License Sentinel

io.github.wgd5678Published by GitHub account wgd5678v0.1.0Updated Oct 24, 2026

Audit Python and npm dependency licenses before you ship, judged against how you distribute.

VerifiedSTDIODesktop onlyDeveloper Tools

Overview

AI-generated overview

Audit Python and npm dependency licenses before shipping, judged against how the software is distributed.

What you can do
License Sentinel is a local MCP server that checks the licenses of Python and npm dependencies. According to its registry description, it audits those licenses before you ship and judges them against how you distribute your software. No tool list is published, so the exact commands and output format are not documented here.
When to use it
Worth adding when you need to review third-party dependency licenses in a Python or npm project, for example before a release or when distribution terms change. It is aimed at license compliance checks tied to your distribution model.
Requirements
Runs as a local process over stdio, installed from the PyPI package license-sentinel, so a Python environment is needed. No authentication, environment variables, or headers are declared. Desktop only; no web executable.
Before you install
It inspects dependency metadata in your project, so it may read package manifests and lockfiles. No credentials, payments, or write actions are declared, but the published description does not state whether it modifies files or contacts external services; verify behavior before running it on sensitive repositories.

Installation

In SourceWeft

  1. Open License Sentinel in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

license-sentinel

[wgd5678/license-sentinel MCP server]

Audit Python and npm dependency licenses for compliance before you ship — an MCP server for AI coding agents.

An AI agent can add pdf-renderer to your project in one second. It will not tell you that pdf-renderer is AGPL-3.0 and that shipping it inside a closed-source product is a license violation. License data and compatibility rules are things a model cannot reliably recall — packages relicense between versions (MongoDB → SSPL, Redis → BUSL, Elasticsearch → Elastic-2.0), and "the source is on GitHub" does not mean "free to ship".

license-sentinel reads what is actually on your disk and judges it against how you distribute your product.

  • Works for Python and npm in one pass — one scan covers both halves of a mixed stack.
  • Runs locally over stdio. No network calls, no telemetry, nothing leaves your machine.
  • Verdicts, not raw data: CLEAN / REVIEW / BLOCK, each with the reason in plain language.

Tools

ToolWhat it does
audit_project(path, context)Scan a project's dependencies and return counts plus every BLOCKING and REVIEW item with reasons.
check_package(names, context)Check specific packages or messy license strings before installing. Accepts AGPL-3.0, BUSL-1.1, GPLv3, Apache License 2.0, MIT OR Apache-2.0.
generate_notices(path, output)Write a THIRD-PARTY-NOTICES.md attribution document for client hand-off.

There is also a pre_release_license_review prompt that chains the audit into a go/no-go review.

Install

bash
# run without installing (recommended)uvx --from license-sentinel license-sentinel
# or installuv pip install license-sentinel# orpip install license-sentinel

Configure your client

Claude Desktop / Cursor / Windsurf / VS Code Copilot / Zed all read the same shape:

json
{  "mcpServers": {    "license-sentinel": {      "command": "uvx",      "args": ["--from", "license-sentinel", "license-sentinel"]    }  }}

If you installed with pip instead, use "command": "license-sentinel" with no args. Restart the client and the three tools appear.

Distribution context

The same dependency is fine in one context and fatal in another, so every tool takes a context argument:

ContextMeaningWhat it blocks
proprietary (default)Closed-source product you distributeGPL/AGPL/SSPL, BUSL/Elastic, non-commercial
saas-backendNever distributed, only runs on your serversAGPL/SSPL (network trigger), BUSL/Elastic
permissiveYour own project is MIT/Apache/BSDAnything copyleft that would contaminate your terms
copyleft-okYour own project is GPL familyOnly source-available and non-commercial

What it reads

  • Python: .venv/ / venv/ / env/ installed packages (dist-info/METADATA), requirements.txt, pyproject.toml (PEP 621, poetry, dependency-groups)
  • npm: node_modules/*/package.json (including scoped packages), package.json dependencies

If a dependency is declared but not installed, it is reported with an UNKNOWN license rather than silently dropped — an unlicensed dependency is all-rights-reserved by default.

Privacy

No HTTP client is imported anywhere in this package. The scan is read-only (except generate_notices, which writes the file you name). Nothing is uploaded.

Limitations

  • Not legal advice. It is a fast first pass that catches the expensive mistakes; have counsel review anything flagged.
  • Transitive dependencies are read from what is installed. If you have no .venv and no node_modules, declared-only dependencies come back UNKNOWN.
  • The current environment running the server is never scanned, so the server's own packages never pollute your report. Set LICENSE_SENTINEL_SCAN_CURRENT_ENV=1 to change that.

Development

bash
uv syncpython tests/smoke_test.py     # 9 tests, no pytest neededpython tests/e2e_check.py      # calls the tools end to end

License

MIT

Source: README.md at commit a5fb21f

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts