Clearlydefined MCP server

@pipeworx/clearlydefined

ClearlyDefined — the licence, copyright attribution and provenance actually found inside an open-source package, from the Linux Foundation's curated dataset.

Part of Pipeworx — an MCP gateway connecting AI agents to 1679+ live data sources.

Tools

by name fragment across npm, Maven, PyPI, RubyGems, NuGet, crates.io, Packagist, Go and GitHub.

• clearlydefined_search(pattern, limit?, type?) — find component coordinates

the curated record for one exact version: declared SPDX licence, every licence expression discovered in the files, the copyright holders to attribute, the upstream source repo + commit, release date, hashes, and 0-100 scores.

• clearlydefineddefinition(type, provider, namespace?, name, revision, includefiles?, file_limit?) —

which scanners (ScanCode, Licensee, REUSE, FOSSology) analysed that revision, and at which versions — i.e. how much evidence sits behind the definition.

• clearlydefinedharveststatus(type, provider, namespace?, name, revision) —

Auth

Keyless.

Data sources

• — coordinate search.
• — one definition.
• — harvest records.

Things the next person would otherwise rediscover

absent namespace is the literal -, as in npm/npmjs/-/express/4.18.2.

• Coordinates are five segments and the namespace is never omitted — an

2026-09-17: lodash, express and requests returned in seconds; log4j-core never returned inside 55 seconds. The pack bounds it at 30s and the error tells the caller to use exact coordinates instead. Other query shapes on /definitions (?type=&provider=&name=&sort=) answered 502.

• ?pattern= is a prefix scan and does not always answer. Measured

different answer from MIT. The payload carries an explicit licenseevidence: "present" | "nonefound" so a null declared_license is never read as "unlicensed" by accident.

• A definition can exist with no licence evidence at all, which is a

revisions as a literal version string and returns an empty definition for it.

• /definitions/.../revisions is NOT a revision list — the API treats

Related packs

osv answers the vulnerability question and deps-dev the dependency question about the same components. This one answers the licence-compliance question.

Quick Start

Add to your MCP client (Claude Desktop, Cursor, Windsurf, etc.):

{
  "mcpServers": {
    "clearlydefined": {
      "url": "https://gateway.pipeworx.io/clearlydefined/mcp"
    }
  }
}

What this endpoint actually serves

tools/list at https://gateway.pipeworx.io/clearlydefined/mcp returns the tools in the table above plus the shared Pipeworx meta-tools — askpipeworx, discovertools, search_within, remember/recall and the rest of the gateway-wide set. So the tool count you see is larger than this table: a single-pack endpoint currently lists roughly 30 shared tools alongside the pack's own. The connection's initialize response states its exact scope, and is the authoritative answer for a given day.

This is deliberate, not multiplexing by accident. The meta-tools are what let a scoped connection answer a question this pack does not cover — via ask_pipeworx, which routes across the whole catalog — without you adding a second MCP server. There is currently no way to mount a pack endpoint without them; if the extra schemas cost you more context than the routing is worth, connect to the full gateway once rather than to several pack endpoints.

Or connect to the full Pipeworx gateway to get every pack's tools listed directly, instead of just this one's:

{
  "mcpServers": {
    "pipeworx": {
      "url": "https://gateway.pipeworx.io/mcp"
    }
  }
}

Shortened. The full README is on GitHub.