{"id":"spdx-policy","title":"SPDX license expression parse and policy check","description":"Parses up to 50 SPDX license expressions (AND, OR, WITH exceptions, + or-later, LicenseRef) and evaluates each against a caller policy (allow list, deny list, allowed exceptions, OSI/FSF flags, copyleft tier) for agents vetting dependency licenses. Returns the canonical expression, per-license flags from the pinned SPDX License List, the verdict, and which licenses satisfy an OR. Does not detect licenses from source text, read package manifests or give legal advice; copyleft tiers are an id-family heuristic, not an SPDX attribute.","roi":"A bad license slips into a release when the agent only string-matches a license field.","audience":"developer","package":"code-preflight-kit","channels":["x402","mcp"],"endpoint":{"method":"POST","url":"https://agents.writerslogic.com/api/v1/spdx-policy","path":"/api/v1/spdx-policy","contentType":"application/json"},"price":{"amount":"0.005","currency":"USDC","network":"base","perCall":true,"failedCallsCharged":false},"inputSchema":{"type":"object","additionalProperties":false,"required":["expressions"],"properties":{"expressions":{"type":"array","minItems":1,"maxItems":50,"items":{"type":"string","maxLength":500},"description":"SPDX expressions, e.g. 'MIT OR (GPL-2.0-only WITH Classpath-exception-2.0)'."},"allow":{"type":"array","maxItems":200,"items":{"type":"string","maxLength":100},"description":"If non-empty, only these SPDX ids pass (GPL-2.0-only and GPL-2.0 are the same entry; GPL-2.0+ means or-later and must be listed as such)."},"deny":{"type":"array","maxItems":200,"items":{"type":"string","maxLength":100},"description":"SPDX ids that always fail."},"allowExceptions":{"type":"array","maxItems":100,"items":{"type":"string","maxLength":100},"description":"If non-empty, only these WITH exception ids pass."},"allowLicenseRefs":{"type":"array","maxItems":100,"items":{"type":"string","maxLength":100},"description":"LicenseRef-* ids the caller has reviewed; other refs yield unknown."},"requireOsiApproved":{"type":"boolean","description":"Fail licenses without isOsiApproved in the SPDX list."},"requireFsfLibre":{"type":"boolean","description":"Fail licenses without isFsfLibre in the SPDX list."},"allowDeprecated":{"type":"boolean","description":"Default true: deprecated ids only add a witness. false: they fail."},"denyCopyleft":{"type":"string","enum":["none","strong","any"],"description":"Id-family heuristic: strong = GPL/AGPL/SSPL/EUPL/OSL/CC-BY-SA; any adds LGPL/MPL/EPL/CDDL and similar."}}},"resultSchema":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"results":{"type":"array","items":{"type":"object","properties":{"index":{"type":"integer"},"expression":{"type":"string"},"valid":{"type":"boolean"},"canonical":{"type":"string"},"verdict":{"type":"string","enum":["ok","violation","unknown","invalid"]},"leaves":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"kind":{"type":"string","enum":["license","reference","unknown"]},"plus":{"type":"boolean"},"exception":{"type":"string"},"osiApproved":{"type":"boolean"},"fsfLibre":{"type":"boolean"},"deprecated":{"type":"boolean"},"verdict":{"type":"string","enum":["ok","violation","unknown"]},"reasons":{"type":"array","items":{"type":"string"}}}}},"satisfiedBy":{"type":"array","items":{"type":"string"}}}}},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"outputSchema":{"type":"object","properties":{"data":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"results":{"type":"array","items":{"type":"object","properties":{"index":{"type":"integer"},"expression":{"type":"string"},"valid":{"type":"boolean"},"canonical":{"type":"string"},"verdict":{"type":"string","enum":["ok","violation","unknown","invalid"]},"leaves":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"kind":{"type":"string","enum":["license","reference","unknown"]},"plus":{"type":"boolean"},"exception":{"type":"string"},"osiApproved":{"type":"boolean"},"fsfLibre":{"type":"boolean"},"deprecated":{"type":"boolean"},"verdict":{"type":"string","enum":["ok","violation","unknown"]},"reasons":{"type":"array","items":{"type":"string"}}}}},"satisfiedBy":{"type":"array","items":{"type":"string"}}}}},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]},"example":{"expressions":["MIT OR (GPL-3.0-only WITH GCC-exception-3.1)","Apache-2.0 AND LicenseRef-Internal"],"allow":["MIT","Apache-2.0"],"allowLicenseRefs":["LicenseRef-Internal"]},"openapiOperation":{"operationId":"spdx_policy","summary":"SPDX license expression parse and policy check","description":"Parses up to 50 SPDX license expressions (AND, OR, WITH exceptions, + or-later, LicenseRef) and evaluates each against a caller policy (allow list, deny list, allowed exceptions, OSI/FSF flags, copyleft tier) for agents vetting dependency licenses. Returns the canonical expression, per-license flags from the pinned SPDX License List, the verdict, and which licenses satisfy an OR. Does not detect licenses from source text, read package manifests or give legal advice; copyleft tiers are an id-family heuristic, not an SPDX attribute.\n\nPrice: 0.005 USDC on Base (x402).","x-x402-price-usdc":"0.005","x-x402-amount":"5000","x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.005"}},"x-audience":"developer","x-sample-url":"https://agents.writerslogic.com/api/v1/samples/spdx-policy","security":[{"x402":[]},{"apiKey":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["expressions"],"properties":{"expressions":{"type":"array","minItems":1,"maxItems":50,"items":{"type":"string","maxLength":500},"description":"SPDX expressions, e.g. 'MIT OR (GPL-2.0-only WITH Classpath-exception-2.0)'."},"allow":{"type":"array","maxItems":200,"items":{"type":"string","maxLength":100},"description":"If non-empty, only these SPDX ids pass (GPL-2.0-only and GPL-2.0 are the same entry; GPL-2.0+ means or-later and must be listed as such)."},"deny":{"type":"array","maxItems":200,"items":{"type":"string","maxLength":100},"description":"SPDX ids that always fail."},"allowExceptions":{"type":"array","maxItems":100,"items":{"type":"string","maxLength":100},"description":"If non-empty, only these WITH exception ids pass."},"allowLicenseRefs":{"type":"array","maxItems":100,"items":{"type":"string","maxLength":100},"description":"LicenseRef-* ids the caller has reviewed; other refs yield unknown."},"requireOsiApproved":{"type":"boolean","description":"Fail licenses without isOsiApproved in the SPDX list."},"requireFsfLibre":{"type":"boolean","description":"Fail licenses without isFsfLibre in the SPDX list."},"allowDeprecated":{"type":"boolean","description":"Default true: deprecated ids only add a witness. false: they fail."},"denyCopyleft":{"type":"string","enum":["none","strong","any"],"description":"Id-family heuristic: strong = GPL/AGPL/SSPL/EUPL/OSL/CC-BY-SA; any adds LGPL/MPL/EPL/CDDL and similar."}}},"example":{"expressions":["MIT OR (GPL-3.0-only WITH GCC-exception-3.1)","Apache-2.0 AND LicenseRef-Internal"],"allow":["MIT","Apache-2.0"],"allowLicenseRefs":["LicenseRef-Internal"]}}}},"responses":{"200":{"description":"Paid result with provenance","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"results":{"type":"array","items":{"type":"object","properties":{"index":{"type":"integer"},"expression":{"type":"string"},"valid":{"type":"boolean"},"canonical":{"type":"string"},"verdict":{"type":"string","enum":["ok","violation","unknown","invalid"]},"leaves":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"kind":{"type":"string","enum":["license","reference","unknown"]},"plus":{"type":"boolean"},"exception":{"type":"string"},"osiApproved":{"type":"boolean"},"fsfLibre":{"type":"boolean"},"deprecated":{"type":"boolean"},"verdict":{"type":"string","enum":["ok","violation","unknown"]},"reasons":{"type":"array","items":{"type":"string"}}}}},"satisfiedBy":{"type":"array","items":{"type":"string"}}}}},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]}}}},"400":{"description":"Invalid request (no payment consumed)","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"401":{"description":"Invalid X-API-KEY","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"402":{"description":"Payment required or invalid","content":{"application/json":{"schema":{"type":"object","description":"x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)","properties":{"x402Version":{"type":"integer"},"error":{"type":"string"},"code":{"type":"string"},"resource":{"type":"object"},"accepts":{"type":"array","items":{"type":"object"}},"extensions":{"type":"object"}}}}}},"502":{"description":"Upstream failure; the payment is released or not settled","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}}}},"links":{"docs":"https://agents.writerslogic.com/docs/spdx-policy/","docsJson":"https://agents.writerslogic.com/docs/spdx-policy.json","sample":"https://agents.writerslogic.com/api/v1/samples/spdx-policy","openapi":"https://agents.writerslogic.com/openapi.json","catalog":"https://agents.writerslogic.com/api/v1/catalog","verifyProvenance":"https://agents.writerslogic.com/api/v1/verify-provenance","index":"https://agents.writerslogic.com/docs/index.json"}}