English Français العربية

io.github.wgd5678/license-sentinel

Official registry Security

Audit Python and npm dependency licenses before you ship, judged against how you distribute.

Source code Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

PYPI package license-sentinel
Claude Code 
claude mcp add license-sentinel -- uvx license-sentinel==0.1.0
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "license-sentinel": {
            "command": "uvx",
            "args": [
                "license-sentinel==0.1.0"
            ]
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. license-sentinel
  2. Tools
  3. Install
  4. Configure your client
  5. Distribution context
  6. What it reads
  7. Privacy
  8. Limitations
  9. Development
  10. License

license-sentinel

Audit Python and npm dependency licenses for compliance before you ship — an MCP server for AI coding agents.

An AI agent can add pdf-renderer to your project in one second. It will not tell you that pdf-renderer is AGPL-3.0 and that shipping it inside a closed-source product is a license violation. License data and compatibility rules are things a model cannot reliably recall — packages relicense between versions (MongoDB → SSPL, Redis → BUSL, Elasticsearch → Elastic-2.0), and "the source is on GitHub" does not mean "free to ship".

license-sentinel reads what is actually on your disk and judges it against how you distribute your product.

  • Works for Python and npm in one pass — one scan covers both halves of a mixed stack.
  • Runs locally over stdio. No network calls, no telemetry, nothing leaves your machine.
  • Verdicts, not raw data: CLEAN / REVIEW / BLOCK, each with the reason in plain language.

Tools

ToolWhat it does
audit_project(path, context)Scan a project's dependencies and return counts plus every BLOCKING and REVIEW item with reasons.
check_package(names, context)Check specific packages or messy license strings before installing. Accepts AGPL-3.0, BUSL-1.1, GPLv3, Apache License 2.0, MIT OR Apache-2.0.
generate_notices(path, output)Write a THIRD-PARTY-NOTICES.md attribution document for client hand-off.

There is also a pre_release_license_review prompt that chains the audit into a go/no-go review.

Install

# run without installing (recommended)
uvx --from license-sentinel license-sentinel

# or install
uv pip install license-sentinel
# or
pip install license-sentinel

Configure your client

Claude Desktop / Cursor / Windsurf / VS Code Copilot / Zed all read the same shape:

{
  "mcpServers": {
    "license-sentinel": {
      "command": "uvx",
      "args": ["--from", "license-sentinel", "license-sentinel"]
    }
  }
}

If you installed with pip instead, use "command": "license-sentinel" with no args. Restart the client and the three tools appear.

Distribution context

The same dependency is fine in one context and fatal in another, so every tool takes a context argument:

ContextMeaningWhat it blocks
proprietary (default)Closed-source product you distributeGPL/AGPL/SSPL, BUSL/Elastic, non-commercial
saas-backendNever distributed, only runs on your serversAGPL/SSPL (network trigger), BUSL/Elastic
permissiveYour own project is MIT/Apache/BSDAnything copyleft that would contaminate your terms
copyleft-okYour own project is GPL familyOnly source-available and non-commercial

What it reads

  • Python: .venv/ / venv/ / env/ installed packages (dist-info/METADATA), requirements.txt, pyproject.toml (PEP 621, poetry, dependency-groups)
  • npm: node_modules/*/package.json (including scoped packages), package.json dependencies

If a dependency is declared but not installed, it is reported with an UNKNOWN license rather than silently dropped — an unlicensed dependency is all-rights-reserved by default.

Privacy

No HTTP client is imported anywhere in this package. The scan is read-only (except generate_notices, which writes the file you name). Nothing is uploaded.

Limitations

  • Not legal advice. It is a fast first pass that catches the expensive mistakes; have counsel review anything flagged.
  • Transitive dependencies are read from what is installed. If you have no .venv and no node_modules, declared-only dependencies come back UNKNOWN.
  • The current environment running the server is never scanned, so the server's own packages never pollute your report. Set LICENSE_SENTINEL_SCAN_CURRENT_ENV=1 to change that.

Development

uv sync
python tests/smoke_test.py     # 9 tests, no pytest needed
python tests/e2e_check.py      # calls the tools end to end

License

MIT

Frequently asked questions

What is io.github.wgd5678/license-sentinel?

Audit Python and npm dependency licenses before you ship, judged against how you distribute.

How do I install io.github.wgd5678/license-sentinel?

It runs on your machine. In Claude Code: claude mcp add license-sentinel -- uvx license-sentinel==0.1.0. For other clients, paste the JSON configuration from this page into their MCP settings.

Does io.github.wgd5678/license-sentinel need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is io.github.wgd5678/license-sentinel open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains io.github.wgd5678/license-sentinel?

It is published by wgd5678. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.