{"uid":"cap_ZbFmm3DzhvTjbjRhZeqsP","slug":"payload402-npm-license-triage-1ecd5cba","name":"payload402 npm License Triage","description":"npm package license triage for coding agents: call before npm install or adding a dependency mid-task. Returns declared license, SPDX normalization, and permissive-default compatible yes/no/unknown from the public npm registry. Triage only — not compliance-grade SBOM or legal advice. Workflow: call GET /license/check (or MCP check_npm_license) before npm install; if compatible=no, pick another package or escalate to human; if unknown, treat as risk. Example: left-pad@1.0.0 before install. Also: Convert amounts between ISO 4217 currencies using ECB daily reference rates (Frankfurter). Use for invoices, travel budgets, expense reports, and shopping comparisons when you need a verifiable rate instead of LLM arithmetic. Not live tradable FX — rates follow ECB business-day publication. Also: Resolve a place name or lat/lon to IANA timezone and coordinates (Open-Meteo). Use for agent scheduling, travel logistics, and local-time questions without LLM guessing. Not IP geolocation. Also: Translate short text between languages (Azure Translator). Use when an agent needs a verifiable string in another language for UI copy, messages, or research snippets — not legal, medical, or certified translation.","url":"https://payload402.edgebytenet.workers.dev/mcp-license","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","toolName","inputSchema"],"properties":{"type":{"type":"string","const":"mcp"},"toolName":{"type":"string"},"description":{"type":"string"},"inputSchema":{"type":"object"}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"spdx":"MIT","policy":"permissive-default","reason":"Permissive license matches permissive-default policy","source":"npm-registry","license":"MIT","package":"lodash","version":"4.17.21","compatible":"yes","disclaimer":"Triage indicator only, not legal or compliance advice"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_QsENTI2myJ7r_Sskq6bmb","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Resolves the declared license for a specific npm package version, normalizes it to SPDX, and returns a permissive-default compatibility flag for coding agents.","exampleAgentPrompt":"Before I add axios@1.6.0 as a dependency, can you check its npm license and tell me if it's permissive-compatible?","exampleUseCases":[{"title":"Pre-commit dependency license check","prompt":"I'm about to add chalk@5.3.0 to our project — can you look up its npm license and tell me if it's permissive or if there are any copyleft flags I should know about?"},{"title":"Automated CI license gate","prompt":"During our build, check the license for uuid@9.0.0 on npm, normalize it to SPDX, and tell me whether it passes a permissive-default compatibility check."},{"title":"Vetting an unfamiliar library","prompt":"I found a package called node-forge at version 1.3.1 — can you resolve its declared license from the npm registry and let me know if it's safe to use in a commercial closed-source app?"}],"resultDescription":"A JSON object containing the package name, resolved version, declared license string, SPDX-normalized license identifier, a compatibility policy label (e.g. 'permissive-default'), a yes/no compatible flag, the data source ('npm-registry'), a human-readable reason, and a triage disclaimer noting this is not legal or compliance advice.","failureModes":["Package name or version not found on npm registry — returns error or empty result","Unrecognized or non-standard license string that cannot be normalized to SPDX — may return raw license with no SPDX field","Network or upstream npm registry unavailability causing timeout","Malformed input schema or missing required toolName field — returns validation error","Ambiguous or compound license expressions (e.g. (MIT OR Apache-2.0)) may require manual review"],"whenToPreferThis":"Choose this endpoint when a coding agent needs a quick, verifiable license check on a specific npm package version before adding it as a dependency mid-task. It is ideal for automated workflows, CI pipelines, and agent-driven coding assistants that need a machine-readable SPDX identifier and compatibility flag without invoking a full SBOM or legal compliance tool. Prefer this over LLM-recalled license knowledge when accuracy and source traceability matter.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T00:30:41.167Z","isFirstParty":false}