Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-semclone scan the ./project directory for open source licenses and vulnerabilities"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP (Model Context Protocol) server that provides LLMs with comprehensive OSS compliance and vulnerability analysis capabilities through the SEMCL.ONE toolchain.
mcp-semclone integrates the complete SEMCL.ONE toolchain to provide LLMs with powerful software composition analysis capabilities:
License Detection & Compliance: Scan codebases for licenses and validate against policies
Binary Analysis: Analyze compiled binaries (APK, EXE, DLL, SO, JAR) for OSS components and licenses
Vulnerability Assessment: Query multiple vulnerability databases for security issues
Package Discovery: Identify packages from source code and generate PURLs
SBOM Generation: Create Software Bill of Materials in CycloneDX format
Policy Validation: Check license compatibility and organizational compliance
Related MCP server: Security-Use MCP Server
Analysis & Scanning:
scan_directory - Comprehensive directory scanning for packages, licenses, and vulnerabilities
scan_binary - Analyze compiled binaries (APK, EXE, DLL, SO, JAR) for OSS components
check_package - Check specific packages for licenses and vulnerabilities
download_and_scan_package - Download package source from registries and perform deep license/copyright scanning
Legal Notices & Documentation:
generate_legal_notices - Generate legal notices by scanning source code directly (fast, recommended)
generate_legal_notices_from_purls - Generate legal notices from PURL list (downloads from registries)
generate_sbom - Generate Software Bill of Materials in CycloneDX format
License & Policy Validation:
validate_policy - Validate licenses against organizational policies
validate_license_list - Quick license safety validation for distribution types
get_license_obligations - Get detailed compliance requirements for licenses
check_license_compatibility - Check if two licenses can be mixed
get_license_details - Get comprehensive license information including full text
analyze_commercial_risk - Assess commercial distribution risks
Complete Workflows:
run_compliance_check - Universal one-shot compliance workflow for any project type
license_database - Access license compatibility information
policy_templates - Get pre-configured policy templates
compliance_check - Guided workflow for license compliance checking
vulnerability_assessment - Guided workflow for security assessment
pip install mcp-semcloneThis automatically installs all required SEMCL.ONE tools:
purl2notices - Comprehensive package detection and license extraction
osslili - License detection from archives (used by check_package)
binarysniffer - Binary analysis for OSS components
ospac - Policy validation engine
vulnq - Vulnerability database queries
upmex - Package metadata extraction (used by check_package)
pipx installs the package in an isolated environment while making the CLI tools globally available. This is ideal for avoiding dependency conflicts with other Python packages on your system.
# Install pipx if you don't have it
pip install pipx
pipx ensurepath
# Install mcp-semclone
pipx install mcp-semclone
# IMPORTANT: Inject all SEMCL.ONE tool dependencies into the same isolated environment
# This ensures all tools are available both as libraries and CLI commands
# Required by some agents that need direct CLI tool access
# Use --include-apps to make CLI commands globally available
pipx inject mcp-semclone purl2notices purl2src osslili binarysniffer ospac vulnq upmex --include-appsBenefits of pipx:
✅ Isolated environment prevents dependency conflicts
✅ All tools globally accessible in PATH
✅ Easy to update: pipx upgrade mcp-semclone
✅ Clean uninstall: pipx uninstall mcp-semclone
For detailed setup instructions including:
IDE-specific configurations (Cursor, Cline, Kiro, VS Code, JetBrains)
Auto-approve settings
pip vs pipx configurations
Configuration templates
Troubleshooting
See the IDE Integration Guide
Optional environment variables for enhanced functionality:
# API Keys (optional, for higher rate limits)
export GITHUB_TOKEN="your_github_token"
export NVD_API_KEY="your_nvd_api_key"
# Tool paths (optional, only if tools are not in PATH)
# Tools are auto-detected by default using shutil.which()
export PURL2NOTICES_PATH="/custom/path/to/purl2notices"
export OSSLILI_PATH="/custom/path/to/osslili"
export BINARYSNIFFER_PATH="/custom/path/to/binarysniffer"
export VULNQ_PATH="/custom/path/to/vulnq"
export OSPAC_PATH="/custom/path/to/ospac"
export UPMEX_PATH="/custom/path/to/upmex"Note: Tools are automatically detected in your PATH. Environment variables are only needed for custom installation locations.
Once configured, you can ask your LLM:
"Scan /path/to/project for license compliance issues"
"Analyze this Android APK file for OSS components and licenses"
"Check if this project has any critical vulnerabilities"
"Generate an SBOM for my project"
"What licenses are in this compiled binary?"
"Validate these licenses against our commercial distribution policy"
"Find all GPL-licensed dependencies in this codebase"
Scan the project to identify all packages and licenses
Load or create a policy defining allowed/denied licenses
Validate licenses against the policy
Generate compliance report with violations and recommendations
Discover packages in the codebase
Query vulnerability databases for each package
Prioritize by severity (CRITICAL > HIGH > MEDIUM > LOW)
Identify available fixes and upgrade paths
Generate security report with remediation steps
Scan project structure to identify components
Extract metadata for each component
Detect licenses and copyright information
Format as SBOM (CycloneDX 1.4 JSON)
Validate completeness of the SBOM
See examples/basic_usage.py for simple examples of calling MCP tools directly.
A complete autonomous agent example demonstrating OSS compliance analysis using local LLM (Ollama) with MCP integration.
Location: examples/strands-agent-ollama/
Features:
Autonomous decision-making (plan → execute → interpret → report)
Local LLM inference via Ollama (llama3, gemma3, deepseek-r1)
Interactive and batch analysis modes
Custom policy enforcement
Complete privacy (no external API calls)
Quick Start:
cd examples/strands-agent-ollama
./quickstart.sh
python agent.py interactiveDocumentation:
README.md - Complete usage guide
TUNING.md - Optimization guide
OVERVIEW.md - Architecture reference
Use Cases:
Mobile app compliance (APK/IPA analysis)
Embedded/IoT firmware scanning
CI/CD integration
Interactive compliance queries
See the example directory for full details.
We welcome contributions! Please see CONTRIBUTING.md for details.
mcp-semclone is released under the Apache License 2.0. See LICENSE for details.
Issues: GitHub Issues
Discussions: GitHub Discussions
Security: Report vulnerabilities to security@semcl.one
Part of the SEMCL.ONE Software Composition Analysis toolchain
Analyze commercial licensing risk for a project.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| include_data_files | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must fully convey behavioral traits. It only says 'Analyze', implying a read-only operation, but does not state safety info, required permissions, or side effects. This is insufficient for a tool performing analysis.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence, but it fails to include essential details (parameters, usage context). It is short but under-informative, so it earns a middle score for efficiency at the cost of completeness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema (not shown), the overall description is minimal. Given 13 sibling tools and 2 parameters, the description lacks details on scope, prerequisites, and specific use cases, making it incomplete for safe tool selection.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description adds no information about parameters 'path' or 'include_data_files'. The agent cannot determine what values are valid or how parameters affect behavior.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Analyze commercial licensing risk for a project.' clearly states a verb and resource, but it is generic and does not differentiate from sibling tools like 'check_license_compatibility' or 'run_compliance_check'. The term 'commercial risk' is specific, but the description lacks scope or uniqueness.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. There is no mention of prerequisites, exclusions, or contrast with siblings like 'scan_directory' or 'validate_license_list'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Check if two licenses are compatible for use together.
This tool answers: "Can I combine code under these two licenses?"
Args: license1: First SPDX license ID (e.g., "MIT") license2: Second SPDX license ID (e.g., "GPL-3.0") context: Usage context (general, static_linking, dynamic_linking)
Returns: Compatibility assessment including: - compatible: True/False indicating if licenses can be combined - reason: Explanation of why they are/aren't compatible - restrictions: Any special conditions or restrictions - recommendations: Suggested actions if incompatible
Example: Checking MIT vs GPL-3.0 returns: - compatible: False - reason: GPL-3.0 is strongly copyleft and requires derivative works to be GPL-3.0 - recommendations: Use dynamic linking, keep code separate, or relicense
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | general | |
| license1 | Yes | ||
| license2 | Yes |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It thoroughly explains the return structure: compatible, reason, restrictions, recommendations. It also documents the context parameter options. There is no mention of destructive actions or auth requirements, but the tool appears read-only and safe.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured: a one-line summary, a clarifying question, then clear sections for Args, Returns, and Example. Every sentence adds value. The example at the end concretely illustrates the tool's output, enhancing clarity without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (3 parameters, output schema exists), the description is complete. It covers purpose, parameters with examples, return structure, and a concrete usage example. There is no need for additional context like rate limits or authorization for this type of tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, meaning the schema provides no descriptions. The description compensates fully by explaining each parameter: license1/2 are SPDX IDs with examples, and context lists its possible values (general, static_linking, dynamic_linking). This adds significant meaning beyond the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool's purpose: 'Check if two licenses are compatible for use together.' It includes a clarifying question 'Can I combine code under these two licenses?' and distinguishes from sibling tools like get_license_details or get_license_obligations by focusing specifically on compatibility.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies usage context: when combining code under two licenses. It provides a direct question the tool answers, but does not explicitly state when not to use it or mention alternative tools. The context parameter hints at different use cases (static vs dynamic linking), adding nuance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Check a specific package using intelligent tool selection.
This tool intelligently analyzes package files by:
For archives (.jar, .whl, .rpm, .gem, etc.): Use upmex for metadata extraction
If upmex fails or for non-archives: Fall back to osslili for license detection
For PURLs: Use package registry APIs when available
Args: identifier: Package identifier (PURL like pkg:maven/com.google.gson/gson@2.10.1, file path to archive, or package file) check_vulnerabilities: Whether to check for vulnerabilities (default: False for speed) check_licenses: Whether to extract license information (default: True)
Returns: Dictionary containing package metadata, licenses, and optionally vulnerabilities
| Name | Required | Description | Default |
|---|---|---|---|
| identifier | Yes | ||
| check_licenses | No | ||
| check_vulnerabilities | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description explains the fallback logic and tool selection process, which adds transparency. However, there is a contradiction: description states check_vulnerabilities defaults to False, but the input schema shows default true. This inconsistency harms reliability.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with numbered steps, clear argument descriptions, and a return statement. It is concise yet informative, with no unnecessary repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the core logic and input, and an output schema exists. However, it lacks mention of whether the tool is read-only, and the default inconsistency reduces completeness. Overall adequate for a tool with output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description fully explains each parameter: identifier format (PURL, file path), and the purpose and defaults of the two boolean parameters. This adds significant meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool checks a package using intelligent selection, and lists specific actions (archive extraction, license detection, PURL registry APIs). This distinguishes it from general scanning tools, but does not explicitly differentiate from all siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for package files or PURLs, but does not explicitly state when to use this tool over alternatives like scan_binary or check_license_compatibility. No when-not-to-use guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Download package source from registry and perform comprehensive analysis.
⚠️ IMPORTANT: This tool CAN and WILL download source code from package registries!
Workflow (tries methods in order until sufficient data is collected):
Primary: Use purl2notices to download and analyze (fastest, most comprehensive)
Deep scan: If incomplete, use purl2src to get download URL → download artifact → run osslili for deep license scanning + upmex for metadata
Maven-specific: If license still missing for Maven packages, uses upmex with --registry --api clearlydefined to resolve parent POM licenses
Online fallback: If still incomplete, use upmex --api clearlydefined/purldb for online metadata
What this tool does:
Downloads the actual package source code from npm/PyPI/Maven/etc registries
Performs comprehensive license and copyright analysis
Extracts package metadata (name, version, homepage, description)
Scans ALL source files for embedded licenses (not just package.json/setup.py/pom.xml)
Returns copyright statements found in actual source code
Maven packages: Automatically resolves parent POM licenses when not declared in package POM
When to use this tool:
Package metadata is incomplete or missing (e.g., "UNKNOWN" license in PyPI)
Need to verify what's ACTUALLY in the package files (not just metadata)
Want to analyze source code directly (not just manifests)
Security auditing - see actual package contents before approval
License compliance - find licenses embedded in source files
Need to extract copyright statements from source code
Real-world example: User asks: "Can you check if duckdb@0.2.3 has license info in the source code?"
PyPI metadata shows "UNKNOWN" license
This tool downloads the actual .whl/.tar.gz from PyPI
Scans ALL files in the package for license information
Finds licenses embedded in source code that aren't in metadata
Returns: {"method_used": "purl2notices", "declared_license": "UNKNOWN", "detected_licenses": ["CC0-1.0"], ...}
Performance:
Primary (purl2notices): 5-15 seconds (fastest)
Deep scan (download + osslili + upmex): 10-30 seconds
Online fallback (upmex --api): 2-5 seconds (but less complete)
Security note:
Downloads are verified against package checksums when available
Files are scanned but NOT executed
Temporary files are cleaned up unless keep_download=True
Args: purl: Package URL (e.g., "pkg:pypi/duckdb@0.2.3", "pkg:npm/express@4.21.2") keep_download: If True, keeps downloaded files for manual inspection (default: False)
Returns: Dictionary containing: - purl: The package URL analyzed - method_used: Which method succeeded ("purl2notices", "deep_scan", "online_fallback") - download_path: Where package was downloaded (if keep_download=True) - metadata: Package metadata (name, version, homepage, etc.) - declared_license: License from package metadata - detected_licenses: List of licenses found by scanning source files - copyright_statements: Copyright statements extracted from source - files_scanned: Number of files analyzed - scan_summary: Summary of what was found
Examples: # Check if package has license info in source code download_and_scan_package(purl="pkg:pypi/duckdb@0.2.3")
# Download and keep files for manual inspection
result = download_and_scan_package(
purl="pkg:npm/suspicious-package@1.0.0",
keep_download=True
)
print(f"Inspect files at: {result['download_path']}")
| Name | Required | Description | Default |
|---|---|---|---|
| purl | Yes | ||
| keep_download | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It is highly transparent: details the workflow (three methods in order), performance expectations, security notes (verified downloads, no execution, cleanup), and explicitly warns that it WILL download source code. This exceeds typical behavior disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is lengthy but well-organized with headers, bullet points, and sections. Each part adds value, and the structure aids readability. Could be slightly more concise, but the information density is justified given the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (multi-step workflow, 2 parameters, detailed outputs), the description is complete. It covers all relevant aspects: workflow, use cases, examples, performance, security, and return values. Even with an output schema (context indicates it exists), the description enriches understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate fully. It explains 'purl' with examples and format, and 'keep_download' with its effect and default. Also details the return structure, adding significant meaning beyond the input schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Download package source from registry and perform comprehensive analysis.' It distinguishes itself from siblings like 'check_package' (which likely checks metadata) and 'scan_directory' (which scans local files) by emphasizing downloading and analyzing actual source files from registries.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit 'When to use this tool' section with bullet points and a real-world example. While it doesn't list alternative tools explicitly, the context makes it clear when this tool is appropriate versus others that might check metadata or scan local directories.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
PRIMARY TOOL: Generate legal notices by scanning source code directly (DEFAULT - FAST).
This is the RECOMMENDED tool for creating legal compliance documentation. Scans your project's source code directly to detect ALL packages (including transitive dependencies) and generates comprehensive attribution notices.
⚠️ THIS IS THE DEFAULT TOOL - Use this for most cases!
Scans source code directly (node_modules/, site-packages/, vendor/)
Detects ALL packages automatically (transitive dependencies included)
10x faster than downloading from registries
No need to extract PURLs manually
WHEN TO USE THIS TOOL:
You have source code locally with dependencies installed
npm project with node_modules/ directory
Python project with site-packages/ or virtualenv
Any project with locally installed dependencies
WHEN NOT TO USE:
Dependencies not installed locally → Use generate_legal_notices_from_purls instead
You already have a PURL list → Use generate_legal_notices_from_purls instead
PURPOSE: Creates production-ready legal compliance documentation including:
Complete copyright holder attributions (auto-extracted)
Full license texts from SPDX
Formatted for NOTICE file inclusion
Ready for app store submission
Professional legal documentation
WHEN TO USE (MOST COMMON SCENARIOS):
Creating NOTICE files for distribution (PRIMARY USE CASE)
Generating legal compliance documentation for any product
After scanning packages and need complete attribution
Preparing legal docs for app store submissions (iOS/Android)
Need copyright holder information (automatically extracted)
Anytime you need production-ready legal documentation
WHEN NOT TO USE:
Understanding individual license obligations → use get_license_obligations
Just checking license compatibility → use check_license_compatibility
Quick validation only → use validate_license_list
Want one-shot complete workflow → use run_compliance_check
DON'T have PURLs yet → use scan_directory FIRST to get them
WORKFLOW POSITION: Typically used AFTER scan_directory/check_package and validation (validate_license_list), as the FINAL step to generate legal documentation.
COMMON WORKFLOWS:
Mobile App Compliance (MOST COMMON): scan_directory(check_vulnerabilities=True, identify_packages=True) → validate_license_list(distribution="mobile") → generate_legal_notices(purls=[...], output_file="NOTICE.txt") [PRIMARY] → generate_sbom(path=".")
After Package Analysis: check_package(identifier="pkg:npm/express@4.0.0") → validate_policy(licenses=[...]) → generate_legal_notices(purls=[...])
Batch Compliance: scan_directory(path=".", identify_packages=True) → (parallel) generate_sbom + generate_legal_notices
BACKEND: Uses purl2notices in scan mode to read source code directly. Automatically extracts copyright holders, fetches license texts from SPDX, and formats complete attribution.
Args: path: Path to source directory to scan (project root with dependencies installed) output_format: Output format - "text" (default), "html", "markdown" output_file: Optional path to save the output file include_license_text: If True, include full license texts (default: True)
Returns: Dictionary containing: - notices: The generated legal notices text - packages_processed: Number/description of packages processed - packages_failed: Number of packages that failed processing - output_file: Path to saved file (if output_file was specified) - format: The output format used - mode: "scan_directory" (indicates source code scanning was used)
Examples: # Generate text NOTICE file for npm project generate_legal_notices( path="/path/to/npm-project", output_file="NOTICE.txt" )
# Generate HTML notices for Python project
generate_legal_notices(
path="/path/to/python-project",
output_format="html",
output_file="NOTICE.html"
)
# Quick scan without saving to file
result = generate_legal_notices(path=".")
print(result["notices"])
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| output_file | No | ||
| output_format | No | text | |
| include_license_text | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Although no annotations are provided, the description thoroughly explains the tool's behavior: it scans source directories, detects all packages including transitive dependencies, extracts copyright holders, fetches license texts from SPDX, and generates formatted output. It also describes the backend (purl2notices in scan mode) and the mode field in the return value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is overly verbose and repetitive, with 'WHEN TO USE' and 'WHEN NOT TO USE' sections appearing multiple times. While well-structured overall, it contains redundant information and could be shortened without losing clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (4 parameters, many siblings) and lack of annotations, the description covers all necessary aspects: purpose, usage guidelines, parameter explanations, return value structure, and examples. The output schema is present and referenced in the Returns section.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, but the description provides detailed explanations of all four parameters (path, output_format, output_file, include_license_text) with defaults and examples. This adds significant meaning beyond the schema's basic types and required field.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool generates legal notices by scanning source code, specifying it as the primary and default tool. It distinguishes itself from siblings like generate_legal_notices_from_purls by emphasizing direct source code scanning for speed and automatic detection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when-to-use and when-not-to-use sections, including specific alternative tools for different scenarios. It also includes workflow positions and common workflows, giving clear context for selecting this tool over others.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ALTERNATIVE TOOL: Generate legal notices from PURL list (downloads from registries - SLOWER).
Use this tool ONLY when:
Dependencies are NOT installed locally (no node_modules/, site-packages/)
You already have a list of PURLs from another source
You're working with a PURL list, not source code
⚠️ PERFORMANCE WARNING: This downloads packages from registries (slow)
Downloads each package from npm/PyPI/etc (1-2 seconds per package)
For 49 packages: ~60-120 seconds
Use generate_legal_notices(path=...) instead if you have source code
⚠️ CRITICAL: DO NOT manually extract PURLs from package.json or requirements.txt!
WRONG: Reading package.json, extracting "http-server@14.1.1" → 1 PURL
RIGHT: Use scan_directory() to get ALL transitive dependencies → 49 PURLs
Example: npm project with 1 dependency = ~50 packages in node_modules (all needed!)
WHEN TO USE THIS TOOL:
Source code not available locally
Working with a pre-existing PURL list
Dependencies not installed (no node_modules/ or site-packages/)
WHEN NOT TO USE (use generate_legal_notices instead):
You have source code with dependencies installed locally
npm project with node_modules/ → Use generate_legal_notices(path=...)
Python project with virtualenv → Use generate_legal_notices(path=...)
Args: purls: List of Package URLs (e.g., ["pkg:npm/express@4.0.0", "pkg:pypi/django@4.2.0"]) output_format: Output format - "text" (default), "html", "markdown" output_file: Optional path to save the output file include_license_text: If True, include full license texts (default: True)
Returns: Dictionary containing: - notices: The generated legal notices text - packages_processed: Number of packages successfully processed - packages_failed: Number of packages that failed processing - output_file: Path to saved file (if output_file was specified) - format: The output format used - mode: "download_purls" (indicates registry downloads were used)
Examples: # Generate notices from PURL list (after scan_directory) scan_result = scan_directory("/path/to/project") purls = [pkg["purl"] for pkg in scan_result["packages"]] generate_legal_notices_from_purls( purls=purls, output_file="NOTICE.txt" )
# Generate HTML notices from specific PURLs
generate_legal_notices_from_purls(
purls=["pkg:npm/express@4.21.2", "pkg:npm/body-parser@1.20.3"],
output_format="html",
output_file="NOTICE.html"
)
| Name | Required | Description | Default |
|---|---|---|---|
| purls | Yes | ||
| output_file | No | ||
| output_format | No | text | |
| include_license_text | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description fully discloses behavioral traits: performance warning (slow downloads), the fact that it downloads packages from registries, and the output mode in the return dictionary. It also cautions against incorrect usage, ensuring the agent understands the tool's cost and correct workflow.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is lengthy but well-organized into sections (performance warning, critical note, when to use/not use, args, returns, examples). Every sentence serves a purpose, but the level of detail could be trimmed slightly without losing clarity. The structure aids readability and prioritizes critical information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (4 parameters, output schema, sibling alternative), the description is thorough. It covers parameter semantics, return values, performance characteristics, pitfalls, and example workflows. The output schema is provided, so return value explanation is sufficient. There are no gaps in context for effective tool invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides basic parameter types and defaults (e.g., output_format defaulting to 'text', include_license_text defaulting to true). The description adds semantic value by explaining the 'purls' parameter as a list of Package URLs, describing the purpose of each parameter, and providing concrete examples. However, the schema already conveys some information, so the description's additional value is moderate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool generates legal notices from a PURL list and distinguishes itself from the sibling tool 'generate_legal_notices' by specifying when each should be used. It provides a specific verb ('generate legal notices') and resource ('PURL list'), making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when-to-use (dependencies not installed, have PURL list) and when-not-to-use (source code available, use generate_legal_notices) guidance. It also includes a critical warning against manual PURL extraction and illustrates proper usage with scan_directory examples.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Generate a Software Bill of Materials (SBOM) in CycloneDX format using purl2notices.
This tool creates comprehensive SBOMs in CycloneDX 1.4 JSON format for software inventory, vulnerability tracking, and compliance documentation.
SBOM includes: name, version, PURL, licenses, homepage (external references). Data is sourced from purl2notices scan mode which provides accurate package metadata.
Use this tool when:
You need to generate an SBOM for a project or package list
Creating inventory documentation for compliance
After analyzing packages and need structured output
Preparing documentation for security audits
Required by procurement or regulatory requirements
Input modes:
Provide purls (list of Package URLs) for packages you've already identified
Provide path to scan a directory and generate SBOM from discovered packages
At least one of purls or path must be provided
Args: purls: Optional list of Package URLs (PURLs) to include in SBOM path: Optional directory path to scan for packages output_file: Optional path to save the SBOM file (CycloneDX JSON format) include_licenses: If True, include license information (default: True)
Returns: Dictionary containing: - sbom: The generated SBOM structure (CycloneDX 1.4 JSON) - packages_count: Number of packages included - output_file: Path to saved file (if output_file was specified)
Examples: # Generate SBOM from PURLs (after batch analysis) generate_sbom( purls=["pkg:npm/express@4.0.0", "pkg:pypi/django@4.2.0"], output_file="/tmp/sbom.json" )
# Generate SBOM by scanning directory
generate_sbom(path="/path/to/project")
# After batch scan workflow
scan_result = check_package("package.jar")
generate_sbom(purls=[scan_result["purl"]], include_licenses=True)
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | ||
| purls | No | ||
| output_file | No | ||
| include_licenses | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Describes data sources (purl2notices scan mode), output format, and included fields. Discloses that at least one of purls or path is required. However, does not discuss potential side effects like overwriting an existing output file or behavior when both purls and path are provided.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with sections and examples, but somewhat verbose with repetition (e.g., CycloneDX mentioned multiple times). Could be tightened without losing clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the existence of an output schema (not shown), the description need not detail return values, yet it still provides a structured dictionary summary. Covers input modes, optional parameters, and examples, making it fully adequate for agent selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema coverage, the description provides detailed parameter explanations in the 'Args' section and examples. Each parameter's purpose, type, and default are clearly explained, adding significant meaning beyond the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it generates an SBOM in CycloneDX format. It distinguishes from sibling tools (e.g., scan_directory, check_package) which focus on scanning or checking packages, not generating structured SBOM output.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Includes a 'Use this tool when:' section listing specific scenarios like compliance documentation and security audits. Lacks explicit exclusions or comparisons to alternative tools, but the scenarios are clear and relevant.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get comprehensive details about a specific license.
This tool provides complete license information including the full license text for generating NOTICE files and understanding license requirements.
Args: license_id: SPDX license ID (e.g., "Apache-2.0", "MIT", "GPL-3.0") include_full_text: Include full license text (can be long, ~5-20KB)
Returns: License information including: - name: Full license name - type: License category (permissive, copyleft_weak, copyleft_strong, etc.) - properties: Characteristics (OSI approved, FSF free, etc.) - permissions: What you CAN do (commercial use, modify, distribute, etc.) - requirements: What you MUST do (include license, preserve copyright, etc.) - limitations: What is NOT provided (liability, warranty, etc.) - obligations: Specific compliance requirements - full_text: Complete license text (if include_full_text=True, fetched from SPDX API)
Example: For Apache-2.0, returns complete license data including: - Full license text for NOTICE files - Patent grant information - Attribution requirements
| Name | Required | Description | Default |
|---|---|---|---|
| license_id | Yes | ||
| include_full_text | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description covers key behavior: it retrieves data from an external API (SPDX), warns about large text size (~5-20KB), and indicates optional full-text inclusion. It doesn't mention auth or rate limits, but the disclosure is strong.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with sections for Args, Returns, and Example, using clear language. Every sentence adds value without redundancy, and the size is appropriate for the tool's detail level.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema, the description provides rich context about return fields and usage. It covers all necessary aspects for an agent to use this tool correctly, especially given the sibling tools focusing on analysis rather than raw data.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description provides complete parameter details: license_id with examples (Apache-2.0, MIT, GPL-3.0) and include_full_text with size warning and default. It also exhaustively lists return fields, adding substantial value beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it gets comprehensive details about a specific license, including full license text. It distinguishes from sibling tools like check_license_compatibility or get_license_obligations by focusing on raw data retrieval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description specifies it's for generating NOTICE files and understanding license requirements, providing clear usage context. It lacks explicit when-not-to-use or alternatives, but the purpose is well-defined.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get detailed obligations for specified licenses.
This tool answers the critical question: "What must I do to comply with these licenses?"
Args: licenses: List of SPDX license IDs (e.g., ["MIT", "Apache-2.0", "GPL-3.0"]) output_format: Output format (json, text, checklist, markdown)
Returns: Comprehensive obligations including: - Required actions (attribution, notices, disclosure, etc.) - Permissions (commercial use, modification, distribution, etc.) - Limitations (liability, warranty, trademark use, etc.) - Conditions (source disclosure, license preservation, state changes, etc.) - Key requirements for compliance
Example: For MIT license, returns obligations like: - Include original license text in distributions - Preserve copyright notices - No trademark rights granted
| Name | Required | Description | Default |
|---|---|---|---|
| licenses | Yes | ||
| output_format | No | json |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries full burden. It clearly describes return categories (obligations, permissions, etc.) implying read-only behavior, but does not explicitly state no side effects or required permissions. Adequate but not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with separate sections for purpose, args, returns, and example. Slightly wordy with bullets, but every sentence adds value. Front-loaded with purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's scope (getting license obligations), the description is complete: covers input parameters, return categories with examples, and fits within the sibling context. No missing elements apparent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description fully compensates by explaining each parameter: licenses as list of SPDX IDs with example, and output_format with possible values (json, text, checklist, markdown). Adds significant meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states verb 'Get' and resource 'obligations for specified licenses', with a specific question 'What must I do to comply?'. Differentiates from sibling tools like get_license_details by focusing on compliance obligations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
While the description implicitly guides by stating the critical question it answers, it lacks explicit when-to-use guidance or mention of alternatives. No exclusions or comparisons with sibling tools are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
UNIVERSAL COMPLIANCE WORKFLOW: One-shot compliance check for ANY project type.
This is a convenience tool that runs the complete standard compliance workflow:
Scan for licenses and packages (scan_directory)
Generate legal notices with purl2notices (generate_legal_notices)
Validate against policy using ospac (validate_policy or default policy)
Generate SBOM for documentation (generate_sbom)
Check for vulnerabilities (if enabled)
Return comprehensive summary with APPROVE/REJECT decision
This tool works for ANY distribution type (mobile, desktop, embedded, SaaS, etc.) - no specialized tools needed. Distribution type is used for policy validation context.
WHEN TO USE:
You want a complete compliance assessment in one call
Starting a new project compliance review
Need approve/reject decision with full documentation
Don't want to orchestrate multiple tool calls manually
Want standardized compliance workflow
WHEN NOT TO USE:
You need fine-grained control over each step → call individual tools
You only need specific information → use targeted tools (scan_directory, etc.)
You want to customize the workflow → use individual tools in your preferred sequence
WORKFLOW EXECUTED:
scan_directory(path, identify_packages=True, check_licenses=True)
generate_legal_notices(purls, output_file=NOTICE.txt)
validate_policy(licenses, policy_file or default_policy)
generate_sbom(purls, output_file=sbom.json)
check vulnerabilities (if check_vulnerabilities=True)
Aggregate results → FINAL DECISION: approved/rejected + risk level
Args: path: Directory or project to analyze distribution_type: Optional - mobile, desktop, saas, embedded, etc. (for policy context) policy_file: Optional - Path to custom ospac policy. Uses default if not specified. check_vulnerabilities: Check for security vulnerabilities (default: True) output_dir: Optional - Directory to save outputs (NOTICE.txt, sbom.json). Uses path if not specified.
Returns: Dictionary containing: - decision: "APPROVED" or "REJECTED" - risk_level: "LOW", "MEDIUM", or "HIGH" - summary: Human-readable summary of findings - licenses: List of detected licenses - packages: List of identified packages (PURLs) - vulnerabilities: List of vulnerabilities (if checked) - policy_violations: List of policy violations (if any) - artifacts_created: List of files generated (NOTICE.txt, sbom.json) - recommendations: Actionable next steps
Example: # Complete compliance check with default settings result = run_compliance_check("/path/to/project")
# Mobile app compliance with custom policy
result = run_compliance_check(
path="/path/to/mobile/app",
distribution_type="mobile",
policy_file="/policies/mobile_policy.json"
)
# Check decision
if result["decision"] == "APPROVED":
print("✓ Ready to ship!")
else:
print("✗ Issues found:", result["policy_violations"])
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| output_dir | No | ||
| policy_file | No | ||
| distribution_type | No | ||
| check_vulnerabilities | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully discloses behavior: it executes a 6-step workflow, returns a comprehensive dictionary with decision, risk level, violations, etc. It also lists what each step does and the return structure, leaving no ambiguity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections (workflow, args, returns, example) and is front-loaded with purpose. However, it is somewhat verbose with repeated lists and could be slightly trimmed without losing value. Still efficient overall.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool complexity (5 parameters, no annotations, output schema present but not shown), the description covers all necessary information: workflow, parameter details, return values with field explanations, and an example. It is complete for agent invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although the input schema has 0% description coverage (only titles and types), the description provides detailed explanations for all 5 parameters, including defaults, optionality, and how they affect the workflow. This fully compensates for the schema's lack of descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'UNIVERSAL COMPLIANCE WORKFLOW: One-shot compliance check for ANY project type' and lists the steps. It clearly distinguishes itself from sibling tools like scan_directory by being a convenience tool that orchestrates multiple steps.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes dedicated 'WHEN TO USE' and 'WHEN NOT TO USE' sections, explicitly naming alternative tools such as scan_directory, validate_policy, etc. It provides clear guidance on when to call this tool vs. individual tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Scan binary files for OSS components and licenses using BinarySniffer.
This tool analyzes compiled binaries, executables, libraries, and archives (APK, EXE, DLL, SO, JAR, etc.) to detect open source components, extract license information, and identify security issues.
Use this tool when:
Analyzing mobile apps (APK, IPA)
Scanning executables (EXE, ELF binaries)
Examining shared libraries (DLL, SO, DYLIB)
Analyzing Java archives (JAR, WAR, EAR)
Scanning firmware or embedded binaries
Generating SBOM for binary distributions
Args: path: Path to binary file or directory to analyze analysis_mode: Analysis depth - "fast" (quick scan), "standard" (balanced), or "deep" (thorough analysis, slower) generate_sbom: If True, generate SBOM in CycloneDX format check_licenses: If True, perform detailed license analysis check_compatibility: If True, check license compatibility and show warnings confidence_threshold: Minimum confidence level (0.0-1.0) for component detection output_format: Output format - "json", "table", "csv" (default: json)
Returns: Dictionary containing: - components: List of detected OSS components with licenses - licenses: Summary of all licenses found - compatibility_warnings: License compatibility issues (if check_compatibility=True) - sbom: CycloneDX SBOM (if generate_sbom=True) - metadata: Scan statistics and file information
Examples: # Scan an Android APK scan_binary("app.apk")
# Deep analysis with SBOM generation
scan_binary("firmware.bin", analysis_mode="deep", generate_sbom=True)
# Check license compatibility
scan_binary("library.so", check_compatibility=True)
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| analysis_mode | No | standard | |
| generate_sbom | No | ||
| output_format | No | json | |
| check_licenses | No | ||
| check_compatibility | No | ||
| confidence_threshold | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Describes the tool's behavior: analyzes compiled binaries, detects components, extracts licenses, identifies security issues. Notes that deep mode is slower and requires more thorough analysis. No side effects or modifications are implied, but does not explicitly state it is read-only. Sufficient given no annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with summary, usage list, Args, Returns, and Examples. Each section adds value, but the 'Use this tool when' list slightly overlaps with the file-type examples. Still efficient and front-loaded with key purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 7 parameters, one required, and presence of many sibling tools, the description covers all necessary aspects: tool purpose, target file types, parameter details, return structure, and examples. No output schema provided but return dictionary is described adequately.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description compensates fully with a detailed 'Args' section explaining all 7 parameters, including defaults, possible values (fast/standard/deep), numeric range for confidence_threshold, and boolean toggles. Examples illustrate usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'Scan binary files for OSS components and licenses using BinarySniffer', with specific verb and resource. Lists many file types and distinguishes from siblings like scan_directory or check_package which handle non-binary or package-level analysis.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit 'Use this tool when' list covering multiple scenarios (mobile apps, executables, libraries, firmware, SBOM generation). However, it does not mention when to avoid using it or suggest alternative sibling tools for specific subtasks (e.g., using generate_sbom alone).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
FIRST STEP: Scan a directory for compliance issues using purl2notices.
This is typically the FIRST tool you should use when analyzing a project. Use this to discover what's in your project before validation or documentation generation.
PURPOSE:
Scan project source code for licenses (using purl2notices)
Detect ALL packages including transitive dependencies (scans node_modules/, site-packages/, vendor/)
Extract copyright statements from source code
Check for vulnerabilities (using vulnq)
Validate against policy (using ospac)
WHAT purl2notices DETECTS:
Project source licenses (from your own code)
Dependency packages (ALL packages in node_modules/, not just package.json)
Package licenses (from dependency source code)
Copyright holders (extracted from actual source files)
IMPORTANT: This tool scans the ENTIRE dependency tree:
For npm projects: All 50+ packages in node_modules/ (not just the 1-2 in package.json)
For Python projects: All packages in site-packages/ or virtualenv
Includes transitive dependencies automatically
WHEN TO USE:
Starting compliance analysis for a new project (FIRST STEP)
Need to discover all licenses in source code
Want to identify all package dependencies (including transitive)
Beginning vulnerability assessment
Need comprehensive project analysis with copyright attribution
WHEN NOT TO USE:
Already have PURLs and just need legal notices → use generate_legal_notices directly
Analyzing compiled binaries → use scan_binary instead
Just validating known licenses → use validate_license_list
Checking single package → use check_package
WORKFLOW POSITION: FIRST STEP in most compliance workflows. Use this to discover what's in your project before validation/generation.
TYPICAL NEXT STEPS:
For mobile apps: scan_directory(check_vulnerabilities=True) → validate_license_list(distribution="mobile") → generate_legal_notices(purls=scan_result["packages"])
For vulnerability assessment: scan_directory(check_vulnerabilities=True) → analyze_commercial_risk(path=".") → check specific packages with check_package for details
For documentation: scan_directory() → generate_legal_notices(purls=scan_result["packages"]) → generate_sbom(path=".")
IMPORTANT NOTES:
identify_packages parameter is deprecated (purl2notices always detects packages)
check_vulnerabilities=True: Checks all detected packages for CVEs
check_licenses parameter is deprecated (purl2notices always scans licenses)
Scans recursively by default (max depth 3 into node_modules/)
Args: path: Directory or file path to scan recursive: Enable recursive scanning (default: True, max depth 3) check_vulnerabilities: Check for vulnerabilities in detected packages check_licenses: (Deprecated - always True) Scan for licenses identify_packages: (Deprecated - always True) Detect packages policy_file: Optional policy file for license compliance validation
Returns: Dictionary containing: - licenses: List of detected licenses from project and dependencies - packages: List of ALL detected packages with PURLs (includes transitive deps) - vulnerabilities: List of vulnerabilities (if check_vulnerabilities=True) - policy_violations: Policy violations (if policy_file provided) - metadata: Summary information including copyright holders and counts
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| recursive | No | ||
| policy_file | No | ||
| check_licenses | No | ||
| identify_packages | No | ||
| check_vulnerabilities | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It comprehensively discloses behavior: scans entire dependency trees (including transitive), recursive scanning with max depth 3, deprecation of parameters, and what is detected (licenses, packages, vulnerabilities, policy). No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but well-structured with clear sections. It is slightly verbose due to repetition (e.g., 'FIRST STEP' appears multiple times), but the structure (uppercase headers, bullet points, examples) makes it easy to scan. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (6 parameters, no schema descriptions, 13 sibling tools), the description is remarkably complete. It covers purpose, scope, usage guidelines, parameter details, return values, deprecation notes, and workflow examples. No gaps remain for an AI to misuse the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description explains each parameter in detail: path (required), recursive (default true, max depth 3), check_vulnerabilities (default false, checks CVEs), check_licenses (deprecated, always true), identify_packages (deprecated, always false), policy_file (optional). It also describes the return dictionary structure, adding significant value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: scanning a directory for compliance issues using purl2notices. It distinguishes itself from siblings by explicitly marking itself as the FIRST STEP and providing alternative tools for specific scenarios (e.g., generate_legal_notices, scan_binary).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes explicit 'WHEN TO USE' and 'WHEN NOT TO USE' sections, clearly listing conditions and alternative tools. It also provides workflow examples showing typical next steps, making it easy for the AI to decide when to invoke this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
QUICK answer to: "Can I ship this with these licenses?"
This tool analyzes a list of licenses without requiring a filesystem path, making it ideal for quick validation checks.
WHEN TO USE:
You have a list of licenses (from scan results)
Need to validate for specific distribution type (mobile, desktop, saas, embedded)
Want app store compatibility check (iOS/Android)
Fast compliance validation without deep analysis
Quick go/no-go decision for shipping
WHEN NOT TO USE:
Need to scan codebase first → use scan_directory
Need detailed policy evaluation → use validate_policy
Need complete legal documentation → use generate_legal_notices after validation
Don't have license list yet → use scan_directory first
WORKFLOW POSITION: Use AFTER scan_directory/check_package to validate licenses, BEFORE generate_legal_notices to confirm compliance.
COMMON WORKFLOW: scan_directory(identify_packages=True) → validate_license_list(distribution="mobile") [VALIDATION STEP] → generate_legal_notices(purls=[...]) [IF APPROVED]
RETURNS CLEAR DECISION:
safe_for_distribution: true/false
app_store_compatible: true/false (if check_app_store_compatibility=True)
recommendations: What to do next
violations: What's wrong (if any)
Args: licenses: List of SPDX license identifiers (e.g., ["MIT", "Apache-2.0"]) distribution: Target distribution type - "mobile", "desktop", "saas", "embedded", "general" check_app_store_compatibility: Check specific App Store (iOS/Android) compatibility
Returns: Dictionary with: - safe_for_distribution: bool - Overall safety assessment - copyleft_risk: str - "none", "weak", or "strong" - risk_level: str - "LOW", "MEDIUM", or "HIGH" - violations: List of identified issues - recommendations: List of actionable recommendations - app_store_compatible: bool - iOS/Android app store compatibility - license_details: Summary of each license
| Name | Required | Description | Default |
|---|---|---|---|
| licenses | Yes | ||
| distribution | No | general | |
| check_app_store_compatibility | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description fully carries the behavioral disclosure burden. It explains that the tool is a quick validation without deep analysis, and it details the return fields (safe_for_distribution, app_store_compatible, etc.). While it doesn't mention authentication or rate limits, it is transparent about its read-only nature and what the output contains.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections (intro, WHEN TO USE, WHEN NOT TO USE, WORKFLOW, RETURNS, Args, Returns). It is front-loaded with the core question and every sentence adds value without being verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's three parameters and output schema (described in Returns section), the description is complete. It covers the input parameters, return fields, workflow integration with siblings, and provides a common workflow example. No gaps are evident.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description compensates by explaining each parameter: licenses (list of SPDX identifiers with example), distribution (target with enumerated options), and check_app_store_compatibility (boolean with effect). It adds meaning beyond the bare schema by providing context and examples.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose as providing a quick answer to 'Can I ship this with these licenses?' and specifies it analyzes a list of licenses without requiring a filesystem path. It distinguishes itself from sibling tools by explicitly listing when to use and when not to use them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes explicit 'WHEN TO USE' and 'WHEN NOT TO USE' sections, naming alternative tools like scan_directory, validate_policy, and generate_legal_notices. It also provides the workflow position and a common workflow example, making it clear when to select this tool over others.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Validate if licenses are approved or rejected for a specific project/distribution type.
This tool evaluates licenses against organizational policies and returns clear APPROVE or DENY decisions based on the distribution type. This is the primary tool for answering: "Can I use these licenses for my [mobile/commercial/saas/etc] project?"
Key Use Cases:
Check if licenses are approved for mobile app distribution
Validate licenses for commercial products
Ensure SaaS deployment compliance
Verify licenses for embedded systems
Check licenses for any distribution type
Returns clear approve/deny decisions:
action: "approve" (licenses are allowed), "deny" (licenses blocked), or "review" (manual review needed)
severity: "info" (approved), "warning" (review), "error" (denied)
message: Explanation of the decision
requirements: What must be done to comply (if approved)
remediation: How to fix the issue (if denied)
Args: licenses: List of SPDX license IDs to validate (e.g., ["MIT", "Apache-2.0", "GPL-3.0"]) policy_file: Optional custom policy directory (uses enterprise defaults if not provided) distribution: Distribution type - determines policy rules: - "mobile": iOS/Android apps (blocks GPL, allows permissive) - "commercial": Commercial products (blocks strong copyleft) - "saas": Software as a Service (blocks AGPL, allows GPL) - "embedded": Embedded systems (blocks copyleft) - "desktop": Desktop applications - "web": Web applications - "open_source": Open source projects (allows most licenses) - "internal": Internal use only (allows all) context: Optional usage context (e.g., "static_linking", "dynamic_linking")
Returns: Dictionary with: - licenses: List of licenses evaluated - distribution: Distribution type used - context: Context evaluated - result.action: "approve", "deny", or "review" - result.severity: "info" (approved), "warning" (review), or "error" (denied) - result.message: Human-readable decision explanation - result.requirements: List of compliance requirements (if approved) - result.remediation: Suggested fix (if denied, e.g., "Replace with MIT alternative") - using_default_policy: Whether default enterprise policy was used
Examples: # Check if licenses are approved for mobile app validate_policy(["MIT", "Apache-2.0"], distribution="mobile") → action: "approve" ✓
# Check GPL for mobile (will be denied)
validate_policy(["GPL-3.0"], distribution="mobile")
→ action: "deny", remediation: "Replace with permissive alternative"
# Check licenses for commercial distribution
validate_policy(["MIT", "LGPL-2.1", "Apache-2.0"], distribution="commercial")
→ action: "approve" or "review" depending on policy
# Check AGPL for SaaS (will be denied)
validate_policy(["AGPL-3.0"], distribution="saas")
→ action: "deny", reason: "Network copyleft requires source disclosure"Workflow Integration: 1. After scanning: scan_directory() → extract licenses → validate_policy() 2. Quick check: validate_policy(["GPL-3.0"], distribution="mobile") → see if approved 3. Policy enforcement: validate_policy() → if action=="deny" → block deployment
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | ||
| licenses | Yes | ||
| policy_file | No | ||
| distribution | No | binary |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It thoroughly explains the tool's behavior: returns approve/deny/review decisions, describes output fields, and lists distribution-specific rules. However, it does not explicitly state that the tool has no side effects or is read-only, though the validation nature implies this.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections for purpose, use cases, return values, args, examples, and workflow. It is slightly verbose but every section adds value. The front-loading of purpose and key use cases is effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (4 parameters, output schema), the description is fully complete. It covers all input parameters, output fields, behavior per distribution type, and provides multiple examples. It integrates with workflow and addresses typical use cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, so the description must compensate. It does so excellently: explains each parameter in detail (licenses as SPDX IDs, policy_file optional, distribution types with policies, context examples), provides allowed values, and includes examples showing parameter usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: validate licenses against organizational policies for a specific distribution type. It uses specific verbs and resources, and distinguishes itself from sibling tools by positioning itself as the primary tool for answering 'Can I use these licenses for my project?'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides extensive usage context, including key use cases (mobile, commercial, SaaS, etc.) and workflow integration (post-scan, quick check, enforcement). It does not explicitly mention when not to use this tool or direct to alternatives, but given the clear use cases, it is well-guided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v1.6.2analyze_commercial_riskcheck_license_compatibilitycheck_packagedownload_and_scan_packagegenerate_legal_noticesgenerate_legal_notices_from_purlsgenerate_sbomget_license_detailsget_license_obligationsrun_compliance_checkscan_binaryscan_directoryvalidate_license_listvalidate_policyEvery tool has a clearly distinct purpose. While generate_legal_notices and generate_legal_notices_from_purls are similar, their descriptions explicitly differentiate them by input method and use case, preventing confusion. All other tools target unique aspects of compliance analysis.
Tool names predominantly follow a verb_noun pattern (e.g., scan_directory, validate_policy), but there is minor inconsistency: some use hyphens (check_license_compatibility) while others use underscores consistently, and verbs vary (analyze, check, generate, scan, validate). Overall, the pattern is predictable and readable.
With 14 tools, the server covers a comprehensive compliance workflow—from scanning and package analysis to license validation, legal notice generation, and SBOM creation. Each tool serves a clear role without redundancy, and the count is well-scoped for the domain.
The tool surface covers the entire lifecycle: scanning (source, binary), package analysis (simple and deep), license checks (details, obligations, compatibility), risk assessment, policy validation, legal notices (source and PURL-based), SBOM generation, and an end-to-end compliance workflow. No significant gaps are apparent.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Open-source licence risk checks for AI coding agents and dependency trees.
Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/SemClone/mcp-semclone'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
