Back to Directory/Developer Tools

io.github.bighippoman/license-compliance

Scan npm dependencies for license compliance issues. Catch GPL contamination.

Developer ToolsTypeScriptv1.0.2

license-compliance-mcp

MCP server that scans npm project dependencies for license compliance issues. Catch GPL contamination before code ships.

Tools

check-licenses

Scan a project's npm dependencies against a license policy and get a detailed compliance report.

Parameters:

  • path (required) — Absolute path to the project root
  • policy (optional, default: "permissive") — Policy preset or custom SPDX expression
    • "permissive" — Only MIT, ISC, BSD, Apache-2.0, etc.
    • "weak-copyleft" — Adds LGPL, MPL-2.0, EPL-2.0
    • "copyleft" — Adds GPL, AGPL
    • Custom: "(MIT OR Apache-2.0)" — Any valid SPDX expression

explain-license

Get a plain-language explanation of any SPDX license — permissions, conditions, limitations, compatibility, and gotchas.

Parameters:

  • license (required) — SPDX identifier (e.g., "MIT", "GPL-3.0-only", "Apache-2.0")

Install

Claude Code

claude mcp add license-compliance -- npx -y license-compliance-mcp

Claude Desktop / Cursor

Add to your config (claude_desktop_config.json or .cursor/mcp.json):

{
  "mcpServers": {
    "license-compliance": {
      "command": "npx",
      "args": ["-y", "license-compliance-mcp"]
    }
  }
}

How It Works

  1. Scans node_modules using license-checker-rseidelsohn
  2. Normalizes license strings to valid SPDX using spdx-correct
  3. Evaluates each package against the policy using spdx-satisfies
  4. Traces dependency chains to show how problematic packages entered the project
  5. Generates a markdown report grouped by severity (critical > warning > info)

Requirements

  • Node.js >= 18
  • Project must have node_modules installed (npm install)

Installation

Source-derived launch command. Check the maintainer’s required arguments and credentials before running:

bash
npx -y license-compliance-mcp

Set up in your AI client

Merge this template into ~/Library/Application Support/Claude/claude_desktop_config.json. Keep existing servers. Add any arguments, credentials, and permissions required by the maintainer; this template has not been install-tested.

json
{
  "mcpServers": {
    "io-github-bighippoman-license-compliance": {
      "command": "npx",
      "args": [
        "-y",
        "license-compliance-mcp"
      ]
    }
  }
}

Restart Claude Desktop completely for changes to take effect. Confirm the server appears connected in the client’s tool list, then try a read-only example from its documentation.

Claude Desktop setup reference

Package

license-compliance-mcpnpm

Compatible MCP Clients

io.github.bighippoman/license-compliance works with any MCP-compatible client. Copy the config snippet from the Configuration section above and add it to the file shown for your client, then restart the application.

  • Claude Desktop~/Library/Application Support/Claude/claude_desktop_config.jsonRestart Claude Desktop completely for changes to take effect.
  • Cursor~/.cursor/mcp.jsonRestart Cursor for changes to take effect.
  • VS Code.vscode/mcp.jsonReload VS Code window for changes to take effect.
  • Windsurf~/.codeium/windsurf/mcp_config.jsonRestart Windsurf for changes to take effect.
  • Claude Code.mcp.jsonSave at the project root, then start Claude Code in that project and review the MCP server approval prompt. Keep real credentials out of shared files.

Learn More