SPDX license expression parse and policy check

$0.005 USDC per call · Developer and security · POST /api/v1/spdx-policy · Id spdx-policy

Parses up to 50 SPDX license expressions (AND, OR, WITH exceptions, + or-later, LicenseRef) and evaluates each against a caller policy (allow list, deny list, allowed exceptions, OSI/FSF flags, copyleft tier) for agents vetting dependency licenses. Returns the canonical expression, per-license flags from the pinned SPDX License List, the verdict, and which licenses satisfy an OR. Does not detect licenses from source text, read package manifests or give legal advice; copyleft tiers are an id-family heuristic, not an SPDX attribute.

What you get

A bad license slips into a release when the agent only string-matches a license field.

Call it

Send the JSON body below to https://agents.writerslogic.com/api/v1/spdx-policy. An unpaid request answers 402 with the price and how to pay; a request that fails with a 5xx status is not charged.

curl -i -X POST https://agents.writerslogic.com/api/v1/spdx-policy \
  -H 'content-type: application/json' \
  -d '{"expressions":["MIT OR (GPL-3.0-only WITH GCC-exception-3.1)","Apache-2.0 AND LicenseRef-Internal"],"allow":["MIT","Apache-2.0"],"allowLicenseRefs":["LicenseRef-Internal"]}'

Input

Field	Type	Required	Description
`expressions`	array<string; length 0..500>; max 50 items	yes	SPDX expressions, e.g. 'MIT OR (GPL-2.0-only WITH Classpath-exception-2.0)'.
`allow`	array<string; length 0..100>; max 200 items	no	If non-empty, only these SPDX ids pass (GPL-2.0-only and GPL-2.0 are the same entry; GPL-2.0+ means or-later and must be listed as such).
`deny`	array<string; length 0..100>; max 200 items	no	SPDX ids that always fail.
`allowExceptions`	array<string; length 0..100>; max 100 items	no	If non-empty, only these WITH exception ids pass.
`allowLicenseRefs`	array<string; length 0..100>; max 100 items	no	LicenseRef-* ids the caller has reviewed; other refs yield unknown.
`requireOsiApproved`	boolean	no	Fail licenses without isOsiApproved in the SPDX list.
`requireFsfLibre`	boolean	no	Fail licenses without isFsfLibre in the SPDX list.
`allowDeprecated`	boolean	no	Default true: deprecated ids only add a witness. false: they fail.
`denyCopyleft`	string; one of "none", "strong", "any"	no	Id-family heuristic: strong = GPL/AGPL/SSPL/EUPL/OSL/CC-BY-SA; any adds LGPL/MPL/EPL/CDDL and similar.

Example request body

{
  "expressions": [
    "MIT OR (GPL-3.0-only WITH GCC-exception-3.1)",
    "Apache-2.0 AND LicenseRef-Internal"
  ],
  "allow": [
    "MIT",
    "Apache-2.0"
  ],
  "allowLicenseRefs": [
    "LicenseRef-Internal"
  ]
}

Result

The response is { "data": ..., "_provenance": ... }. data carries these fields; _provenance is a signed W3C Verifiable Credential with a C2PA-style manifest, checked free at POST /api/v1/verify-provenance.

Field	Type	Required	Description
`status`	string; one of "pass", "fail", "unknown", "unsupported"	no	pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass.
`results`	array<object>	no
`witnesses`	array<object>	no
`versions`	object	no	Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile).
`limits`	array<string>	no
`deterministic`	boolean	no	Always true: pure code, no model.

Pay and connect

Available through: x402 (USDC on Base), MCP. MCP clients reach it through the code-preflight-kit package.

Machine-readable

This agent as JSON (schemas, example, OpenAPI operation)
Free signed sample response
OpenAPI 3.1 · Catalog · Index of every agent