licensegate

An npm licence check your AI coding agent can call

Coding agents now choose and install dependencies themselves. They pick by what solves the task; nothing in that loop reads the licence. An MCP tool puts the question where the choice is made, before npm install.

Install licensegate

This page explains how these licences are commonly read. It is not legal advice; for a product decision with money on it, ask a lawyer who handles open source.

Why at the moment of choice

When a person adds a dependency, there is at least a chance they glance at the licence on the npm page. When an agent adds one, it reads the task, finds a package that fits and runs npm install. If the package is AGPL and your product is a SaaS, you find out in CI, in a customer’s security review or in a buyer’s due diligence, after code has been written on top of it. Asking before the install costs one tool call.

What happens when an AI agent calls check_package The agent wants to add an npm package and calls check_package with its name. licensegate reads the licence from the project if the package is installed, otherwise it asks the npm registry for that one package, sending only the name and version. It applies the repo's .licensegate.json policy, then the shipping mode. The answer is ok, so the agent installs it; review, so the agent asks you; or block, so the agent picks another package. Agent: add a PDF library check_package{ name: "mupdf" } Licence from node_modules,or from the npm registry(name and version only) .licensegate.json first,then the --mode ok: installreview: ask youblock: pick another After the install: scan_projectchecks its dependencies
Only check_package, and only for a package that isn’t installed yet, makes a request: the same one npm install would make to the registry. check_licence and scan_project run offline.

Add it to your agent

licensegate 0.8.0 includes the server: licensegate mcp speaks MCP over stdio, with no dependencies and nothing to install globally. In Claude Code, from the project folder:

claude mcp add licensegate -- npx -y https://licensegate.org/dl/licensegate.tgz mcp --mode saas

Add --scope project to share it with the team through a .mcp.json file in the repo. Cursor reads the same shape from .cursor/mcp.json:

.mcp.json (Claude Code) or .cursor/mcp.json (Cursor)
{
  "mcpServers": {
    "licensegate": {
      "command": "npx",
      "args": ["-y", "https://licensegate.org/dl/licensegate.tgz", "mcp", "--mode", "saas"]
    }
  }
}

VS Code uses a servers key and a type:

.vscode/mcp.json
{
  "servers": {
    "licensegate": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "https://licensegate.org/dl/licensegate.tgz", "mcp", "--mode", "saas"]
    }
  }
}

Pick the --mode that matches how you ship: saas, distributed for an app people download, library for a package, internal for tools only your team uses. On native Windows, Claude Code needs cmd /c before npx for local servers. The server reads .licensegate.json from the project, so your licence policy, its deny list and its exceptions apply to the agent’s choices too.

What the agent gets back

Three tools: check_package (a package by name, before installing it), check_licence (an SPDX expression, offline) and scan_project (the whole tree, or with diff only what changed since a git ref). Every answer comes as a short text for the model and as structured data. The real exchange for a SaaS that doesn’t have mupdf yet:

MCP tools/call · response, as JSON-RPC
{
  "content": [{
    "type": "text",
    "text": "BLOCK mupdf@1.28.1  AGPL-3.0-or-later (network) for --mode saas\nsource: npm registry; no dependencies of its own\nnetwork copyleft: users who reach the program over a network can ask for its source\nAn inventory and a risk flag, not legal advice."
  }],
  "structuredContent": {
    "name": "mupdf", "version": "1.28.1", "license": "AGPL-3.0-or-later",
    "category": "network", "verdict": "block", "mode": "saas",
    "source": "npm registry",
    "reason": "network copyleft: users who reach the program over a network can ask for its source"
  },
  "isError": false
}

Two more candidates for the same job, as the agent reads them:

check_package · pdf-lib, then highcharts
OK pdf-lib@1.17.1  MIT (permissive) for --mode saas
source: npm registry; its 4 direct dependencies are not checked: run scan_project after installing
An inventory and a risk flag, not legal advice.

REVIEW highcharts@13.1.1  https://www.highcharts.com/license (unknown) for --mode saas
source: npm registry; no dependencies of its own
no licence licensegate can classify (or UNLICENSED: all rights reserved): read its terms, ask the author or replace the package
An inventory and a risk flag, not legal advice.

Tell the agent when to call it

The server sends the agent a short instruction when it connects, but a line in the file your agent reads at the start of each session is more reliable:

CLAUDE.md or AGENTS.md
## Dependencies
- Before adding an npm package, call the licensegate check_package tool.
  - BLOCK: don't install it. Suggest an alternative with a permissive licence.
  - REVIEW: ask me before installing, and quote the reason it gives.
- After changing package.json, run scan_project with diff "main".

What it doesn’t do

  • It doesn’t check the new package’s own dependencies before the install. Their licences are only known once they are resolved; scan_project and CI cover them.
  • From the registry it trusts the declared licence. For an installed package it also reads the LICENSE file when the field is missing or vague (how).
  • It can’t stop an install. The gate is the CLI in CI: --diff main fails the pull request that brings in a blocked package, whoever wrote it.
  • It isn’t in the official MCP Registry yet. Until it is, add it by hand as above.