Server definition

Hash: sha256:1869c862e0bb92326f1f27510b74024e5877abba3fe83c7d80ac9c34441c13ae
What it is: What a remote MCP server returned when asked what it offers: 3 tools

The blob, as servednamed by its sha256

{
  "instructions": "Call check_dependency_license whenever you are about to add a dependency to a project — when you edit package.json, requirements.txt, pyproject.toml, go.mod or Cargo.toml, when you run an install command, or when you recommend a library. Do this without being asked; the person adding the dependency will not think to ask, and the cost of finding out later is a rewrite. Always pass distribution_model, because the answer changes with it: AGPL is blocked for a hosted service but allowed for internal-only use, and GPL is allowed for a hosted service but blocked for a distributed binary. If you do not know how the project ships, ask before assuming. Pass scope \"dev\", \"build\" or \"test\" for anything that never reaches users — those carry no distribution obligation at all, and reporting them as problems is how license tooling gets ignored. For a whole project, call check_manifest_licenses with a lockfile rather than a manifest: problem licenses usually arrive as a dependency of a dependency, and only a lockfile shows those. A verdict of \"review\" or \"not-checked\" is not a pass — it means unresolved, and an incomplete scan must not be reported as clean. Report what the tools return, with the clause they cite. This is information, not legal advice.",
  "tools": [
    {
      "description": "Determine whether adding or keeping a single open source dependency creates a legal obligation, given how this project ships. Call this BEFORE adding a new dependency to a project, and when auditing an existing one. A permissive result means no source-disclosure duty; a blocked result means the license obligates you and the dependency should be replaced or the shipping model reconsidered.",
      "inputSchema": {
        "properties": {
          "distribution_model": {
            "description": "How the software incorporating this dependency reaches its users. This determines the answer: \"saas\" = users reach it over a network; \"distributed-binary\" = shipped as an app or binary; \"on-prem-delivery\" = installed in a customer environment; \"internal-only\" = never leaves your organization; \"library-published\" = released for others to depend on.",
            "enum": [
              "saas",
              "distributed-binary",
              "on-prem-delivery",
              "internal-only",
              "library-published"
            ],
            "type": "string"
          },
          "ecosystem": {
            "description": "Package registry the dependency comes from.",
            "enum": [
              "npm",
              "pypi",
              "go",
              "cargo",
              "rubygems",
              "nuget"
            ],
            "type": "string"
          },
          "name": {
            "description": "Package name as written in the manifest, e.g. \"express\", \"requests\", \"github.com/gin-gonic/gin\", or \"serde\".",
            "type": "string"
          },
          "scope": {
            "description": "Where the dependency sits. Use \"dev\", \"build\", or \"test\" for anything that does not end up in the shipped artifact — those carry no distribution obligation. Defaults to \"runtime\".",
            "enum": [
              "runtime",
              "dev",
              "build",
              "test",
              "optional"
            ],
            "type": "string"
          },
          "version": {
            "description": "Exact version if known. Omit to use the latest published version, which may differ from what is installed.",
            "type": "string"
          }
        },
        "required": [
          "ecosystem",
          "name",
          "distribution_model"
        ],
        "type": "object"
      },
      "name": "check_dependency_license",
      "outputSchema": {
        "properties": {
          "assumption": {
            "properties": {
              "assumed": {
                "type": "string"
              },
              "declared": {
                "type": "string"
              }
            },
            "required": [
              "declared",
              "assumed"
            ],
            "type": "object"
          },
          "license": {
            "type": [
              "string",
              "null"
            ]
          },
          "obligations": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "rationale": {
            "type": "string"
          },
          "reference": {
            "type": "string"
          },
          "verdict": {
            "enum": [
              "allowed",
              "review",
              "blocked"
            ],
            "type": "string"
          }
        },
        "required": [
          "license",
          "verdict",
          "obligations",
          "rationale"
        ],
        "type": "object"
      }
    },
    {
      "description": "Scan an entire dependency manifest and report every dependency whose license creates an obligation for this shipping model. Use when reviewing a project as a whole, preparing for due diligence, or after a large dependency change. Pass a package-lock.json when one exists: problematic licenses usually arrive as transitive dependencies rather than ones you added directly, and only a lockfile reveals those.",
      "inputSchema": {
        "properties": {
          "content": {
            "description": "Full text of a lockfile, SBOM, or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, Gemfile.lock, packages.lock.json, CycloneDX (JSON), SPDX (JSON), package.json, requirements.txt, go.mod, Cargo.toml, .csproj, Directory.Packages.props, packages.config. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups. An SBOM covers several ecosystems in one document, but its licenses are read from the document rather than looked up, so they are only as current as the document.",
            "type": "string"
          },
          "distribution_model": {
            "description": "How the software incorporating this dependency reaches its users. This determines the answer: \"saas\" = users reach it over a network; \"distributed-binary\" = shipped as an app or binary; \"on-prem-delivery\" = installed in a customer environment; \"internal-only\" = never leaves your organization; \"library-published\" = released for others to depend on.",
            "enum": [
              "saas",
              "distributed-binary",
              "on-prem-delivery",
              "internal-only",
              "library-published"
            ],
            "type": "string"
          }
        },
        "required": [
          "content",
          "distribution_model"
        ],
        "type": "object"
      },
      "name": "check_manifest_licenses",
      "outputSchema": {
        "properties": {
          "distributionModel": {
            "type": "string"
          },
          "ecosystem": {
            "type": "string"
          },
          "findings": {
            "items": {
              "properties": {
                "ecosystem": {
                  "type": "string"
                },
                "name": {
                  "type": "string"
                },
                "obligations": {
                  "items": {
                    "type": "string"
                  },
                  "type": "array"
                },
                "rationale": {
                  "type": "string"
                },
                "resolvedFrom": {
                  "description": "Where the license came from. \"lockfile\" is exact; \"sbom\" means it was written in the SBOM you pasted rather than looked up, so it is only as current as that document; \"registry\" and \"deps-dev\" are the pinned version as published; \"registry-latest\" means the pinned version could not be read and the latest release was used instead; \"not-checked\" means the lookup budget ran out and this dependency was never resolved; \"not-published\" means it is a git dependency, a member of the scanned workspace, or from a private registry, so no public registry has license data for it — re-scanning will not resolve those.",
                  "type": "string"
                },
                "scope": {
                  "enum": [
                    "runtime",
                    "dev",
                    "build",
                    "test",
                    "optional"
                  ],
                  "type": "string"
                },
                "spdxExpression": {
                  "type": [
                    "string",
                    "null"
                  ]
                },
                "verdict": {
                  "enum": [
                    "allowed",
                    "review",
                    "blocked"
                  ],
                  "type": "string"
                },
                "version": {
                  "type": [
                    "string",
                    "null"
                  ]
                }
              },
              "required": [
                "ecosystem",
                "name",
                "scope",
                "verdict",
                "obligations",
                "rationale"
              ],
              "type": "object"
            },
            "type": "array"
          },
          "limitations": {
            "description": "What this scan could not establish. Never empty when anything was left unresolved. Read it before treating a result as clean.",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "summary": {
            "description": "Counts by verdict. total is every dependency found, not only the ones that were resolved.",
            "properties": {
              "allowed": {
                "type": "number"
              },
              "blocked": {
                "type": "number"
              },
              "review": {
                "type": "number"
              },
              "total": {
                "type": "number"
              }
            },
            "required": [
              "total",
              "allowed",
              "review",
              "blocked"
            ],
            "type": "object"
          }
        },
        "required": [
          "summary",
          "findings",
          "limitations"
        ],
        "type": "object"
      }
    },
    {
      "description": "Given an SPDX license identifier or expression, explain what it requires across every shipping model at once. Use when the question is about the license itself rather than a specific package — for example when comparing AGPL-3.0 against GPL-3.0 for a hosted service, or deciding what a project may safely depend on.",
      "inputSchema": {
        "properties": {
          "license": {
            "description": "SPDX identifier or expression, e.g. \"AGPL-3.0-only\", \"Apache-2.0\", or \"(MIT OR GPL-2.0-only)\".",
            "type": "string"
          },
          "linkage": {
            "description": "How the dependency is linked. Matters for LGPL-family licenses. Compiled languages such as Go and Rust normally link statically. Defaults to \"dynamic\".",
            "enum": [
              "dynamic",
              "static",
              "separate-process"
            ],
            "type": "string"
          }
        },
        "required": [
          "license"
        ],
        "type": "object"
      },
      "name": "explain_license",
      "outputSchema": {
        "properties": {
          "byDistributionModel": {
            "description": "One row per way of shipping. This is where the same license diverges.",
            "items": {
              "properties": {
                "model": {
                  "enum": [
                    "saas",
                    "distributed-binary",
                    "on-prem-delivery",
                    "internal-only",
                    "library-published"
                  ],
                  "type": "string"
                },
                "obligations": {
                  "items": {
                    "type": "string"
                  },
                  "type": "array"
                },
                "rationale": {
                  "type": "string"
                },
                "verdict": {
                  "enum": [
                    "allowed",
                    "review",
                    "blocked"
                  ],
                  "type": "string"
                }
              },
              "required": [
                "model",
                "verdict",
                "obligations",
                "rationale"
              ],
              "type": "object"
            },
            "type": "array"
          },
          "devScope": {
            "description": "The result when the dependency never reaches users (dev, build or test scope). Independent of the shipping model.",
            "properties": {
              "rationale": {
                "type": "string"
              },
              "verdict": {
                "enum": [
                  "allowed",
                  "review",
                  "blocked"
                ],
                "type": "string"
              }
            },
            "required": [
              "verdict",
              "rationale"
            ],
            "type": "object"
          },
          "license": {
            "type": "string"
          },
          "linkage": {
            "type": "string"
          }
        },
        "required": [
          "license",
          "byDistributionModel",
          "devScope"
        ],
        "type": "object"
      }
    }
  ]
}

Verify it yourself

curl -s https://api.teppi.xyz/v1/evidence/sha256:1869c862e0bb92326f1f27510b74024e5877abba3fe83c7d80ac9c34441c13ae | sha256sum