Licence and provenance
Declared licence, open-source dependencies disclosed, and the tool it was built with named.
- Applies to
- agents, MCP servers, apps, templates
- Standard references
- none mapped
A finding here is not a failure
Software of any size carries something. A listing that raises findings on this check is still sold, with the findings published and their severity and reachability stated. A badge that only ever said pass would teach people to stop reading it.
Explainer · 2026-09-30
Licence and provenance: why a missing licence file is a finding even when a licence is declared
A licence field in a package's metadata says which licence applies. The common open-source licences also ask for their text to travel with every copy, and many packages ship without it.
What this row checks
A declared licence, the open-source dependencies disclosed, and the tool the listing was built with named. For a published package the first part is two questions: is a licence declared, and does the licence text ship with the package.
Why the file matters
The MIT licence says its copyright and permission notice shall be included in all copies or substantial portions of the software. The Apache licence asks that recipients be given a copy of the licence. A package that declares MIT in its metadata and ships no licence text has named its terms and then not met them.
In the hand run, every automated note saying a package shipped no licence file was true, and every one of those packages declared a licence in its registry metadata all the same. The finding is the missing text, not a missing choice.
Provenance
Provenance is the other half of the row: where the package came from. npm can publish a signed provenance statement linking a package to the repository and build that produced it, for packages built on a supported continuous-integration service. It proves where a package was built, not that what was built is safe, and a listing shows it when it exists.
In the glossary: Provenance attestation, Artifact digest.
What this check has found
195 listings in the catalogue raise a finding here. Every one is still sold, with the finding printed on its page.
- Storybook MCP
no LICENCE file at the root (.)
- Server Filesystem
no LICENCE file at the root (.)
- Server Pdf
no LICENCE file at the root (.)
- Server Sequential Thinking
no LICENCE file at the root (.)
- Server Everything
no LICENCE file at the root (.)
- Ato MCP
no LICENCE file at the root (.)
- Server Memory
no LICENCE file at the root (.)
- Next Devtools MCP
no LICENCE file at the root (.)
- Claude Flow Cli
no LICENCE file at the root (.)
- Metabase MCP
no LICENCE file at the root (.)
- Hlims MCP
no LICENCE file at the root (.)
- Observability MCP
no LICENCE file at the root (.)
- Z Ai MCP Server
no LICENCE file at the root (.)
- Sellable MCP
no LICENCE file at the root (.)
- Stripe MCP
no LICENCE file at the root (.)
- Forestadmin MCP Server
no LICENCE file at the root (.)
- MCP Server Atlassian Jira
no LICENCE file at the root (.)
- Cloudbase MCP
no LICENCE file at the root (.)
- Drawio MCP
no LICENCE file at the root (.)
- Goke MCP
no LICENCE file at the root (.)
- MCP Server Alipay
no LICENCE file at the root (.)
- Samarth Gtm MCP
no LICENCE file at the root (.)
- Browsermcp MCP
no LICENCE file at the root (.)
- Kubernetes MCP Server Linux Amd64
no LICENCE file at the root (.)
- Clarity MCP Server
no LICENCE file at the root (.)
- Browser Tools MCP
no LICENCE file at the root (.)
- MCP Server Atlassian Confluence
no LICENCE file at the root (.)
- Fe MCP Server
no LICENCE file at the root (.)
- Openai Codex
no LICENCE file at the root (.)
- Earendil Works Pi Coding Agent
no LICENCE file at the root (.)
- Am I Vibing
no LICENCE file at the root (.)
- Fallow
no LICENCE file at the root (.)
- Googleworkspace CLI
no LICENCE file at the root (.)
- Accio AI CLI
no LICENCE file at the root (.)
- Mindstudio AI Agent
no LICENCE file at the root (.)
- Cloakbrowser
no LICENCE file at the root (.)
- Agent Eval
no LICENCE file at the root (.)
- Claude Flow Codex
no LICENCE file at the root (.)
- Earendil Works Pi AI
no LICENCE file at the root (.)
- Ruvllm
no LICENCE file at the root (.)
- I18n CLI
no LICENCE file at the root (.)
- Stably
no LICENCE file at the root (.)
- Tokscale
no LICENCE file at the root (.)
- Seo CLI
no LICENCE file at the root (.)
- Tokscale CLI
no LICENCE file at the root (.)
- Firecrawl CLI
no LICENCE file at the root (.)
- Easyai CLI
no LICENCE file at the root (.)
- Assist
no LICENCE file at the root (.)
- Connector Claude Code
no LICENCE file at the root (.)
- Inference CLI
no LICENCE file at the root (.)
- F5 Sales Demo Pi AI
no LICENCE file at the root (.)
- Create Agent App
no LICENCE file at the root (.)
- Create Stellar Agentic
no LICENCE file at the root (.)
- Archqa Create Agentic Playwright
no LICENCE file at the root (.)
- Pptx Viewer MCP
no LICENCE file at the root (.)
- Agentmail MCP
no LICENCE file at the root (.)
- Server Puppeteer
no LICENCE file at the root (.)
- Local MCP
no LICENCE file at the root (.)
- Nocodb MCP Server
no LICENCE file at the root (.)
- Brains MCP
no LICENCE file at the root (.)
- MCP Server Gsc
no LICENCE file at the root (.)
- MCP Datadog
no LICENCE file at the root (.)
- Run MCP Servers With Aws Lambda
no LICENCE file at the root (.)
- Excalidraw MCP
no LICENCE file at the root (.)
- Artist MCP
no LICENCE file at the root (.)
- MCP Server Linear
no LICENCE file at the root (.)
- Opentakeoff MCP
no LICENCE file at the root (.)
- MCP Analytics
no LICENCE file at the root (.)
- Cds MCP Server
no LICENCE file at the root (.)
- MCP Salesforce
no LICENCE file at the root (.)
- Ag MCP
no LICENCE file at the root (.)
- MCP Server Browser
no LICENCE file at the root (.)
- Spacefast MCP
no LICENCE file at the root (.)
- Jira MCP Server
no LICENCE file at the root (.)
- Search MCP Server
no LICENCE file at the root (.)
- Firefox Devtools MCP
no LICENCE file at the root (.)
- Airweave MCP Search
no LICENCE file at the root (.)
- Memory
no LICENCE file at the root (.)
- Oe MCP
no LICENCE file at the root (.)
- Mysql MCP
no LICENCE file at the root (.)
- Letsfg MCP
no LICENCE file at the root (.)
- Slack Workspace MCP Server
no LICENCE file at the root (.)
- Omnisocials MCP Server
no LICENCE file at the root (.)
- Postgres MCP Hardened
no LICENCE file at the root (.)
- MCP Server Aws Sso
no LICENCE file at the root (.)
- MCP Server Docker
no LICENCE file at the root (.)
- MCP Atlassian
no LICENCE file at the root (.)
- Integration MCP Proxy
no LICENCE file at the root (.)
- G Jira MCP
no LICENCE file at the root (.)
- MCP Server Mysql
no LICENCE file at the root (.)
- Creatrip MCP Server
no LICENCE file at the root (.)
- Jira MCP
no LICENCE file at the root (.)
- Perplexity User MCP
no LICENCE file at the root (.)
- Myclaw Toolkit
no LICENCE file at the root (.)
- Gitlab Http API MCP
no LICENCE file at the root (.)
- O2n MCP Server
no LICENCE file at the root (.)
- MCP Server Aws
no LICENCE file at the root (.)
- MCP Legislative
no LICENCE file at the root (.)
- MCP Film
no LICENCE file at the root (.)
- MCP Server Slack
no LICENCE file at the root (.)
- MCP Merchant
no LICENCE file at the root (.)
- MCP Server Filesystem Ro
no LICENCE file at the root (.)
- MCP Server Filesystem
no LICENCE file at the root (.)
- Fvhub MCP
no LICENCE file at the root (.)
- MCP Server Redis
no LICENCE file at the root (.)
- MCP Sequential Thinking Test
no LICENCE file at the root (.)
- MCP Server Mysql
no LICENCE file at the root (.)
- Facultiai MCP Server
no LICENCE file at the root (.)
- Herohunt MCP
no LICENCE file at the root (.)
- Selenide MCP
no LICENCE file at the root (.)
- Herbal Multidb MCP
no LICENCE file at the root (.)
- MCP Server Slack
no LICENCE file at the root (.)
- Example MCP Server Sqlite
no LICENCE file at the root (.)
- Server Github
no LICENCE file at the root (.)
- Mykeepai MCP
no LICENCE file at the root (.)
- Simul8r MCP
no LICENCE file at the root (.)
- Dbsql MCP
no LICENCE file at the root (.)
- Elasticdash MCP
no LICENCE file at the root (.)
- MCP Server Time
no LICENCE file at the root (.)
- Kubernetes MCP Server
no LICENCE file at the root (.)
- Pgsql MCP Server
no LICENCE file at the root (.)
- Run MCP Servers With Aws Lambda
no LICENCE file at the root (.)
- Podman MCP Server
no LICENCE file at the root (.)
- Redis MCP Server
no LICENCE file at the root (.)
- Mysql MCP Zag
no LICENCE file at the root (.)
- Slack Lists MCP
no LICENCE file at the root (.)
- Avm MCP Server
no LICENCE file at the root (.)
- Better Qdrant MCP
no LICENCE file at the root (.)
- Rtfd MCP
no LICENCE file at the root (.)
- Larkin MCP
no LICENCE file at the root (.)
- Skillport MCP
no LICENCE file at the root (.)
- Cerngitlab MCP
no LICENCE file at the root (.)
- Gsc Bing MCP
no LICENCE file at the root (.)
- Slack Pat MCP
no LICENCE file at the root (.)
- Ui Ticket MCP
no LICENCE file at the root (.)
- W8s Astro MCP
no LICENCE file at the root (.)
- Datris MCP Server
no LICENCE file at the root (.)
- Loreto MCP
no LICENCE file at the root (.)
- Kontrol Freek MCP
no LICENCE file at the root (.)
- MCP Billing Gateway
no LICENCE file at the root (.)
- AI Vault MCP
no LICENCE file at the root (.)
- Custom MCP Database
no LICENCE file at the root (.)
- Addon MCP
no LICENCE file at the root (.)
- Nx MCP
no LICENCE file at the root (.)
- Codebase Memory MCP
no LICENCE file at the root (.)
- Gk
no LICENCE file at the root (.)
- Dynoxide
no LICENCE file at the root (.)
- Agent Comms
no LICENCE file at the root (.)
- Sem
no LICENCE file at the root (.)
- Ruv Swarm
no LICENCE file at the root (.)
- Wordpress MCP Server
no LICENCE file at the root (.)
- Fluttersdk MCP
no LICENCE file at the root (.)
- Trusty Squire MCP
no LICENCE file at the root (.)
- Unleash MCP
no LICENCE file at the root (.)
- Rsdoctor MCP Server
no LICENCE file at the root (.)
- Neat Is MCP
no LICENCE file at the root (.)
- Agentcash
no LICENCE file at the root (.)
- Spacefast
no LICENCE file at the root (.)
- Kin MCP
no LICENCE file at the root (.)
- Code Index MCP
no LICENCE file at the root (.)
- Godot MCP
no LICENCE file at the root (.)
- Chirpie MCP
no LICENCE file at the root (.)
- Nichedb
no LICENCE file at the root (.)
- Next Finance MCP
no LICENCE file at the root (.)
- Starreel MCP
no LICENCE file at the root (.)
- Clipform MCP Server
no LICENCE file at the root (.)
- Toolroute Sdk
no LICENCE file at the root (.)
- Codehealth MCP
no LICENCE file at the root (.)
- Ateam AI MCP
no LICENCE file at the root (.)
- Codegraph MCP
no LICENCE file at the root (.)
- Browser MCP
no LICENCE file at the root (.)
- Layers CLI
no LICENCE file at the root (.)
- Formlab MCP
no LICENCE file at the root (.)
- Inspo MCP
no LICENCE file at the root (.)
- Controlkeel
no LICENCE file at the root (.)
- Hicortex
no LICENCE file at the root (.)
- Transloadit MCP Server
no LICENCE file at the root (.)
- Stratta MCP
no LICENCE file at the root (.)
- Remem
no LICENCE file at the root (.)
- Mneme AI
no LICENCE file at the root (.)
- Deja Vu
no LICENCE file at the root (.)
- Repo Prism MCP Server
no LICENCE file at the root (.)
- Rentahuman MCP
no LICENCE file at the root (.)
- Hypelens Agent Rail
no LICENCE file at the root (.)
- Adeu MCP Server
no LICENCE file at the root (.)
- Octofs
no LICENCE file at the root (.)
- Aibtc MCP Server
no LICENCE file at the root (.)
- Motiblog MCP
no LICENCE file at the root (.)
- Deliberation MCP
no LICENCE file at the root (.)
- Arcbounty MCP
no LICENCE file at the root (.)
- Dryrun
no LICENCE file at the root (.)
- Monnet MCP
no LICENCE file at the root (.)
- Moltbridge
no LICENCE file at the root (.)
- Northflank
no LICENCE file at the root (.)
- Twenty
no LICENCE file at the root (.)
Every listing in the catalogue shows its result on this check, with the findings summarised in public and the full report to whoever bought it. Open the catalogue.