policy using spdx-satisfies
  4. Traces dependency chains to show how problematic packages entered the project
  5. Generates a markdown report grouped by severity (critical > warning > info)

Requirements

  • Node.js >= 18
  • Project must have node_modules installed (npm install)

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.