Check if a dependency's license obligates you, based on how you ship. npm, PyPI, Go.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Determine whether adding or keeping a single open source dependency creates a legal obligation, given how this project ships. Call this BEFORE adding a new dependency to a project, and when auditing an existing one. A permissive result means no source-disclosure duty; a blocked result means the license obligates you and the dependency should be replaced or the shipping model reconsidered.
Package name as written in the manifest, e.g. "express", "requests", "github.com/gin-gonic/gin", or "serde".
Package registry the dependency comes from.
How the software incorporating this dependency reaches its users. This determines the answer: "saas" = users reach it over a network; "distributed-binary" = shipped as an app or binary; "on-prem-delivery" = installed in a customer environment; "internal-only" = never leaves your organization; "library-published" = released for others to depend on.
Where the dependency sits. Use "dev", "build", or "test" for anything that does not end up in the shipped artifact — those carry no distribution obligation. Defaults to "runtime".
Exact version if known. Omit to use the latest published version, which may differ from what is installed.
Determine whether adding or keeping a single open source dependency creates a legal obligation, given how this project ships. Call this BEFORE adding a new dependency to a project, and when auditing an existing one. A permissive result means no source-disclosure duty; a blocked result means the license obligates you and the dependency should be replaced or the shipping model reconsidered.
| Argument | Type | Description |
|---|---|---|
| name* | string | Package name as written in the manifest, e.g. "express", "requests", "github.com/gin-gonic/gin", or "serde". |
| scope | string | Where the dependency sits. Use "dev", "build", or "test" for anything that does not end up in the shipped artifact — those carry no distribution obligation. Defaults to "runtime". |
| version | string | Exact version if known. Omit to use the latest published version, which may differ from what is installed. |
| ecosystem* | string | Package registry the dependency comes from. |
| distribution_model* | string | How the software incorporating this dependency reaches its users. This determines the answer: "saas" = users reach it over a network; "distributed-binary" = shipped as an app or binary; "on-prem-delivery" = installed in a customer environment; "internal-only" = never leaves your organization; "library-published" = released for others to depend on. |
{
"type": "object",
"required": [
"ecosystem",
"name",
"distribution_model"
],
"properties": {
"name": {
"type": "string",
"description": "Package name as written in the manifest, e.g. \"express\", \"requests\", \"github.com/gin-gonic/gin\", or \"serde\"."
},
"scope": {
"enum": [
"runtime",
"dev",
"build",
"test",
"optional"
],
"type": "string",
"description": "Where the dependency sits. Use \"dev\", \"build\", or \"test\" for anything that does not end up in the shipped artifact — those carry no distribution obligation. Defaults to \"runtime\"."
},
"version": {
"type": "string",
"description": "Exact version if known. Omit to use the latest published version, which may differ from what is installed."
},
"ecosystem": {
"enum": [
"npm",
"pypi",
"go",
"cargo",
"rubygems",
"nuget"
],
"type": "string",
"description": "Package registry the dependency comes from."
},
"distribution_model": {
"enum": [
"saas",
"distributed-binary",
"on-prem-delivery",
"internal-only",
"library-published"
],
"type": "string",
"description": "How the software incorporating this dependency reaches its users. This determines the answer: \"saas\" = users reach it over a network; \"distributed-binary\" = shipped as an app or binary; \"on-prem-delivery\" = installed in a customer environment; \"internal-only\" = never leaves your organization; \"library-published\" = released for others to depend on."
}
}
}Scan an entire dependency manifest and report every dependency whose license creates an obligation for this shipping model. Use when reviewing a project as a whole, preparing for due diligence, or after a large dependency change. Pass a package-lock.json when one exists: problematic licenses usually arrive as transitive dependencies rather than ones you added directly, and only a lockfile reveals those.
| Argument | Type | Description |
|---|---|---|
| content* | string | Full text of a lockfile, SBOM, or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, Gemfile.lock, packages.lock.json, CycloneDX (JSON), SPDX (JSON), package.json, requirements.txt, go.mod, Cargo.toml, .csproj, Directory.Packages.props, packages.config. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups. An SBOM covers several ecosystems in one document, but its licenses are read from the document rather than looked up, so they are only as current as the document. |
| distribution_model* | string | How the software incorporating this dependency reaches its users. This determines the answer: "saas" = users reach it over a network; "distributed-binary" = shipped as an app or binary; "on-prem-delivery" = installed in a customer environment; "internal-only" = never leaves your organization; "library-published" = released for others to depend on. |
{
"type": "object",
"required": [
"content",
"distribution_model"
],
"properties": {
"content": {
"type": "string",
"description": "Full text of a lockfile, SBOM, or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, Gemfile.lock, packages.lock.json, CycloneDX (JSON), SPDX (JSON), package.json, requirements.txt, go.mod, Cargo.toml, .csproj, Directory.Packages.props, packages.config. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups. An SBOM covers several ecosystems in one document, but its licenses are read from the document rather than looked up, so they are only as current as the document."
},
"distribution_model": {
"enum": [
"saas",
"distributed-binary",
"on-prem-delivery",
"internal-only",
"library-published"
],
"type": "string",
"description": "How the software incorporating this dependency reaches its users. This determines the answer: \"saas\" = users reach it over a network; \"distributed-binary\" = shipped as an app or binary; \"on-prem-delivery\" = installed in a customer environment; \"internal-only\" = never leaves your organization; \"library-published\" = released for others to depend on."
}
}
}Given an SPDX license identifier or expression, explain what it requires across every shipping model at once. Use when the question is about the license itself rather than a specific package — for example when comparing AGPL-3.0 against GPL-3.0 for a hosted service, or deciding what a project may safely depend on.
| Argument | Type | Description |
|---|---|---|
| license* | string | SPDX identifier or expression, e.g. "AGPL-3.0-only", "Apache-2.0", or "(MIT OR GPL-2.0-only)". |
| linkage | string | How the dependency is linked. Matters for LGPL-family licenses. Compiled languages such as Go and Rust normally link statically. Defaults to "dynamic". |
{
"type": "object",
"required": [
"license"
],
"properties": {
"license": {
"type": "string",
"description": "SPDX identifier or expression, e.g. \"AGPL-3.0-only\", \"Apache-2.0\", or \"(MIT OR GPL-2.0-only)\"."
},
"linkage": {
"enum": [
"dynamic",
"static",
"separate-process"
],
"type": "string",
"description": "How the dependency is linked. Matters for LGPL-family licenses. Compiled languages such as Go and Rust normally link statically. Defaults to \"dynamic\"."
}
}
}