mcpField
L
license-compliance-auditor

license-compliance-auditor

github.com/jorgealvesTesting & quality2243 installsUpdated 3d ago
Repository

About license-compliance-auditor

A license-auditing skill for checking whether a software project's direct and transitive dependencies use organization-approved licenses. It reads package manifests and checks license metadata; it is not legal advice.

Key features

  1. 01Audit direct and transitive dependencies
  2. 02Compare licenses with approved lists
  3. 03Flag missing license metadata
  4. 04Identify dual-licensed packages for review
  5. 05Read-only manifest inspection

Use cases

  1. 01Review a newly added dependency
  2. 02Block non-compliant licenses in CI/CD
  3. 03Audit dependencies before a release
  4. 04Flag packages with unknown licenses

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/jorgealves/agent_skills --skill license-compliance-auditor

After installing, type/license-compliance-auditorin Claude Code to confirm it loaded.

Bundled filesskill.yaml

Details

From the project README

License Compliance Auditor

Purpose and Intent

The license-compliance-auditor ensures that software projects remain legally compliant by automatically verifying that all direct and transitive dependencies use licenses approved by the organization.

When to Use

  • Dependency Onboarding: Run when adding a new library to a project.
  • CI/CD Gates: Use as a blocking step in pipelines to prevent merging code with non-compliant licenses (e.g., preventing GPL in a proprietary product).
  • Release Preparation: Audit the entire dependency tree before a major release.

When NOT to Use

  • Legal Advice: This tool provides technical checks based on metadata; it does not replace professional legal counsel.
  • Custom Licenses: It may struggle with proprietary or highly customized license text not found in SPDX registries.

Error Conditions and Edge Cases

  • Missing Metadata: If a package doesn't define a license in its manifest, it will be flagged as "Unknown".
  • Dual Licensing: Packages with multiple licenses (e.g., "MIT OR GPL") will require manual review.
  • Unsupported Ecosystems: Attempting to run on a language not supported by the ecosystem input will fail.

Security and Data-Handling Considerations

  • ReadOnly: The tool only reads manifest files.
  • Privacy: No source code is uploaded; only package names and versions are used to check license registries.

Comments

Markdown supported