# Dependency License Compliance Checker MCP for AI Agents AI Agent Connect

> Dependency License Compliance Checker MCP validates your software supply chain by checking package licenses against approved SPDX identifiers. It automatically flags non-compliant dependencies, ensuring your project stays within legal and security boundaries without manual auditing.

## Overview
- **Category:** security
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_p1hUOgBX0mrCZCasVpj13eqwO654i46yFkWE318T/ai-agent-connect
- **Tags:** license, spdx, audit, supply-chain, compliance, security

## Description

Managing software dependencies is a constant headache for security teams and developers. You pull in a new library, and suddenly you're potentially violating a license policy you didn't even know existed. This MCP changes that by giving your AI agent the ability to audit your entire dependency tree in seconds. Instead of manually cross-referencing package names against legal documents, you can simply ask your agent to verify if your current stack is safe to use. It checks every package against standard SPDX identifiers and your own specific policy requirements. By connecting this to your development environment through the Vinkius catalog, you turn your AI client into a real-time compliance officer. It catches problematic licenses before they ever make it into your production build, keeping your supply chain secure and your legal team happy. You stop guessing about license compatibility and start building with confidence, knowing your dependencies match your organization's rules.

## Tools

### audit_dependencies
null

### get_dependency_license
Retrieves the specific SPDX identifier for a single package. This is useful for quick lookups of individual libraries.

### validate_license_format
null

## Prompt Examples

**Prompt:** 
```
Are these dependencies compliant with MIT and Apache-2.0 licenses: npm:lodash@4.17.21, npm:react@18.2.0?
```

**Response:** 
```
Yes, both dependencies are compliant with the specified licenses.

| Package | Version | License | Status |
| :--- | :--- | :--- | :--- |
| `lodash` | 4.17.21 | MIT | ✅ Compliant |
| `react` | 18.2.0 | MIT | ✅ Compliant |
```

**Prompt:** 
```
What is the license for npm:react@18.2.0?
```

**Response:** 
```
The license for `npm:react@18.2.0` is **MIT**.
```

**Prompt:** 
```
Check if npm:express@4.17.1 is compliant with MIT.
```

**Response:** 
```
Yes, `npm:express@4.17.1` is compliant with the **MIT** license.
```

## Capabilities

### Verify package compliance
Check a list of software packages against your specific license policies.

### Look up SPDX identifiers
Find the official license identifier for any specific dependency.

### Access permitted license lists
View templates of commonly allowed licenses to set your baseline.

### Flag prohibited licenses
Automatically identify dependencies that violate your security rules.

### Audit software supply chains
Validate the legal safety of your entire dependency tree at once.

## Use Cases

### New library onboarding
A developer wants to add a new utility library but isn't sure if its license is compatible with their commercial project. They ask their agent to check the license first.

### Pre-release compliance audit
Before a major version release, a DevSecOps engineer asks their agent to run a full compliance check on the entire dependency manifest.

### Policy definition setup
A security lead uses the agent to pull up allowed license templates to establish a baseline for the engineering team's new security policy.

### Legacy codebase cleanup
An engineer auditing an old project uses the agent to find any outdated or non-compliant licenses that were missed in previous years.

## Benefits

- Eliminate manual license lookups by letting your agent check SPDX identifiers instantly.
- Prevent legal risks by using check_license_compliance to catch non-permitted licenses early.
- Speed up security reviews with automated dependency validation during development.
- Standardize your policy enforcement using list_allowed_license_templates for consistent rules.
- Reduce supply chain vulnerabilities by verifying every package's legal status.

## How It Works

The bottom line is you get instant, automated license verification for every piece of code you pull into your project.

1. Connect your AI client to the MCP via Vinkius
2. Provide a list of dependencies or a specific package name to your agent
3. Receive a compliance report or specific license identifiers

## Frequently Asked Questions

**How can I use the Dependency License Compliance Checker to secure my code?**
You can use it to automatically verify that every third-party library you add to your project follows your organization's legal requirements, preventing accidental license violations.

**Can I check multiple packages at once with the Dependency License Compliance Checker?**
Yes, you can provide a list of multiple dependencies to your agent, and it will validate all of them against your policy in one go.

**Does the Dependency License Compliance Checker support custom license policies?**
Yes, you can define specific rules and use the agent to check if your current dependencies match those custom requirements.

**How does the Dependency License Compliance Checker identify licenses?**
It uses standardized SPDX identifiers to ensure that the license identification is accurate and follows industry-standard naming conventions.

**Is the Dependency License Compliance Checker useful for CI/CD pipelines?**
Absolutely. By using an AI agent equipped with this MCP, you can automate compliance checks as part of your continuous integration process.

**How do I check if my dependencies are compliant?**
You can use the `check_license_compliance` tool by providing a list of dependency strings and your list of allowed SPDX identifiers.

**What is an SPDX identifier?**
An SPDX identifier is a standardized short-form text string used to identify software licenses, such as 'MIT' or 'Apache-2.0'.

**Can I see a list of common licenses?**
Yes, use the `list_allowed_license_templates` tool to retrieve a reference list of widely accepted SPDX license identifiers.

**Can I check a single package's license?**
Yes, use the `get_dependency_license` tool to find the specific SPDX identifier for any individual dependency string.