Mcp Check Licenses

mcp-license-audit

MCP server that audits your project's dependency licenses for compatibility issues. Flags GPL/AGPL conflicts and generates compliance reports.

What It Does

• Parses a package.json file (dependencies + devDependencies)
• Fetches license info for each package from the npm registry
• Classifies licenses: permissive (MIT, Apache, BSD, ISC), copyleft (GPL, AGPL), weak-copyleft (LGPL, MPL), unknown
• Detects conflicts (e.g., GPL dependency in an MIT-licensed project)
• Returns a structured JSON report with risk level and summary

Install

npm install -g mcp-license-audit# or run directly:npx mcp-license-audit

Configure in Claude Code

Add to your .claude/mcp.json or ~/.claude/mcp.json:

{  "mcpServers": {    "license-audit": {      "command": "npx",      "args": ["mcp-license-audit"]    }  }}

Or if installed globally:

{  "mcpServers": {    "license-audit": {      "command": "mcp-license-audit"    }  }}

Analytics

This server supports MCPcat analytics. To enable usage tracking, session replay, and error monitoring, set the MCPCAT_PROJECT_ID environment variable in your MCP client config:

{  "mcpServers": {    "license-audit": {      "command": "npx",      "args": ["mcp-license-audit"],      "env": {        "MCPCAT_PROJECT_ID": "proj_your_id_here"      }    }  }}

Without it, the server runs normally with no analytics. See the MCPcat setup guide for details.

Tool: audit-licenses

Input: packageJson — the full contents of a package.json file as a string.

Output: JSON report:

{  "totalDependencies": 15,  "analyzed": 15,  "licenses": {    "MIT": ["express", "lodash"],    "Apache-2.0": ["typescript"],    "GPL-3.0": ["some-package"],    "unknown": ["private-pkg"]  },  "conflicts": [    {      "package": "some-package",      "license": "GPL-3.0",      "issue": "GPL dependency in MIT project — must open-source your code if distributed"    }  ],  "riskLevel": "medium",  "summary": "15 deps analyzed. 1 GPL conflict found. 1 unknown license."}

Risk levels: low (no copyleft), medium (weak copyleft or many unknowns), high (GPL/AGPL found).

Limits

• Analyzes first 20 dependencies for speed
• Only supports npm packages (no pip/cargo/gem support yet)
• License data comes from the npm registry — private packages return "unknown"

Build from Source

npm installnpm run buildnode dist/index.js