-
licenseNot graded
qualityB
maintenanceAudits npm dependencies for license compatibility, catching copyleft and source-available traps before shipping.
-
LicenseGuard
Server Details
Check if a dependency's license obligates you, based on how you ship. npm, PyPI, Go.
If you are the author of this connector, you can claim ownership with GitHub, an HTTP challenge, or a DNS record. Claimed connector authors can inspect health checks, view analytics, and manage their listing.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP
- URL
- Repository
- rccaoki-wq/license-guard
- GitHub Stars
- 1
- Server Listing
- LicenseGuard
Available Tools
3 toolscheck_dependency_licenseCheck one dependency for license obligationsARead-onlyIdempotentInspect
Determine whether adding or keeping a single open source dependency creates a legal obligation, given how this project ships. Call this BEFORE adding a new dependency to a project, and when auditing an existing one. A permissive result means no source-disclosure duty; a blocked result means the license obligates you and the dependency should be replaced or the shipping model reconsidered.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Package name as written in the manifest, e.g. "express", "requests", "github.com/gin-gonic/gin", or "serde". | |
| scope | No | Where the dependency sits. Use "dev", "build", or "test" for anything that does not end up in the shipped artifact — those carry no distribution obligation. Defaults to "runtime". | |
| version | No | Exact version if known. Omit to use the latest published version, which may differ from what is installed. | |
| ecosystem | Yes | Package registry the dependency comes from. | |
| distribution_model | Yes | How the software incorporating this dependency reaches its users. This determines the answer: "saas" = users reach it over a network; "distributed-binary" = shipped as an app or binary; "on-prem-delivery" = installed in a customer environment; "internal-only" = never leaves your organization; "library-published" = released for others to depend on. |
Output Schema
ParametersJSON Schema
| Name | Required | Description |
|---|---|---|
| license | Yes | |
| verdict | Yes | |
| rationale | Yes | |
| reference | No | |
| assumption | No | |
| obligations | Yes |
TDQS
A4.1/5.0
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already carry the safety profile (readOnlyHint=true, openWorldHint=true, idempotentHint=true, destructiveHint=false). The description adds value beyond those by explaining result semantics — 'A permissive result means no source-disclosure duty; a blocked result means the license obligates you and the dependency should be replaced or the shipping model reconsidered' — which tells the agent what the outcome signifies and how to act on it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: sentence one states purpose, sentence two gives usage timing, sentence three explains result interpretation. Purpose is front-loaded and there is no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Moderately complex tool (5 params, 3 enums) but it benefits from a rich output schema and full annotation coverage. The description covers the purpose, when to invoke it, and what the two outcome classes mean. Nothing an agent needs to decide whether to call it and act on the result is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all five parameters (including the three enums) are fully documented in the schema itself. The description references the shipping model in passing ('given how this project ships') but adds no parameter-level detail beyond what the schema already provides, so the baseline-3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb-resource pair ('Determine whether adding or keeping a single open source dependency creates a legal obligation') and the central contextual variable ('given how this project ships'). The word 'single' cleanly separates it from the sibling check_manifest_licenses (which covers a manifest of dependencies), so an agent can tell them apart from the description alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit timing guidance: 'Call this BEFORE adding a new dependency to a project, and when auditing an existing one.' This tells the agent when the tool is appropriate, but it does not explicitly name the sibling alternatives (check_manifest_licenses, explain_license) or state when those should be chosen instead, leaving some exclusion guidance to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_manifest_licensesCheck a whole manifestARead-onlyIdempotentInspect
Scan an entire dependency manifest and report every dependency whose license creates an obligation for this shipping model. Use when reviewing a project as a whole, preparing for due diligence, or after a large dependency change. Pass a package-lock.json when one exists: problematic licenses usually arrive as transitive dependencies rather than ones you added directly, and only a lockfile reveals those.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| content | Yes | Full text of a lockfile, SBOM, or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, Gemfile.lock, packages.lock.json, CycloneDX (JSON), SPDX (JSON), package.json, requirements.txt, go.mod, Cargo.toml, .csproj, Directory.Packages.props, packages.config. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups. An SBOM covers several ecosystems in one document, but its licenses are read from the document rather than looked up, so they are only as current as the document. | |
| distribution_model | Yes | How the software incorporating this dependency reaches its users. This determines the answer: "saas" = users reach it over a network; "distributed-binary" = shipped as an app or binary; "on-prem-delivery" = installed in a customer environment; "internal-only" = never leaves your organization; "library-published" = released for others to depend on. |
Output Schema
ParametersJSON Schema
| Name | Required | Description |
|---|---|---|
| summary | Yes | Counts by verdict. total is every dependency found, not only the ones that were resolved. |
| findings | Yes | |
| ecosystem | No | |
| limitations | Yes | What this scan could not establish. Never empty when anything was left unresolved. Read it before treating a result as clean. |
| distributionModel | No |
TDQS
A4.5/5.0
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and non-destructive behavior. The description adds useful behavioral context beyond that: it reports every problematic dependency, depends on the shipping model, and highlights that transitive dependencies are only visible via lockfiles.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: the first defines the action, the second gives usage scenarios, and the third adds a high-value parameter recommendation. The main action is front-loaded and no words are wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has a rich input schema, clear annotations, an output schema, and a description that covers purpose, usage timing, and parameter preferences. Nothing essential for an agent to select and invoke the tool correctly appears to be missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds practical guidance beyond the schema by recommending package-lock.json as the preferred content format and explaining why lockfiles are superior for exposing transitive dependencies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Scan an entire dependency manifest and report every dependency whose license creates an obligation for this shipping model.' It clearly differentiates from the likely single-dependency sibling check_dependency_license by emphasizing whole-manifest scope and 'every dependency.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit use contexts: 'reviewing a project as a whole, preparing for due diligence, or after a large dependency change.' It also advises passing a package-lock.json when available and explains why. However, it does not explicitly state when not to use it or name an alternative tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
explain_licenseExplain what a license requiresARead-onlyIdempotentInspect
Given an SPDX license identifier or expression, explain what it requires across every shipping model at once. Use when the question is about the license itself rather than a specific package — for example when comparing AGPL-3.0 against GPL-3.0 for a hosted service, or deciding what a project may safely depend on.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| license | Yes | SPDX identifier or expression, e.g. "AGPL-3.0-only", "Apache-2.0", or "(MIT OR GPL-2.0-only)". | |
| linkage | No | How the dependency is linked. Matters for LGPL-family licenses. Compiled languages such as Go and Rust normally link statically. Defaults to "dynamic". |
Output Schema
ParametersJSON Schema
| Name | Required | Description |
|---|---|---|
| license | Yes | |
| linkage | No | |
| devScope | Yes | The result when the dependency never reaches users (dev, build or test scope). Independent of the shipping model. |
| byDistributionModel | Yes | One row per way of shipping. This is where the same license diverges. |
TDQS
A4.7/5.0
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false, so the tool's safety profile is known. The description adds useful behavioral context: it covers all shipping models at once, implying a comprehensive output. The description does not contradict the annotations; it confirms a read-only, non-destructive operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core action and then giving usage examples. Every sentence adds value: the first defines the input and output scope, the second explains when to use it. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool is read-only, has a clear input schema with full coverage, and there is an output schema (mentioned in context), the description provides sufficient context for an agent to select and invoke it. The examples clarify complex license comparison scenarios. The description is complete for this complexity level.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides detailed descriptions for both parameters (license with examples, linkage with explanation of why it matters and default). The description also implies the use of SPDX identifiers and mentions the concept of shipping models, which adds contextual meaning beyond the schema. With 100% schema coverage, baseline is 3; the description adds a bit more context, so 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies the tool's function clearly: 'Given an SPDX license identifier or expression, explain what it requires across every shipping model at once.' It distinguishes from sibling tools by focusing on the license itself rather than a specific package, which aligns with the sibling names (check_dependency_license, check_manifest_licenses) that are package-specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines5/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells when to use this tool: 'Use when the question is about the license itself rather than a specific package'. It also gives concrete examples like comparing AGPL-3.0 vs GPL-3.0 for a hosted service or deciding safe dependencies. This effectively conveys the intended use case and distinguishes from alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
1 tool update
- Changed
check_manifest_licenses2 fields changed- changed
Input schema / properties / content / descriptionPrevious value: -"Full text of a lockfile or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, Gemfile.lock, packages.lock.json, package.json, requirements.txt, go.mod, Cargo.toml, .csproj, Directory.Packages.props, packages.config. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups."New value: +"Full text of a lockfile, SBOM, or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, Gemfile.lock, packages.lock.json, CycloneDX (JSON), SPDX (JSON), package.json, requirements.txt, go.mod, Cargo.toml, .csproj, Directory.Packages.props, packages.config. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups. An SBOM covers several ecosystems in one document, but its licenses are read from the document rather than looked up, so they are only as current as the document." - changed
Output schema / properties / findings / items / properties / resolvedFrom / descriptionPrevious value: -"Where the license came from. \"lockfile\" is exact; \"registry\" and \"deps-dev\" are the pinned version as published; \"registry-latest\" means the pinned version could not be read and the latest release was used instead; \"not-checked\" means the lookup budget ran out and this dependency was never resolved; \"not-published\" means it is a git dependency, a member of the scanned workspace, or from a private registry, so no public registry has license data for it — re-scanning will not resolve those."New value: +"Where the license came from. \"lockfile\" is exact; \"sbom\" means it was written in the SBOM you pasted rather than looked up, so it is only as current as that document; \"registry\" and \"deps-dev\" are the pinned version as published; \"registry-latest\" means the pinned version could not be read and the latest release was used instead; \"not-checked\" means the lookup budget ran out and this dependency was never resolved; \"not-published\" means it is a git dependency, a member of the scanned workspace, or from a private registry, so no public registry has license data for it — re-scanning will not resolve those."
2 tool updates
- Changed
check_dependency_license1 field changed- changed
Input schema / properties / ecosystem / enumPrevious value: -[ - "npm", - "pypi", - "go", - "cargo" -]New value: +[ + "npm", + "pypi", + "go", + "cargo", + "rubygems", + "nuget" +]
- Changed
check_manifest_licenses1 field changed- changed
Input schema / properties / content / descriptionPrevious value: -"Full text of a lockfile or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, Gemfile.lock, package.json, requirements.txt, go.mod, Cargo.toml. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups."New value: +"Full text of a lockfile or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, Gemfile.lock, packages.lock.json, package.json, requirements.txt, go.mod, Cargo.toml, .csproj, Directory.Packages.props, packages.config. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups."
1 tool update
- Changed
check_manifest_licenses1 field changed- changed
Input schema / properties / content / descriptionPrevious value: -"Full text of a lockfile or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, package.json, requirements.txt, go.mod, Cargo.toml. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups."New value: +"Full text of a lockfile or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, Gemfile.lock, package.json, requirements.txt, go.mod, Cargo.toml. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups."
1 tool update
- Changed
check_dependency_license1 field changed- added
Output schema / properties / assumptionAdded value: +{ + "properties": { + "assumed": { + "type": "string" + }, + "declared": { + "type": "string" + } + }, + "required": [ + "declared", + "assumed" + ], + "type": "object" +}
1 tool update
- Changed
check_manifest_licenses1 field changed- changed
Output schema / properties / findings / items / properties / resolvedFrom / descriptionPrevious value: -"Where the license came from. \"lockfile\" is exact; \"registry\" and \"deps-dev\" are the pinned version as published; \"registry-latest\" means the pinned version could not be read and the latest release was used instead; \"not-checked\" means the lookup budget ran out and this dependency was never resolved."New value: +"Where the license came from. \"lockfile\" is exact; \"registry\" and \"deps-dev\" are the pinned version as published; \"registry-latest\" means the pinned version could not be read and the latest release was used instead; \"not-checked\" means the lookup budget ran out and this dependency was never resolved; \"not-published\" means it is a git dependency, a member of the scanned workspace, or from a private registry, so no public registry has license data for it — re-scanning will not resolve those."
1 tool update
- Changed
check_manifest_licenses1 field changed- changed
Output schema / properties / findings / items / properties / resolvedFrom / descriptionPrevious value: -"Where the license came from. \"lockfile\" is exact; \"registry-latest\" means the pinned version could not be read and the latest release was used instead; \"not-checked\" means the lookup budget ran out and this dependency was never resolved."New value: +"Where the license came from. \"lockfile\" is exact; \"registry\" and \"deps-dev\" are the pinned version as published; \"registry-latest\" means the pinned version could not be read and the latest release was used instead; \"not-checked\" means the lookup budget ran out and this dependency was never resolved."
2 tool updates
- Changed
check_manifest_licenses1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "properties": { + "distributionModel": { + "type": "string" + }, + "ecosystem": { + "type": "string" + }, + "findings": { + "items": { + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + }, + "obligations": { + "items": { + "type": "string" + }, + "type": "array" + }, + "rationale": { + "type": "string" + }, + "resolvedFrom": { + "description": "Where the license came from. \"lockfile\" is exact; \"registry-latest\" means the pinned version could not be read and the latest release was used instead; \"not-checked\" means the lookup budget ran out and this dependency was never resolved.", + "type": "string" + }, + "scope": { + "enum": [ + "runtime", + "dev", + "build", + "test", + "optional" + ], + "type": "string" + }, + "spdxExpression": { + "type": [ + "string", + "null" + ] + }, + "verdict": { + "enum": [ + "allowed", + "review", + "blocked" + ], + "type": "string" + }, + "version": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "ecosystem", + "name", + "scope", + "verdict", + "obligations", + "rationale" + ], + "type": "object" + }, + "type": "array" + }, + "limitations": { + "description": "What this scan could not establish. Never empty when anything was left unresolved. Read it before treating a result as clean.", + "items": { + "type": "string" + }, + "type": "array" + }, + "summary": { + "description": "Counts by verdict. total is every dependency found, not only the ones that were resolved.", + "properties": { + "allowed": { + "type": "number" + }, + "blocked": { + "type": "number" + }, + "review": { + "type": "number" + }, + "total": { + "type": "number" + } + }, + "required": [ + "total", + "allowed", + "review", + "blocked" + ], + "type": "object" + } + }, + "required": [ + "summary", + "findings", + "limitations" + ], + "type": "object" +}
- Changed
explain_license1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "properties": { + "byDistributionModel": { + "description": "One row per way of shipping. This is where the same license diverges.", + "items": { + "properties": { + "model": { + "enum": [ + "saas", + "distributed-binary", + "on-prem-delivery", + "internal-only", + "library-published" + ], + "type": "string" + }, + "obligations": { + "items": { + "type": "string" + }, + "type": "array" + }, + "rationale": { + "type": "string" + }, + "verdict": { + "enum": [ + "allowed", + "review", + "blocked" + ], + "type": "string" + } + }, + "required": [ + "model", + "verdict", + "obligations", + "rationale" + ], + "type": "object" + }, + "type": "array" + }, + "devScope": { + "description": "The result when the dependency never reaches users (dev, build or test scope). Independent of the shipping model.", + "properties": { + "rationale": { + "type": "string" + }, + "verdict": { + "enum": [ + "allowed", + "review", + "blocked" + ], + "type": "string" + } + }, + "required": [ + "verdict", + "rationale" + ], + "type": "object" + }, + "license": { + "type": "string" + }, + "linkage": { + "type": "string" + } + }, + "required": [ + "license", + "byDistributionModel", + "devScope" + ], + "type": "object" +}
2 tool updates
- Changed
check_dependency_license2 fields changed- changed
Input schema / properties / ecosystem / enumPrevious value: -[ - "npm", - "pypi", - "go" -]New value: +[ + "npm", + "pypi", + "go", + "cargo" +] - changed
Input schema / properties / name / descriptionPrevious value: -"Package name as written in the manifest, e.g. \"express\", \"requests\", or \"github.com/gin-gonic/gin\"."New value: +"Package name as written in the manifest, e.g. \"express\", \"requests\", \"github.com/gin-gonic/gin\", or \"serde\"."
- Changed
check_manifest_licenses1 field changed- changed
Input schema / properties / content / descriptionPrevious value: -"Full text of a package-lock.json, package.json, requirements.txt, or go.mod. The format is detected automatically. Prefer package-lock.json: it covers transitive dependencies, carries exact versions, and needs no registry lookups."New value: +"Full text of a lockfile or manifest. Accepted: package-lock.json, pnpm-lock.yaml, yarn.lock, go.sum, Cargo.lock, poetry.lock, uv.lock, package.json, requirements.txt, go.mod, Cargo.toml. The format is detected automatically. Prefer a lockfile: it covers transitive dependencies and carries exact versions. package-lock.json is best of all, since it embeds licenses and needs no registry lookups."
3 tool updates
- First observed
check_dependency_license - First observed
check_manifest_licenses - First observed
explain_license
Frequently Asked Questions
Claiming proves that you control a remote MCP connector. It does not move, proxy, or interrupt the server.
Open the connector listing, choose Claim ownership, and sign in to Glama.
Complete one verification method:
GitHub identity — fastest for official registry listings. For a namespace such as
io.github.alice/server, link the matching GitHub user, then choose Claim with GitHub. An organization namespace such asio.github.acme/serveralso needs that organization to have installed the Glama AI GitHub App and approved its permissions, because GitHub discloses organization membership only to apps it has installed. Use HTTP or DNS when it has not.HTTP challenge — works when you can deploy a public file. Generate a token, publish the exact JSON Glama shows at
/.well-known/glama.jsonon the same origin as the connector, then choose Check HTTP challenge.DNS challenge — works when you control DNS but cannot change the server. Generate a token, create the exact TXT record Glama shows, wait for it to propagate, then choose Check DNS challenge.
After verification, Glama sends a confirmation email and gives you access to listing details, thumbnails, health checks, and analytics. Keep the HTTP file or DNS record in place: Glama periodically checks it and ownership remains verified while the token is discoverable.
The HTTP ownership file has this structure:
{
"$schema": "https://glama.ai/mcp/schemas/connector.json",
"claim": "glama_claim_..."
}Claim tokens are opaque, stable, and bound to the signed-in Glama account. They contain no email address or other personal information. If Glama can no longer discover a verified HTTP or DNS token, it starts a seven-day grace period before removing claim-based access. Restore the same token during that period to keep ownership verified. Never publish an email address, Glama session token, GitHub token, or connector credential as ownership proof.
If verification fails, confirm that you copied the current token exactly. The HTTP file must be public, return valid JSON with a successful HTTP response, and stay on the connector's origin. DNS changes may need more time to propagate. A claim cannot transfer to a different origin or hostname: if the connector target changes, Glama starts the grace period and the new target must be claimed separately after the previous claim is released.
For a connector linked to the official MCP Registry, registry updates continue to replace its name, description, and URL by default. After claiming, open Manage connector and enable Use Glama listing details as the source of truth if edits made on Glama should be preserved. Categories and thumbnails are always managed on Glama; registry linkage and technical connection settings continue to sync.
Control your server's listing on Glama, including description and metadata
Access analytics and receive server usage reports
Get monitoring and health status updates for your server
Feature your server to boost visibility and reach more users
To improve your MCP server's ranking:
Claim ownership of the server listing
Complete the server profile with an accurate description and thumbnail
Provide a test profile so Glama can connect to and evaluate the server
Keep tool definitions clear and complete to earn a high Tool Definition Quality Score (TDQS)
Route real usage through the Glama Gateway; more recorded successful server uses also improve the ranking
For users:
Full audit trail – every tool call is logged with inputs and outputs for compliance and debugging
Granular tool control – enable or disable individual tools per connector to limit what your AI agents can do
Centralized credential management – store and rotate API keys and OAuth tokens in one place
Change alerts – get notified when a connector changes its schema, adds or removes tools, or updates tool definitions, so nothing breaks silently
For server owners:
Proven adoption – public usage metrics on your listing show real-world traction and build trust with prospective users
Tool-level analytics – see which tools are being used most, helping you prioritize development and documentation
Direct user feedback – users can report issues and suggest improvements through the listing, giving you a channel you would not have otherwise
The connector status is unhealthy when Glama is unable to successfully connect to the server. This can happen for several reasons:
The server is experiencing an outage
The URL of the server is wrong
Credentials required to access the server are missing or invalid
If you are the owner of this MCP connector and would like to make modifications to the listing, including providing test credentials for accessing the server, please contact support@glama.ai.
Discussions
No comments yet. Be the first to start the discussion!
Related MCP Connectors
Open-source licence risk checks for AI coding agents and dependency trees.
- mcpOAuthco.policyforge
Generate, audit, and maintain legal policies that match what your code actually does.
Is this dependency current, licensed, deprecated, or already carrying a CVE?
Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems.
Related MCP Servers
gridwork-licenseofficial
AlicenseAqualityDmaintenanceScans project dependencies for license compliance, classifying 60+ licenses and detecting conflicts and copyleft risks.4561MIT- AlicenseAqualityDmaintenanceAudits project dependency licenses for compatibility issues, flags GPL/AGPL conflicts, and generates compliance reports.146MIT
- AlicenseAqualityFmaintenanceScans npm project dependencies for license compliance issues, detecting GPL contamination and generating detailed reports.259MIT
Try in Browser
Glama MCP Gateway
Add one secure layer between your agents and this server.
TDQS
A4.5/5.0
Disambiguation5/5
The three tools have completely distinct purposes: one checks a single dependency, another scans a manifest, and the third explains licenses generally. No overlap or ambiguity exists.
Naming Consistency5/5
All tool names follow a consistent verb_noun pattern: check_dependency_license, check_manifest_licenses, explain_license. The convention is uniform and predictable.
Tool Count5/5
Three tools is ideal for a focused license-checking server. Each tool covers a distinct use case without redundancy or unnecessary surface area.
Completeness5/5
The set covers the full workflow: individual dependency checks, full manifest scans, and general license explanation. There are no obvious gaps for the server's stated purpose.