dependency-license-change-mcp 1.0.0

package/README.md

@@ -0,0 +1,17 @@
+# dependency-license-change-mcp
+
+Dependency License Change compares license evidence across two local snapshots and reports category changes without exposing package names or license text.
+
+## Quick start
+
+```bash
+npm install
+npm test
+npm start
+```
+
+Set `LICENSE_CHANGE_ROOT`, then call `compare_license_evidence` with `before` and `after` snapshot paths.
+
+## Limits
+
+Only aggregate categories and counts are returned. Classification is conservative and is not legal advice.

package/dist/core.d.ts

@@ -0,0 +1,19 @@
+export declare class LicenseChangeError extends Error {
+}
+export declare function compareLicenseEvidence(input: {
+    before: string;
+    after: string;
+}): Promise<{
+    beforeFiles: number;
+    afterFiles: number;
+    changedCategoryCount: number;
+    categoryChanges: {
+        [k: string]: {
+            before: number;
+            after: number;
+        };
+    };
+    valueFree: boolean;
+    warning: string;
+}>;
+export declare function format(v: unknown): string;

package/dist/core.js

@@ -0,0 +1,28 @@
+import { readdir, readFile, realpath, stat } from "node:fs/promises";
+import path from "node:path";
+export class LicenseChangeError extends Error {
+}
+;
+const skip = new Set([".git", "node_modules", "dist", "build"]);
+const classify = (t) => /apache\s*2|apache-2/i.test(t) ? "apache-2" : /mit license|spdx: mit|license: mit/i.test(t) ? "mit" : /gpl/i.test(t) ? "gpl-family" : /bsd/i.test(t) ? "bsd-family" : /isc/i.test(t) ? "isc" : /unlicense/i.test(t) ? "unlicense" : "unknown";
+async function root(input) { const base = process.env.LICENSE_CHANGE_ROOT ?? path.join(process.cwd(), ".."); const root = await realpath(path.resolve(base)).catch(() => path.resolve(base)); const req = path.isAbsolute(input) ? path.resolve(input) : path.resolve(root, input); const target = await realpath(req).catch(() => req); const rel = path.relative(root, target); if (rel.startsWith("..") || path.isAbsolute(rel))
+    throw new LicenseChangeError("Snapshot path must stay inside the configured root"); if (!(await stat(target).catch(() => null)))
+    throw new LicenseChangeError("Snapshot path does not exist"); return target; }
+async function scan(input) { const base = await root(input), counts = {}; let files = 0; async function walk(dir, d) { if (d > 5 || files > 500)
+    return; for (const e of await readdir(dir, { withFileTypes: true }).catch(() => [])) {
+    if (skip.has(e.name))
+        continue;
+    const full = path.join(dir, e.name);
+    if (e.isDirectory())
+        await walk(full, d + 1);
+    else if (/^(license|copying|notice)(?:\.|$)/i.test(e.name) || /package\.(json|lock)$/.test(e.name)) {
+        const b = await readFile(full).catch(() => Buffer.alloc(0));
+        if (b.byteLength > 1000000)
+            continue;
+        files++;
+        const k = classify(b.toString());
+        counts[k] = (counts[k] || 0) + 1;
+    }
+} } await walk(base, 0); return { files, counts }; }
+export async function compareLicenseEvidence(input) { const [before, after] = await Promise.all([scan(input.before), scan(input.after)]); const cats = [...new Set([...Object.keys(before.counts), ...Object.keys(after.counts)])].sort(); const changes = Object.fromEntries(cats.filter(k => (before.counts[k] || 0) !== (after.counts[k] || 0)).map(k => [k, { before: before.counts[k] || 0, after: after.counts[k] || 0 }])); return { beforeFiles: before.files, afterFiles: after.files, changedCategoryCount: Object.keys(changes).length, categoryChanges: changes, valueFree: true, warning: "Only aggregate license categories are returned. Package names, license text, paths, and source contents are never emitted; this is not legal advice." }; }
+export function format(v) { return JSON.stringify(v, null, 2).slice(0, 12000); }

package/dist/index.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/index.js

@@ -0,0 +1,4 @@
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { createServer } from "./server.js";
+const main = async () => { const server = createServer(); await server.connect(new StdioServerTransport()); console.error("MCP server running on stdio"); };
+main().catch((error) => { console.error("Fatal error:", error); process.exit(1); });

package/dist/server.d.ts

@@ -0,0 +1,2 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function createServer(): McpServer;

package/dist/server.js

@@ -0,0 +1,22 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+import { format, compareLicenseEvidence } from "./core.js";
+const textError = (t) => ({ content: [{ type: "text", text: t }], isError: true });
+const READ_ONLY = { readOnlyHint: true, openWorldHint: true };
+const text = (value) => ({ content: [{ type: "text", text: value }] });
+const errorText = (error) => text(`Error: ${error instanceof Error ? error.message : String(error)}`);
+export function createServer() {
+    const server = new McpServer({ name: "dependency-license-change-mcp", version: "1.0.0" });
+    server.registerTool("compare_license_evidence", {
+        title: "Compare license evidence",
+        description: "Compare local license evidence across two snapshots without returning package names, text, paths, or source.",
+        inputSchema: z.object({ before: z.string().min(1).max(1000), after: z.string().min(1).max(1000) }),
+        annotations: READ_ONLY,
+    }, async (input) => { try {
+        return text(format(await compareLicenseEvidence(input)));
+    }
+    catch (error) {
+        return errorText(error);
+    } });
+    return server;
+}

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "dependency-license-change-mcp",
+  "version": "1.0.0",
+  "description": "Compare local license evidence across two snapshots without returning package names, text, paths, or source.",
+  "type": "module",
+  "mcpName": "io.github.mrfentmen/dependency-license-change-mcp",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mrfentmen/dependency-license-change-mcp.git"
+  },
+  "bin": {
+    "dependency-license-change-mcp": "./dist/index.js"
+  },
+  "main": "./dist/index.js",
+  "files": [
+    "dist",
+    "server.json",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "start": "node dist/index.js",
+    "test": "npm run build && node test.mjs"
+  },
+  "keywords": [
+    "mcp",
+    "local-first",
+    "read-only"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.4",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

package/server.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.mrfentmen/dependency-license-change-mcp",
+  "description": "Compare local license evidence across two snapshots without returning package names, text,...",
+  "repository": {
+    "url": "https://github.com/mrfentmen/dependency-license-change-mcp",
+    "source": "github"
+  },
+  "version": "1.0.0",
+  "packages": [
+    {
+      "registryType": "npm",
+      "identifier": "dependency-license-change-mcp",
+      "version": "1.0.0",
+      "transport": {
+        "type": "stdio"
+      }
+    }
+  ]
+}