License Compliance

io.github.bighippomanPublished by GitHub account bighippomanv1.0.2Updated Oct 24, 2026

Scan npm dependencies for license compliance issues. Catch GPL contamination.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Scans npm project dependencies for license compliance issues, including copyleft contamination such as GPL.

What you can do
License Compliance is a local MCP server that inspects the npm dependencies of a project and reports license compliance problems. According to its registry description, it scans npm dependencies for license compliance issues and helps catch GPL contamination. No tool list is published, so the exact commands and output format are not documented here.
When to use it
Worth adding when an assistant needs to check a JavaScript or Node.js project's dependency licenses, for example before releasing or auditing a codebase for copyleft obligations. It is a desktop-only local process, so it suits developers working on their own machine rather than hosted or browser-based use.
Requirements
Runs as a local process over stdio, installed from the npm package license-compliance-mcp, so Node.js and npm are needed. No authentication, environment variables, or headers are declared. It reads the project's npm dependency metadata, so it needs access to the project directory.
Before you install
It only reads dependency and license metadata; no write, send, or delete behavior is declared. License detection is based on package metadata and can be incomplete or wrong, so treat results as a starting point rather than legal advice. No credentials or secrets are requested.

Installation

In SourceWeft

  1. Open License Compliance in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

license-compliance-mcp

MCP server that scans npm project dependencies for license compliance issues. Catch GPL contamination before code ships.

Tools

check-licenses

Scan a project's npm dependencies against a license policy and get a detailed compliance report.

Parameters:

  • path (required) — Absolute path to the project root
  • policy (optional, default: "permissive") — Policy preset or custom SPDX expression
    • "permissive" — Only MIT, ISC, BSD, Apache-2.0, etc.
    • "weak-copyleft" — Adds LGPL, MPL-2.0, EPL-2.0
    • "copyleft" — Adds GPL, AGPL
    • Custom: "(MIT OR Apache-2.0)" — Any valid SPDX expression

explain-license

Get a plain-language explanation of any SPDX license — permissions, conditions, limitations, compatibility, and gotchas.

Parameters:

  • license (required) — SPDX identifier (e.g., "MIT", "GPL-3.0-only", "Apache-2.0")

Install

Claude Code

bash
claude mcp add license-compliance -- npx -y license-compliance-mcp

Claude Desktop / Cursor

Add to your config (claude_desktop_config.json or .cursor/mcp.json):

json
{  "mcpServers": {    "license-compliance": {      "command": "npx",      "args": ["-y", "license-compliance-mcp"]    }  }}

How It Works

  1. Scans node_modules using license-checker-rseidelsohn
  2. Normalizes license strings to valid SPDX using spdx-correct
  3. Evaluates each package against the policy using spdx-satisfies
  4. Traces dependency chains to show how problematic packages entered the project
  5. Generates a markdown report grouped by severity (critical > warning > info)

Requirements

  • Node.js >= 18
  • Project must have node_modules installed (npm install)

Source: README.md at commit 1572eef

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.2LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts