Koskamo

LicenseGuard MCP

An MCP server and web tool that checks whether an open source dependency obligates you based on how you ship. It supports npm, PyPI, Go, and other ecosystems to analyze license compliance for SaaS, distribution, and other models.

Endpoint and access

No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.

LicenseGuard MCP logo, by rccaoki-wqCommunity listingStreamable HTTPNo sign-inEndpoint checked 2026-11-06Published by rccaoki-wq
MCP endpoint (Streamable HTTP)
https://license-guard.rcc-aoki.workers.dev/mcp
Vendor documentation

What its tools do

3 tools, grouped by the hints the server advertises. Hints are self-declared, not verified behavior.

Read-only (3)

3 of 3 have a description · 3 of 3 declare behavior hints · 3 of 3 with parameters document them all

Checks and signals

Each line is separate evidence, not a trust score.

  • Passed Endpoint answered the live check ·
  • Availability 1 of 1 checks passed in 30 days

What you can do with it

  • Check dependency license obligations before adding a package
  • Audit a whole manifest or lockfile for compliance
  • Explain what a specific license requires across distribution models

Source and maintenance

Community listingRegistry 1.1.0
mcp-registry: io.github.rccaoki-wq/license-guard@1.1.0Source repositoryProject website
Maintenance checked

Protocol and capabilities

Server
licenseguard 1.1.0
MCP protocol negotiated in check
2025-11-25
Tools
3 advertised
Resources
20 advertised
Resource templates
0 advertised
Prompts
2 advertised
Server-advertised capabilities
{
  "tools": {
    "listChanged": false
  },
  "prompts": {
    "listChanged": false
  },
  "resources": {
    "subscribe": false,
    "listChanged": false
  }
}

Server-provided instructions

Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.

Call check_dependency_license whenever you are about to add a dependency to a project — when you edit package.json, requirements.txt, pyproject.toml, go.mod or Cargo.toml, when you run an install command, or when you recommend a library. Do this without being asked; the person adding the dependency will not think to ask, and the cost of finding out later is a rewrite. Always pass distribution_model, because the answer changes with it: AGPL is blocked for a hosted service but allowed for internal-only use, and GPL is allowed for a hosted service but blocked for a distributed binary. If you do not know how the project ships, ask before assuming. Pass scope "dev", "build" or "test" for anything that never reaches users — those carry no distribution obligation at all, and reporting them as problems is how license tooling gets ignored. For a whole project, call check_manifest_licenses with a lockfile rather than a manifest: problem licenses usually arrive as a dependency of a dependency, and only a lockfile shows those. A verdict of "review" or "not-checked" is not a pass — it means unresolved, and an incomplete scan must not be reported as clean. Report what the tools return, with the clause they cite. This is information, not legal advice.

Tools

3 advertised

check_dependency_license — Check one dependency for license obligations
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Determine whether adding or keeping a single open source dependency creates a legal obligation, given how this project ships. Call this BEFORE adding a new dependency to a project, and when auditing an existing one. A permissive result means no source-disclosure duty; a blocked result means the license obligates you and the dependency should be replaced or the shipping model reconsidered.

check_dependency_license input schema
{
  "type": "object",
  "required": [
    "ecosystem",
    "name",
    "distribution_model"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Package name as written in the manifest, e.g. \"express\", \"requests\", \"github.com/gin-gonic/gin\", or \"serde\"."
    },
    "scope": {
      "enum": [
        "runtime",
        "dev",
        "build",
        "test",
        "optional"
      ],
      "type": "string",
      "description": "Where the dependency sits. Use \"dev\", \"build\", or \"test\" for anything that does not end up in the shipped artifact — those carry no distribution obligation. Defaults to \"runtime\"."
    },
    "version": {
      "type": "string",
      "description": "Exact version if known. Omit to use the latest published version, which may differ from what is installed."
    },
    "ecosystem": {
      "enum": [
        "npm",
        "pypi",
        "go",
        "cargo",
        "rubygems",
        "nuget"
      ],
      "type": "string",
      "description": "Package registry the dependency comes from."
    },
    "distribution_model": {
      "enum": [
        "saas",
        "distributed-binary",
        "on-prem-delivery",
        "internal-only",
        "library-published"
      ],
      "type": "string",
      "description": "How the software incorporating this dependency reaches its users. This determines the answer: \"saas\" = users reach it over a network; \"distributed-binary\" = shipped as an app or binary; \"on-prem-delivery\" = installed in a customer environment; \"internal-only\" = never leaves your organization; \"library-published\" = released for others to depend on."
    }
  }
}
check_dependency_license output schema
{
  "type": "object",
  "required": [
    "license",
    "verdict",
    "obligations",
    "rationale"
  ],
  "properties": {
    "license": {
      "type": [
        "string",
        "null"
      ]
    },
    "verdict": {
      "enum": [
        "allowed",
        "review",
        "blocked"
      ],
      "type": "string"
    },
    "rationale": {
      "type": "string"
    },
    "reference": {
      "type": "string"
    },
    "assumption": {
      "type": "object",
      "required": [
        "declared",
        "assumed"
      ],
      "properties": {
        "assumed": {
          "type": "string"
        },
        "declared": {
          "type": "string"
        }
      }
    },
    "obligations": {
      "type": "array",
      "items": {
        "type": "string"
      }
    }
  }
}
check_dependency_license annotations
{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
check_manifest_licenses — Check a whole manifest
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Scan an entire dependency manifest and report every dependency whose license creates an obligation for this shipping model. Use when reviewing a project as a whole, preparing for due diligence, or after a large dependency change. Pass a package-lock.json when one exists: problematic licenses usually arrive as transitive dependencies rather than ones you added directly, and only a lockfile reveals those.

check_manifest_licenses input schema
{
  "type": "object",
  "required": [
    "content",
    "distribution_model"
  ],
  "properties": {
    "content": {
      "type": "string",
      "description": "Full text of a lockfile, SBOM, or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, Gemfile.lock, packages.lock.json, CycloneDX (JSON), SPDX (JSON), package.json, requirements.txt, go.mod, Cargo.toml, .csproj, Directory.Packages.props, packages.config. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups. An SBOM covers several ecosystems in one document, but its licenses are read from the document rather than looked up, so they are only as current as the document."
    },
    "distribution_model": {
      "enum": [
        "saas",
        "distributed-binary",
        "on-prem-delivery",
        "internal-only",
        "library-published"
      ],
      "type": "string",
      "description": "How the software incorporating this dependency reaches its users. This determines the answer: \"saas\" = users reach it over a network; \"distributed-binary\" = shipped as an app or binary; \"on-prem-delivery\" = installed in a customer environment; \"internal-only\" = never leaves your organization; \"library-published\" = released for others to depend on."
    }
  }
}
check_manifest_licenses output schema
{
  "type": "object",
  "required": [
    "summary",
    "findings",
    "limitations"
  ],
  "properties": {
    "summary": {
      "type": "object",
      "required": [
        "total",
        "allowed",
        "review",
        "blocked"
      ],
      "properties": {
        "total": {
          "type": "number"
        },
        "review": {
          "type": "number"
        },
        "allowed": {
          "type": "number"
        },
        "blocked": {
          "type": "number"
        }
      },
      "description": "Counts by verdict. total is every dependency found, not only the ones that were resolved."
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "ecosystem",
          "name",
          "scope",
          "verdict",
          "obligations",
          "rationale"
        ],
        "properties": {
          "name": {
            "type": "string"
          },
          "scope": {
            "enum": [
              "runtime",
              "dev",
              "build",
              "test",
              "optional"
            ],
            "type": "string"
          },
          "verdict": {
            "enum": [
              "allowed",
              "review",
              "blocked"
            ],
            "type": "string"
          },
          "version": {
            "type": [
              "string",
              "null"
            ]
          },
          "ecosystem": {
            "type": "string"
          },
          "rationale": {
            "type": "string"
          },
          "obligations": {
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "resolvedFrom": {
            "type": "string",
            "description": "Where the license came from. \"lockfile\" is exact; \"sbom\" means it was written in the SBOM you pasted rather than looked up, so it is only as current as that document; \"registry\" and \"deps-dev\" are the pinned version as published; \"registry-latest\" means the pinned version could not be read and the latest release was used instead; \"not-checked\" means the lookup budget ran out and this dependency was never resolved; \"not-published\" means it is a git dependency, a member of the scanned workspace, or from a private registry, so no public registry has license data for it — re-scanning will not resolve those."
          },
          "spdxExpression": {
            "type": [
              "string",
              "null"
            ]
          }
        }
      }
    },
    "ecosystem": {
      "type": "string"
    },
    "limitations": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "What this scan could not establish. Never empty when anything was left unresolved. Read it before treating a result as clean."
    },
    "distributionModel": {
      "type": "string"
    }
  }
}
check_manifest_licenses annotations
{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
explain_license — Explain what a license requires
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Given an SPDX license identifier or expression, explain what it requires across every shipping model at once. Use when the question is about the license itself rather than a specific package — for example when comparing AGPL-3.0 against GPL-3.0 for a hosted service, or deciding what a project may safely depend on.

explain_license input schema
{
  "type": "object",
  "required": [
    "license"
  ],
  "properties": {
    "license": {
      "type": "string",
      "description": "SPDX identifier or expression, e.g. \"AGPL-3.0-only\", \"Apache-2.0\", or \"(MIT OR GPL-2.0-only)\"."
    },
    "linkage": {
      "enum": [
        "dynamic",
        "static",
        "separate-process"
      ],
      "type": "string",
      "description": "How the dependency is linked. Matters for LGPL-family licenses. Compiled languages such as Go and Rust normally link statically. Defaults to \"dynamic\"."
    }
  }
}
explain_license output schema
{
  "type": "object",
  "required": [
    "license",
    "byDistributionModel",
    "devScope"
  ],
  "properties": {
    "license": {
      "type": "string"
    },
    "linkage": {
      "type": "string"
    },
    "devScope": {
      "type": "object",
      "required": [
        "verdict",
        "rationale"
      ],
      "properties": {
        "verdict": {
          "enum": [
            "allowed",
            "review",
            "blocked"
          ],
          "type": "string"
        },
        "rationale": {
          "type": "string"
        }
      },
      "description": "The result when the dependency never reaches users (dev, build or test scope). Independent of the shipping model."
    },
    "byDistributionModel": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "model",
          "verdict",
          "obligations",
          "rationale"
        ],
        "properties": {
          "model": {
            "enum": [
              "saas",
              "distributed-binary",
              "on-prem-delivery",
              "internal-only",
              "library-published"
            ],
            "type": "string"
          },
          "verdict": {
            "enum": [
              "allowed",
              "review",
              "blocked"
            ],
            "type": "string"
          },
          "rationale": {
            "type": "string"
          },
          "obligations": {
            "type": "array",
            "items": {
              "type": "string"
            }
          }
        }
      },
      "description": "One row per way of shipping. This is where the same license diverges."
    }
  }
}
explain_license annotations
{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}

Prompts

2 advertised

audit_project — Audit this project for license obligations

Advertised by the server during the last successful anonymous check.

Find this project's dependency manifest and check every dependency, including transitive ones, against the way the project ships.

distribution_model
How this project reaches its users. One of: saas, distributed-binary, on-prem-delivery, internal-only, library-published. (required)
compare_licenses — Compare two licenses for a shipping model

Advertised by the server during the last successful anonymous check.

Explain how two licenses differ for one specific way of shipping software, rather than in the abstract.

license_a
SPDX identifier, e.g. "AGPL-3.0-only". (required)
license_b
SPDX identifier, e.g. "GPL-3.0-only". (required)
distribution_model
The shipping model to compare under. One of: saas, distributed-binary, on-prem-delivery, internal-only, library-published. (required)

Resources

20 advertised

MIT — MIT License

Advertised by the server during the last successful anonymous check.

What MIT requires, and the verdict for each way of shipping software.

MIT URI
licenseguard://license/MIT

MIME type: text/markdown

Apache-2.0 — Apache License 2.0

Advertised by the server during the last successful anonymous check.

What Apache-2.0 requires, and the verdict for each way of shipping software.

Apache-2.0 URI
licenseguard://license/Apache-2.0

MIME type: text/markdown

BSD-3-Clause — BSD 3-Clause License

Advertised by the server during the last successful anonymous check.

What BSD-3-Clause requires, and the verdict for each way of shipping software.

BSD-3-Clause URI
licenseguard://license/BSD-3-Clause

MIME type: text/markdown

BSD-2-Clause — BSD 2-Clause License

Advertised by the server during the last successful anonymous check.

What BSD-2-Clause requires, and the verdict for each way of shipping software.

BSD-2-Clause URI
licenseguard://license/BSD-2-Clause

MIME type: text/markdown

ISC — ISC License

Advertised by the server during the last successful anonymous check.

What ISC requires, and the verdict for each way of shipping software.

ISC URI
licenseguard://license/ISC

MIME type: text/markdown

GPL-2.0-only — GNU General Public License v2.0

Advertised by the server during the last successful anonymous check.

What GPL-2.0-only requires, and the verdict for each way of shipping software.

GPL-2.0-only URI
licenseguard://license/GPL-2.0-only

MIME type: text/markdown

GPL-3.0-only — GNU General Public License v3.0

Advertised by the server during the last successful anonymous check.

What GPL-3.0-only requires, and the verdict for each way of shipping software.

GPL-3.0-only URI
licenseguard://license/GPL-3.0-only

MIME type: text/markdown

LGPL-2.1-only — GNU Lesser General Public License v2.1

Advertised by the server during the last successful anonymous check.

What LGPL-2.1-only requires, and the verdict for each way of shipping software.

LGPL-2.1-only URI
licenseguard://license/LGPL-2.1-only

MIME type: text/markdown

LGPL-3.0-only — GNU Lesser General Public License v3.0

Advertised by the server during the last successful anonymous check.

What LGPL-3.0-only requires, and the verdict for each way of shipping software.

LGPL-3.0-only URI
licenseguard://license/LGPL-3.0-only

MIME type: text/markdown

AGPL-3.0-only — GNU Affero General Public License v3.0

Advertised by the server during the last successful anonymous check.

What AGPL-3.0-only requires, and the verdict for each way of shipping software.

AGPL-3.0-only URI
licenseguard://license/AGPL-3.0-only

MIME type: text/markdown

MPL-2.0 — Mozilla Public License 2.0

Advertised by the server during the last successful anonymous check.

What MPL-2.0 requires, and the verdict for each way of shipping software.

MPL-2.0 URI
licenseguard://license/MPL-2.0

MIME type: text/markdown

EPL-2.0 — Eclipse Public License 2.0

Advertised by the server during the last successful anonymous check.

What EPL-2.0 requires, and the verdict for each way of shipping software.

EPL-2.0 URI
licenseguard://license/EPL-2.0

MIME type: text/markdown

SSPL-1.0 — Server Side Public License

Advertised by the server during the last successful anonymous check.

What SSPL-1.0 requires, and the verdict for each way of shipping software.

SSPL-1.0 URI
licenseguard://license/SSPL-1.0

MIME type: text/markdown

BUSL-1.1 — Business Source License 1.1

Advertised by the server during the last successful anonymous check.

What BUSL-1.1 requires, and the verdict for each way of shipping software.

BUSL-1.1 URI
licenseguard://license/BUSL-1.1

MIME type: text/markdown

Elastic-2.0 — Elastic License 2.0

Advertised by the server during the last successful anonymous check.

What Elastic-2.0 requires, and the verdict for each way of shipping software.

Elastic-2.0 URI
licenseguard://license/Elastic-2.0

MIME type: text/markdown

CC0-1.0 — CC0 1.0 Universal

Advertised by the server during the last successful anonymous check.

What CC0-1.0 requires, and the verdict for each way of shipping software.

CC0-1.0 URI
licenseguard://license/CC0-1.0

MIME type: text/markdown

Unlicense — The Unlicense

Advertised by the server during the last successful anonymous check.

What Unlicense requires, and the verdict for each way of shipping software.

Unlicense URI
licenseguard://license/Unlicense

MIME type: text/markdown

Zlib — zlib License

Advertised by the server during the last successful anonymous check.

What Zlib requires, and the verdict for each way of shipping software.

Zlib URI
licenseguard://license/Zlib

MIME type: text/markdown

CC-BY-4.0 — Creative Commons Attribution 4.0

Advertised by the server during the last successful anonymous check.

What CC-BY-4.0 requires, and the verdict for each way of shipping software.

CC-BY-4.0 URI
licenseguard://license/CC-BY-4.0

MIME type: text/markdown

CC-BY-NC-4.0 — Creative Commons Attribution-NonCommercial 4.0

Advertised by the server during the last successful anonymous check.

What CC-BY-NC-4.0 requires, and the verdict for each way of shipping software.

CC-BY-NC-4.0 URI
licenseguard://license/CC-BY-NC-4.0

MIME type: text/markdown

90-day uptime

A lightweight connection check about every six hours, sampled on hosts with many listings. It shows the server answered, not that its tools work.

Too few checks for a percentage yet (2 of 2 answered).

  1. 2026-11-07: 2 of 2 checks answered

30-day availability

Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.

Successful checks
1 of 1 (100%)
Average latency
454 ms
95th percentile latency
454 ms

Maintenance history

Public check and source-refresh events. Editorial and ownership records remain private.

  • · probe · passed · 454 ms · metadata changed · 3 tool(s), 20 resource(s), 0 resource template(s), 2 prompt(s)

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers the remote server. Use --scope project to write .mcp.json for the repo.
Claude Code configuration
claude mcp add --transport http licenseguard-mcp-workers https://license-guard.rcc-aoki.workers.dev/mcp

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).
Codex configuration
codex mcp add licenseguard-mcp-workers --url https://license-guard.rcc-aoki.workers.dev/mcp

Cursor

Merge this server into .cursor/mcp.json in your project, then enable licenseguard-mcp-workers in your MCP settings.
Cursor configuration
{
  "mcpServers": {
    "licenseguard-mcp-workers": {
      "url": "https://license-guard.rcc-aoki.workers.dev/mcp"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure).
Cline configuration
{
  "mcpServers": {
    "licenseguard-mcp-workers": {
      "type": "streamableHttp",
      "url": "https://license-guard.rcc-aoki.workers.dev/mcp",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start licenseguard-mcp-workers and inspect its tools.
VS Code configuration
{
  "servers": {
    "licenseguard-mcp-workers": {
      "type": "http",
      "url": "https://license-guard.rcc-aoki.workers.dev/mcp"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.
Gemini CLI configuration
gemini mcp add --transport http licenseguard-mcp-workers https://license-guard.rcc-aoki.workers.dev/mcp

Claude Desktop

Open Claude Settings > Connectors > Add custom connector, enter this server URL and enable it for the conversation. This is a manual remote-connector handoff, not a desktop JSON configuration.
Claude Desktop configuration
https://license-guard.rcc-aoki.workers.dev/mcp

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.
Windsurf configuration
{
  "mcpServers": {
    "licenseguard-mcp-workers": {
      "serverUrl": "https://license-guard.rcc-aoki.workers.dev/mcp"
    }
  }
}

Let your agent find its tools

Find servers like LicenseGuard MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows
See all 8,851