License Guardian MCP Server

license-guardian ⚖️

Audit the license of every npm dependency before you ship — and catch the copyleft / source-available traps an LLM won't.

An AI agent just added a dependency. Is it AGPL? BUSL? unlicensed? Licenses change between versions, and "the source is on GitHub" does not mean "free to ship in a closed product." license-guardian resolves each dependency's real license from the live npm registry and tells you whether it is compatible with how you distribute.

It's part of the guardian set:

• import-guardian — catches hallucinated imports (packages that don't exist) in AI-generated code.
• npm-guardian — audits a chosen package for CVEs and supply-chain malware.
• lockfile-guardian — audits the resolved package-lock.json for integrity tampering and risky install scripts.
• license-guardian (this) — audits the legal compatibility of the licenses you're about to ship.

---

Why an MCP server (the moat)

A coding agent does not reliably know:

• the exact license a specific version of a package shipped with (packages relicense — MongoDB → SSPL, Redis → BUSL, many tools → AGPL),
• which licenses are source-available but not open source (BUSL, Elastic, SSPL — they look free on GitHub and aren't),
• the compatibility rules (AGPL in a closed SaaS backend, GPL in a proprietary binary, a missing license = all-rights-reserved).

license-guardian pairs a curated SPDX knowledge base with the live license string from npm for the exact version, and judges it against your distribution context. That's data + rules the agent can't fabricate.

What it catches

Use as an MCP server (free)

{
  "mcpServers": {
    "license-guardian": { "command": "npx", "args": ["-y", "license-guardian-mcp"] }
  }
}

Tools:

• audit_package_json — paste a package.json, get a CLEAN / REVIEW / BLOCK verdict per dependency.
• audit_dependencies — audit an explicit list of name / name@version.
• explain_license — resolve and explain one package's real license (SPDX id, obligations, copyleft strength, commercial risk).

Each tool takes a context: proprietary (default), saas-backend, permissive, or copyleft-ok.

Use as an HTTP API

POST /audit    { "package_json": "{…}", "context": "saas-backend" }   # free, 30/h/IP
POST /deps     { "names": ["express","mongodb@5.0.0"], "context": "proprietary" }
GET  /license?name=next@13.0.0                                        # explain one
POST /mcp                                                             # MCP-over-HTTP

Live: https://license-guardian-psi.vercel.app — try /license?name=express.

Pay-per-call (x402)

The /pro/* routes are gated by x402. Your agent pays $0.02 USDC per call automatically — no sign-up, no API key. Settles on-chain (USDC on Base). The server holds no private key; payTo is a public receiving address only.

POST /pro/audit   { "package_json": "…", "context": "…" }   # 402 → pay → result, no rate limit

How it works

1. Parse the dependency list (prod + peer + optional by default; dev optional).
2. For each name@version, fetch the real license string from registry.npmjs.org for that exact version.
3. Normalize the (often messy) license string to a canonical SPDX id.
4. Judge it against your project context using a curated compatibility table.
5. Return per-dependency verdicts + a roll-up + a license-category breakdown.

Runtime dependencies: only @modelcontextprotocol/sdk (the HTTP/x402 stack is a build-time concern). Fast npx, nothing heavy on install.

License

MIT © 2026. This tool provides automated guidance, not legal advice — for high-stakes compliance, confirm with counsel.