MCP.Market

LicenseGuard MCP server

online · 100% uptime
by rccaoki-wq·io.github.rccaoki-wq/license-guard·v1.1.0
No reviews yet

Check if a dependency's license obligates you, based on how you ship. npm, PyPI, Go.

B84/100grade B
Write a reviewRun it
What users say
No reviews yet
Be the first
Safety scan
B84/100

full report

Adoption
New

0 stars

Reviews

Write one

Nobody has reviewed LicenseGuard yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

LicenseGuard tools (3)

write = sends, deletes, buys or posts
  • check_dependency_licenseFree

    Determine whether adding or keeping a single open source dependency creates a legal obligation, given how this project ships. Call this BEFORE adding a new dependency to a project, and when auditing an existing one. A permissive result means no source-disclosure duty; a blocked result means the license obligates you and the dependency should be replaced or the shipping model reconsidered.

  • check_manifest_licensesFree

    Scan an entire dependency manifest and report every dependency whose license creates an obligation for this shipping model. Use when reviewing a project as a whole, preparing for due diligence, or after a large dependency change. Pass a package-lock.json when one exists: problematic licenses usually arrive as transitive dependencies rather than ones you added directly, and only a lockfile reveals those.

  • explain_licenseFree

    Given an SPDX license identifier or expression, explain what it requires across every shipping model at once. Use when the question is about the license itself rather than a specific package — for example when comparing AGPL-3.0 against GPL-3.0 for a hosted service, or deciding what a project may safely depend on.

Public scan report

scanner v0.1.10 · 2026-11-02 · same rubric, same numbers if you re-run it

no findings
  • –Code scanpackage could not be scannedn/a
  • Live reliabilityremote reachable in 421ms20/20
  • Tool poisoning3 tool descriptions checked15/15
  • Auth qualityopen endpoint, read-only tools10/15
  • Maintenancelast push 67 days ago12/15
  • Maintainer identityregistry namespace matches repository owner6/10
Overall 84/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How LicenseGuard compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
84/100
higher than 68% of 48,255 servers
Tools
3
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
Uptime
100%
of our recent checks; the typical remote server answers 100%
Response time
59 ms
faster than 91% of 30,031 servers

What its tools let an agent do: 3 read

Install LicenseGuard in Claude Code, Cursor or VS Code

claude mcp add --transport http license-guard https://license-guard.rcc-aoki.workers.dev/mcp
Add to Cursor

What the publisher says

From the LicenseGuard repository's README, as published. We do not edit it. Read it on GitHub

LicenseGuard

English | 日本語

Also listed on mcpservers.org, Smithery, the TensorBlock MCP Index, and the Docker MCP catalog.

Does this dependency's license create an obligation for the way you ship software?

Generic license scanners answer a different question — "what license is this?" — and then warn on everything. LicenseGuard evaluates the license against your distribution model, so the same license produces different verdicts depending on how the software reaches its users.

Live: https://licenseguard.tenchorooms.com

The workers.dev origin below is the same deployment, kept as the stable endpoint the MCP catalogs point at.

Why does the distribution model decide it?

That last row is the whole point. A build-time linter under AGPL never ships, so it triggers nothing — but tools that warn on it anyway train people to ignore every warning they produce.

The same split runs through the rest of the license landscape, and the distinctions are not interchangeable:

  • GPL obligations attach to distribution. Running GPL code as a network service is not distribution.
  • AGPL adds §13, which attaches to network interaction — a separate trigger from GPL's distribution terms. Citing §13 for a distribution case is simply wrong, and LicenseGuard doesn't.
  • MPL / EPL / CDDL are file-scoped and linkage-independent. MPL-2.0 §3.3 explicitly permits distributing a Larger Work under your own terms. Applying LGPL's relinking logic to them produces false positives.
  • LGPL is the one that actually depends on linkage: static linking carries a relinking obligation, dynamic linking does not.

Verdicts are stated as facts with the clause cited. LicenseGuard does not tell you what to do.

Common questions

Does the GPL apply if I only host the software and never distribute it? No. GPL-3.0 triggers its obligations on distribution. Hosted SaaS is not distribution, so no obligation arises today — but shipping the same software later, as an on-prem deployment, a binary, or a published library, would trigger whole-work source disclosure.

Does the AGPL apply if I only host the software as a SaaS? Yes. AGPL-3.0 §13 requires that users interacting with a modified version over a network be offered the corresponding source of the whole work. This is the clause that makes AGPL behave differently from GPL for hosted services, and it is the entire practical difference between the two.

Do build-time and dev dependencies create license obligations? No. A dev dependency is not part of the artifact you ship, so distribution-triggered obligations do not arise. Tools that emit code into your output, such as code generators, are a separate case worth checking individually.

Is MIT safe for commercial use? Yes, in every distribution model. MIT asks for attribution and nothing more. Apache-2.0 reaches the same result while adding a patent grant and a NOTICE requirement — obligations, but ones that do not vary by how you ship.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Grade history

  • 2026-11-02downgradeA → Bscore 84

LicenseGuard: common questions

Is LicenseGuard MCP server safe?
Mostly: it is graded B (84/100). Read the LicenseGuard safety report
How do I install LicenseGuard?
It runs remotely at license-guard.rcc-aoki.workers.dev. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
Does LicenseGuard need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is LicenseGuard maintained?
The last commit was 69 days ago (2026-08-27). The latest release is v1.1.0.
Is LicenseGuard up?
100% of our last 28 checks got an answer. We check remote servers about four times a day.
How does LicenseGuard compare with other MCP servers?
safety score 84/100 (higher than 68% of 48,255 servers); tools 3 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.