Mcp License Audit

io.github.webmoleaiPublished by GitHub account webmoleaiv0.1.1Updated Oct 24, 2026

Audit dependency licenses for compatibility issues. Flags GPL/AGPL conflicts.

The publisher's own server: audit.domains - Domain Valuation

VerifiedSTDIODesktop onlyDeveloper Tools Security & Monitoring

Server details

Identifier: io.github.webmoleai/mcp-license-audit
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account webmoleai for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.webmoleai%2Fmcp-license-audit.svg)](https://sourceweft.com/mcp/io.github.webmoleai%2Fmcp-license-audit?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Audits project dependency licenses and flags GPL/AGPL compatibility conflicts.

What you can do: This local MCP server lets an assistant audit the licenses of a project's dependencies and identify compatibility issues. It flags conflicts involving GPL and AGPL licensed packages. The registry description lists no individual tools, so the exact commands and output format are not documented here.
When to use it: Worth adding when you want an assistant to check a codebase's dependency licenses before release, distribution, or a compliance review, especially where copyleft licenses such as GPL or AGPL may conflict with your project's license.
Requirements: Runs as a local process on the user's machine via the npm package mcp-license-audit over stdio. Desktop only; no web executable. No authentication, environment variables, or headers are declared.

Before you install

No credentials, payments, or write actions are declared. The audit reads dependency metadata, so review what project paths or manifests you point it at before running it.

Installation

In SourceWeft

Open Mcp License Audit in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

mcp-license-audit

MCP server that audits your project's dependency licenses for compatibility issues. Flags GPL/AGPL conflicts and generates compliance reports.

What It Does

Parses a package.json file (dependencies + devDependencies)
Fetches license info for each package from the npm registry
Classifies licenses: permissive (MIT, Apache, BSD, ISC), copyleft (GPL, AGPL), weak-copyleft (LGPL, MPL), unknown
Detects conflicts (e.g., GPL dependency in an MIT-licensed project)
Returns a structured JSON report with risk level and summary

Install

Configure in Claude Code

Add to your .claude/mcp.json or ~/.claude/mcp.json:

json

{  "mcpServers": {    "license-audit": {      "command": "npx",      "args": ["mcp-license-audit"]    }  }}

{  "mcpServers": {    "license-audit": {      "command": "npx",      "args": ["mcp-license-audit"]    }  }}

Or if installed globally:

Tool: `audit-licenses`

Input: packageJson — the full contents of a package.json file as a string.

Output: JSON report:

json

{  "totalDependencies": 15,  "analyzed": 15,  "licenses": {    "MIT": ["express", "lodash"],    "Apache-2.0": ["typescript"],    "GPL-3.0": ["some-package"],    "unknown": ["private-pkg"]  },  "conflicts": [    {      "package": "some-package",      "license": "GPL-3.0",      "issue": "GPL dependency in MIT project — must open-source your code if distributed"    }  ],  "riskLevel": "medium",  "summary": "15 deps analyzed. 1 GPL conflict found. 1 unknown license."}

{  "totalDependencies": 15,  "analyzed": 15,  "licenses": {    "MIT": ["express", "lodash"],    "Apache-2.0": ["typescript"],    "GPL-3.0": ["some-package"],    "unknown": ["private-pkg"]  },  "conflicts": [    {      "package": "some-package",      "license": "GPL-3.0",      "issue": "GPL dependency in MIT project — must open-source your code if distributed"    }  ],  "riskLevel": "medium",  "summary": "15 deps analyzed. 1 GPL conflict found. 1 unknown license."}

Risk levels: low (no copyleft), medium (weak copyleft or many unknowns), high (GPL/AGPL found).

Limits

Analyzes first 20 dependencies for speed
Only supports npm packages (no pip/cargo/gem support yet)
License data comes from the npm registry — private packages return "unknown"

Build from Source

Source: README.md at commit cbdfa82

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v0.1.1LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts
Declare a license in the repository or the registry entry.

Other Audit integrations

audit.domains - Domain Valuation

domains.auditOfficial publisher

Deterministic domain-name valuation: fair-value intervals, comparable recorded sales, availability checks, and a verified for-sale listing market.

Streamable HTTPWeb executable

Business & Commerce27 toolsNov 1, 2026

Revenue Agent — OpenAPI Audit & Change Detection

news.prhOfficial publisher

A remote MCP endpoint that audits OpenAPI specifications and detects API changes, charging $0.10 USDC per analysis via x402 on Base.

Streamable HTTPWeb executable

Developer Tools2 toolsOct 24, 2026

SEO Audit & Broken Link Checker

Published by GitHub account prometheus-maker

An Apify-hosted MCP server that audits a website's pages for SEO metadata and finds broken links and images, returning per-page scores.

Streamable HTTPWeb executableAuth

Data & AnalyticsCredential requiredNov 7, 2026

FinePrint AI Legal Risk & Contract Audit MCP Server

Published by GitHub account RitualDev-Lab

Local in-memory scanner that grades legal contracts, NDAs and leases for risk and drafts redline amendments for coding agents.

STDIODesktop only

AI & MLNot validated yetNov 7, 2026

Mcp Supply Audit

Published by GitHub account kimmawla

Audits MCP servers as supply-chain artifacts — registry entries, PyPI/npm packages, client configs and tool definitions — using read-only static checks.