LicenseGuard

Decides whether an open source dependency's license **actually obligates you** — given how your project ships. Generic license scanners answer a different question ("what license is this?") and then warn on everything. LicenseGuard evaluates the license against your distribution model, so the same license produces different verdicts: | How you ship | AGPL-3.0 dependency | |---|---| | SaaS (network-accessible) | **blocked** — §13 network clause | | Internal use only | allowed | | Distributed binary / on-prem | **blocked** — inherited GPL distribution terms | | **devDependency** (never in the artifact) | **allowed** | That last row is the point. A build-time linter under AGPL never ships, so it triggers nothing — but tools that warn on it anyway train people to ignore every warning they produce. The same distinctions run through the rest of the license landscape, and they are not interchangeable: - **GPL** obligations attach to *distribution*. Running GPL code as a network service is not distribution. - **AGPL** adds §13, which attaches to *network interaction* — a separate trigger from GPL's distribution terms. - **MPL / EPL / CDDL** are file-scoped and linkage-independent. MPL-2.0 §3.3 explicitly permits distributing a Larger Work under your own terms. - **LGPL** is the one that actually depends on linkage: static linking carries a relinking obligation, dynamic linking does not. ## Tools | Tool | When to call it | |---|---| | `check_dependency_license` | Before adding a single dependency | | `check_manifest_licenses` | To audit a whole manifest or lockfile | | `explain_license` | To see what a license requires across every distribution model | ## Coverage **npm · PyPI · Go modules · crates.io** Reads `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `requirements.txt`, `pyproject.toml`, `poetry.lock`, `uv.lock`, `go.mod`, `go.sum`, `Cargo.toml`, `Cargo.lock` — so transitive dependencies are covered, which matters because problem licenses usually arrive as a dependency of a dependency rather than one you added on purpose. Dependencies that cannot be resolved are reported as `not-checked` or `review`, never as `allowed`. An incomplete scan is never presented as clean. ## Run it locally instead No auth on the hosted endpoint. If you would rather not send a lockfile to a third-party service, the same policy engine runs on your machine: ``` docker run -i --rm ghcr.io/rccaoki-wq/license-guard ``` Only package names and versions reach public registries. An end-to-end test pins the hosted and local paths together so they cannot disagree. ## Disclaimer Informational only, based on published license texts and declared dependency metadata. Not legal advice, and it does not claim to identify every obligation.

Readiness is how fully this listing follows its protocol and how it behaved in our probes over 30 days. It is shown for reference and does not move it in search. Search order and leaderboards use the separate quality grade (here B+, 91.0/100), which weighs availability, conformance, p95 speed and descriptor. How the two differ

Compared with peers

Against 53,039 reachable MCP servers in our daily snapshot (2026-11-12 06:46 UTC). Display only; it does not change search order.

Readiness

Higher than 60% of peers

This listing 83 · peer median 81

Latency

Faster than 92% of peers

This listing 94 ms · peer median 326 ms

How many agent tools actually work · All statistics

Listed in

Directories this entry was found in.

How to connect

https://licenseguard.tenchorooms.com/mcp

curl -X POST https://licenseguard.tenchorooms.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}'