← All rules

mcp-scan rule

License compliance risk

license-riskhigh

What mcp-scan saw

The license scanner read the license field from the npm registry metadata gathered during the supply-chain scan, uppercased it, and graded it: missing entirely is HIGH, the literal UNLICENSED is HIGH, a string containing GPL, AGPL, LGPL, CC-BY-SA, EUPL, OSL, CDDL, or MPL is MEDIUM, and anything not in the permissive list and not 'SEE LICENSE IN LICENSE' or 'PROPRIETARY' is LOW.

Why it fires

It runs only when metadata.source is npm, so it grades registry metadata rather than the LICENSE file in the repository. Missing is graded HIGH because absence of a license means no grant at all, not a permissive default, which is the case people most often get backwards.

When this is a false positive

  • Matching is substring, not SPDX parsing. A dual license expressed as 'MIT OR GPL-3.0' contains GPL and grades as copyleft MEDIUM, even though you may take the MIT branch.
  • MPL-2.0 is on the copyleft list. It is file-level copyleft and normally imposes nothing on code that merely links it, so the MEDIUM grade overstates the obligation for most consumers.
  • The registry license field is often stale or missing on packages whose repository does carry a LICENSE file. The HIGH grade is about the metadata, not the actual grant.
  • Any non-standard but permissive identifier not in the hardcoded permissive list grades LOW purely for being unrecognized.

How to fix it

  1. Read the license string quoted in the finding. It is the raw value from the npm registry.
  2. Check the package's repository for a LICENSE file. If the grant is there and the registry field is missing, the risk is metadata quality, not licensing.
  3. For a dual license, confirm which branch you take and record it. The rule cannot express a choice, so it will keep reporting.
  4. For a genuine copyleft dependency in a product you distribute, escalate to whoever owns legal review before shipping.
  5. To suppress across the board, add 'license-risk' to suppressRules in .mcp-scan.json. Prefer per-server suppression via .mcp-scan-ignore when only one package is at issue.