Spdx MCP server

by mrfentmen·io.github.mrfentmen/spdx-mcp·v1.0.0

No reviews yet

Use this MCP server to SPDX open source license metadata and compatibility helpers. Tools...

A85/100grade A

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

A85/100

full report

Adoption

New

0 stars

Reviews

Write one

Nobody has reviewed Spdx yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Spdx tools (2)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

get_license
Get SPDX metadata for an exact license identifier such as MIT, Apache-2.0, or GPL-3.0-only.
search_licenses
Search SPDX license identifiers and names.

Public scan report

scanner v0.1.10 · 2026-11-01 · same rubric, same numbers if you re-run it

no findings

Code scan8 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 85 days ago12/15
Maintainer identityregistry namespace matches repository owner6/10

Overall 85/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

How Spdx compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 85/100; higher than 70% of 48,255 servers
Tools: 2; the typical server has 7
Tools that change things: 0%; typical: 0%. Fewer write tools means less an agent can break

What its tools let an agent do: 2 read

Install Spdx in Claude Code, Cursor or VS Code

Runs npx -y spdx-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add spdx-mcp -- npx -y spdx-mcp

Add to Cursor

What the publisher says

From the Spdx repository's README, as published. We do not edit it. Read it on GitHub

spdx-mcp

Search the SPDX license list while reviewing dependencies, choosing project licenses, or preparing open-source notices.

Tools

search_licenses: search identifiers and license names.
get_license: fetch metadata for an exact identifier such as MIT, Apache-2.0, or GPL-3.0-only.

This server reports SPDX metadata. It is not a legal opinion and does not perform full dependency license compatibility analysis. The public SPDX list is cached for the process lifetime.

Run

npm install
npm run build
node dist/index.js

Nothing above is checked by us. What we check is on the safety report.

Spdx: common questions

Is Spdx MCP server safe?: Yes, by our scan: it is graded A (85/100). Read the Spdx safety report
How do I install Spdx?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Spdx need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Spdx maintained?: The last commit was 87 days ago (2026-08-08). The latest release is v1.0.0.
How does Spdx compare with other MCP servers?: safety score 85/100 (higher than 70% of 48,255 servers); tools 2 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.