io.github.bighippoman/license-compliance
Scan npm dependencies for license compliance issues. Catch GPL contamination.
Open source Open in the app JSON README (API)
About
Scan npm dependencies for license compliance issues. Catch GPL contamination.
Details
- Kind
- MCP servers
- Topic
- Developer tools
- Publisher
- bighippoman
- Origin
- official
- Category
- ferramentas
- Transport
- local
- Version
- 1.0.2
- Last push
- 2026-03-06T09:30:06Z
- Repository state
- ativo
- Language
- TypeScript
- License
- MIT
- Added
- 2026-08-29 03:02:31
- Updated
- 2026-08-29 03:02:31
- Origin id
io.github.bighippoman/license-compliance
README
# license-compliance-mcp
MCP server that scans npm project dependencies for license compliance issues. Catch GPL contamination before code ships.
## Tools
### `check-licenses`
Scan a project's npm dependencies against a license policy and get a detailed compliance report.
**Parameters:**
- `path` (required) — Absolute path to the project root
- `policy` (optional, default: `"permissive"`) — Policy preset or custom SPDX expression
- `"permissive"` — Only MIT, ISC, BSD, Apache-2.0, etc.
- `"weak-copyleft"` — Adds LGPL, MPL-2.0, EPL-2.0
- `"copyleft"` — Adds GPL, AGPL
- Custom: `"(MIT OR Apache-2.0)"` — Any valid SPDX expression
### `explain-license`
Get a plain-language explanation of any SPDX license — permissions, conditions, limitations, compatibility, and gotchas.
**Parameters:**
- `license` (required) — SPDX identifier (e.g., `"MIT"`, `"GPL-3.0-only"`, `"Apache-2.0"`)
## Install
### Claude Code
```bash
claude mcp add license-compliance -- npx -y license-compliance-mcp
```
### Claude Desktop / Cursor
Add to your config (`claude_desktop_config.json` or `.cursor/mcp.json`):
```json
{
"mcpServers": {
"license-compliance": {
"command": "npx",
"args": ["-y", "license-compliance-mcp"]
}
}
}
```
## How It Works
1. Scans `node_modules` using `license-checker-rseidelsohn`
2. Normalizes license strings to valid SPDX using `spdx-correct`
3. Evaluates each package against the policy using `spdx-satisfies`
4. Traces dependency chains to show how problematic packages entered the project
5. Generates a markdown report grouped by severity (critical > warning > info)
## Requirements
- Node.js >= 18
- Project must have `node_modules` installed (`npm install`)