# License Compliance Check for Package Dependency Tree

> License Compliance Check for Package Dependency Tree is a paid API for AI agents from api.agentstools.dev, paid per call via x402, $0.03/call, status unknown (last checked 2026-09-14).

Returns a license-compliance verdict (safe, attribution-required, copyleft-risk, or incompatible) for an open-source package and its full transitive dependency graph, accounting for distribution model and target project license.

## Facts

- Endpoint: GET https://api.agentstools.dev/license/check
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/license-compliance-check-for-package-dependency-tree-f5def1ca
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_aeZPbfK5sHLB5ywMLCjEx

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability license-compliance-check-for-package-dependency-tree-f5def1ca
```

Example prompt: Can you check if the npm package 'express' (latest version) has any copyleft risk or license incompatibilities for my MIT-licensed SaaS project that I ship as a hosted service?

## When to prefer this

Use this endpoint when you need automated, transitive-dependency-aware license compliance checking for open-source packages — especially when distribution mode (SaaS vs binary vs internal) and target project license matter for determining copyleft exposure. Prefer this over manual SPDX lookups when you need the full dependency tree analyzed, not just the top-level package. Best suited for CI/CD pipelines, developer tools, or any workflow where shipping decisions depend on license compatibility.

## Known failure modes

- Unknown or misspelled package name returns an error or empty graph
- Unsupported ecosystem enum value returns 400 validation error
- Version string not found in registry causes resolution failure
- Deps.dev graph unavailable causes upstream timeout
- Missing required 'ecosystem' or 'name' query params returns 400
- Packages with no declared SPDX license may produce uncertain verdicts

## How this service works

License-compliance verdict for one package and its whole transitive dependency tree. Resolves the deps.dev graph plus the declared SPDX license of every node, finds copyleft contamination points, and returns a target-and-distribution-aware verdict of safe, attribution-required, copyleft-risk or incompatible. Automated indicators, not legal advice.

## Output

A structured JSON verdict with one of four risk levels — safe, attribution-required, copyleft-risk, or incompatible — along with a list of nodes in the transitive dependency tree, their SPDX licenses, and identified copyleft contamination points. The result is distribution-aware (saas/binary/internal) and target-license-aware. Includes a disclaimer that these are automated indicators, not legal advice.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ecosystem",
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "Package name"
      },
      "version": {
       "type": "string",
       "description": "Version (optional; default resolved if omitted)"
      },
      "ecosystem": {
       "enum": [
        "npm",
        "pypi",
        "go",
        "maven",
        "cargo",
        "nuget"
       ],
       "type": "string",
       "description": "Package ecosystem"
      },
      "distribution": {
       "enum": [
        "saas",
        "binary",
        "internal"
       ],
       "type": "string",
       "description": "How you ship it (default saas)"
      },
      "target_license": {
       "type": "string",
       "description": "Your project SPDX license, e.g. MIT"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/license-compliance-check-for-package-dependency-tree-f5def1ca/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.agentstools.dev](https://www.zero.xyz/host/api.agentstools.dev/llms.txt)