# security_fetch_licence_analysis

Understand any software licence in plain English. Returns obligations, permissions, limitations, risk level, and OSI/FSF status for any SPDX licence identifier. Static bundle covers top-50 common licences (no network call). Falls back to spdx.org API for rare identifiers. All risk levels assume proprietary/commercial use. Rate limit: 60/minute. No auth required. For security engineers and developers understanding what a licence allows before including a dependency. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_fetch_licence_analysis", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

Agent View of the PolicyLayer registry record for `security_fetch_licence_analysis`. HTML page: https://policylayer.com/tools/dev-7bd0-mcp-server/security-fetch-licence-analysis

## Facts

- Tool: `security_fetch_licence_analysis`
- Server: DataNexus MCP (`dev-7bd0/mcp-server`) — https://policylayer.com/tools/dev-7bd0-mcp-server.md
- Homepage: https://github.com/dev-7bd0/mcp-server
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 1
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `spdx_id` | string | no | SPDX licence identifier e.g. MIT, Apache-2.0, GPL-3.0. Required. |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "security_fetch_licence_analysis",
    "arguments": {}
  }
}
```

## Why security_fetch_licence_analysis is rated Low

This is a read-only information retrieval tool that queries and returns license analysis data without any side effects. It does not create, modify, delete, execute code, or trigger external operations.

From the tool's own definition: "Tool performs static analysis and lookup of software license information from SPDX identifiers. Returns 'obligations, permissions, limitations, risk level, and OSI/FSF status' - all informational outputs with no modifications to data or systems."

## Use case

AI agents call security_fetch_licence_analysis to retrieve information from DataNexus MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches DataNexus MCP:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "security_fetch_licence_analysis": {}
  }
}
```

## Other tools on DataNexus MCP (54)

- `apikeys_revoke_api_key` — Destructive — https://policylayer.com/tools/dev-7bd0-mcp-server/apikeys-revoke-api-key.md
- `apikeys_rotate_api_key` — Destructive — https://policylayer.com/tools/dev-7bd0-mcp-server/apikeys-rotate-api-key.md
- `compliance_check_sam_exclusion` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/compliance-check-sam-exclusion.md
- `compliance_fetch_finra_broker` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/compliance-fetch-finra-broker.md
- `compliance_fetch_npi_provider` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/compliance-fetch-npi-provider.md
- `compliance_search_npi_by_name` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/compliance-search-npi-by-name.md
- `domain_check_email_security` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-check-email-security.md
- `domain_fetch_dns_records` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-dns-records.md
- `domain_fetch_domain_history` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-domain-history.md
- `domain_fetch_domain_rdap` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-domain-rdap.md
- `domain_fetch_reverse_ip` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-reverse-ip.md
- `domain_fetch_ssl_certificate_chain` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-ssl-certificate-chain.md
- `domain_fetch_subdomains` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-subdomains.md
- `frontend_security_audit_ci_pipeline` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/frontend-security-audit-ci-pipeline.md
- `frontend_security_audit_manifest` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/frontend-security-audit-manifest.md
- `frontend_security_detect_typosquatting` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/frontend-security-detect-typosquatting.md
- `frontend_security_fetch_package_risk_brief` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/frontend-security-fetch-package-risk-brief.md
- `govcon_fetch_open_solicitations` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/govcon-fetch-open-solicitations.md
- `govcon_fetch_vendor_contract_history` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/govcon-fetch-vendor-contract-history.md
- `govcon_search_contract_awards` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/govcon-search-contract-awards.md
- `legal_fetch_inventor_portfolio` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/legal-fetch-inventor-portfolio.md
- `legal_fetch_patent_by_number` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/legal-fetch-patent-by-number.md
- `legal_fetch_patent_citations` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/legal-fetch-patent-citations.md
- `legal_search_patents_by_keyword` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/legal-search-patents-by-keyword.md
- `nonprofit_fetch_charity_uk` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-fetch-charity-uk.md
- `nonprofit_fetch_nonprofit_by_ein` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-fetch-nonprofit-by-ein.md
- `nonprofit_fetch_nonprofit_financial_trends` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-fetch-nonprofit-financial-trends.md
- `nonprofit_fetch_nonprofit_full_profile` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-fetch-nonprofit-full-profile.md
- `nonprofit_search_nonprofits_by_category` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-search-nonprofits-by-category.md
- `nonprofit_search_nonprofits_by_name` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-search-nonprofits-by-name.md
- …and 24 more: https://policylayer.com/tools/dev-7bd0-mcp-server.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=dev-7bd0-mcp-server · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/dev-7bd0-mcp-server