mcpField
M
mcp-license-audit

mcp-license-audit

Local
github.com/webmoleaiLegal & Government0Updated 29w ago
Repository

About mcp-license-audit

mcp-license-audit is an MCP server for checking npm dependency licenses against a project’s license for compatibility issues. It classifies licenses, flags conflicts such as GPL/AGPL dependencies, and returns a structured compliance report.

Key features

  1. 01Parse package.json dependencies
  2. 02Fetch licenses from the npm registry
  3. 03Classify license types
  4. 04Detect license compatibility conflicts
  5. 05Return risk levels and JSON reports

Use cases

  1. 01Audit npm dependencies before release
  2. 02Identify GPL or AGPL conflicts
  3. 03Review unknown package licenses

MCP support

Exposes the `audit-licenses` tool to MCP clients. It accepts `packageJson` contents and returns a structured license and risk report.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "webmoleai-mcp-license-audit": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-license-audit"
      ]
    }
  }
}
Run commandnpx -y mcp-license-audit

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npmmcp-license-audit0.1.1

Tools

1

Saved tool list · updated 2w ago

ParameterTypeRequiredDescription
packageJsonstringYesContents of a package.json file as a string

Details

From the project README

mcp-license-audit

MCP server that audits your project's dependency licenses for compatibility issues. Flags GPL/AGPL conflicts and generates compliance reports.

What It Does

  • Parses a package.json file (dependencies + devDependencies)
  • Fetches license info for each package from the npm registry
  • Classifies licenses: permissive (MIT, Apache, BSD, ISC), copyleft (GPL, AGPL), weak-copyleft (LGPL, MPL), unknown
  • Detects conflicts (e.g., GPL dependency in an MIT-licensed project)
  • Returns a structured JSON report with risk level and summary

Install

npm install -g mcp-license-audit
# or run directly:
npx mcp-license-audit

Configure in Claude Code

Add to your .claude/mcp.json or ~/.claude/mcp.json:

{
  "mcpServers": {
    "license-audit": {
      "command": "npx",
      "args": ["mcp-license-audit"]
    }
  }
}

Or if installed globally:

{
  "mcpServers": {
    "license-audit": {
      "command": "mcp-license-audit"
    }
  }
}

Tool: audit-licenses

Input: packageJson — the full contents of a package.json file as a string.

Output: JSON report:

{
  "totalDependencies": 15,
  "analyzed": 15,
  "licenses": {
    "MIT": ["express", "lodash"],
    "Apache-2.0": ["typescript"],
    "GPL-3.0": ["some-package"],
    "unknown": ["private-pkg"]
  },
  "conflicts": [
    {
      "package": "some-package",
      "license": "GPL-3.0",
      "issue": "GPL dependency in MIT project — must open-source your code if distributed"
    }
  ],
  "riskLevel": "medium",
  "summary": "15 deps analyzed. 1 GPL conflict found. 1 unknown license."
}

Risk levels: low (no copyleft), medium (weak copyleft or many unknowns), high (GPL/AGPL found).

Limits

  • Analyzes first 20 dependencies for speed
  • Only supports npm packages (no pip/cargo/gem support yet)
  • License data comes from the npm registry — private packages return "unknown"

Build from Source

npm install
npm run build
node dist/index.js

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.