{"uid":"cap_aeZPbfK5sHLB5ywMLCjEx","slug":"license-compliance-check-for-package-dependency-tree-f5def1ca","name":"License Compliance Check for Package Dependency Tree","description":"License-compliance verdict for one package and its whole transitive dependency tree. Resolves the deps.dev graph plus the declared SPDX license of every node, finds copyleft contamination points, and returns a target-and-distribution-aware verdict of safe, attribution-required, copyleft-risk or incompatible. Automated indicators, not legal advice.","url":"https://api.agentstools.dev/license/check","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","required":["ecosystem","name"],"properties":{"name":{"type":"string","description":"Package name"},"version":{"type":"string","description":"Version (optional; default resolved if omitted)"},"ecosystem":{"enum":["npm","pypi","go","maven","cargo","nuget"],"type":"string","description":"Package ecosystem"},"distribution":{"enum":["saas","binary","internal"],"type":"string","description":"How you ship it (default saas)"},"target_license":{"type":"string","description":"Your project SPDX license, e.g. MIT"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.03","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.03/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm__PgqDLEbb2_IyvwcoJAVF","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.03","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns a license-compliance verdict (safe, attribution-required, copyleft-risk, or incompatible) for an open-source package and its full transitive dependency graph, accounting for distribution model and target project license.","exampleAgentPrompt":"Can you check if the npm package 'express' (latest version) has any copyleft risk or license incompatibilities for my MIT-licensed SaaS project that I ship as a hosted service?","exampleUseCases":null,"resultDescription":"A structured JSON verdict with one of four risk levels — safe, attribution-required, copyleft-risk, or incompatible — along with a list of nodes in the transitive dependency tree, their SPDX licenses, and identified copyleft contamination points. The result is distribution-aware (saas/binary/internal) and target-license-aware. Includes a disclaimer that these are automated indicators, not legal advice.","failureModes":["Unknown or misspelled package name returns an error or empty graph","Unsupported ecosystem enum value returns 400 validation error","Version string not found in registry causes resolution failure","Deps.dev graph unavailable causes upstream timeout","Missing required 'ecosystem' or 'name' query params returns 400","Packages with no declared SPDX license may produce uncertain verdicts"],"whenToPreferThis":"Use this endpoint when you need automated, transitive-dependency-aware license compliance checking for open-source packages — especially when distribution mode (SaaS vs binary vs internal) and target project license matter for determining copyleft exposure. Prefer this over manual SPDX lookups when you need the full dependency tree analyzed, not just the top-level package. Best suited for CI/CD pipelines, developer tools, or any workflow where shipping decisions depend on license compatibility.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T12:47:29.453Z","isFirstParty":false}