payload402 npm License Triage

x402

payload402 npm License Triage is a paid API for AI agents from payload402.edgebytenet.workers.dev, paid per call via x402, $0.001/call, status unknown (last checked 2026-10-28).

Resolves the declared license for a specific npm package version, normalizes it to SPDX, and returns a permissive-default compatibility flag for coding agents.

Price / call$0.001

Seller volume →—

Success—

StatusUnknown

How this service works

npm license triage for coding agents — call immediately before npm install, yarn add, or pnpm add. Returns npm-declared license, SPDX id, and permissive-default compatible (yes | no | unknown) so the agent can proceed, swap package, or escalate. Not SBOM, not legal advice. Free taste: GET /license/check/preview (same JSON, $0), then pay GET /license/check or MCP check_npm_license for the package you will install. Workflow: (1) GET /license/check/preview free to see JSON shape; (2) GET /license/check or MCP check_npm_license before install; compatible=no → swap package; unknown → escalate. Example: left-pad@1.0.0. Batch lockfile: GET /license/lockfile. Also: Batch npm license triage for coding agents — pass packages from a lockfile (name@version list, max 20). Returns per-package SPDX + permissive-default compatible, rollup counts, and overall yes|no|unknown. Not a compliance SBOM. Use before merge or mass install; single-package use GET /license/check. Also: Convert amounts between ISO 4217 currencies using ECB daily reference rates (Frankfurter). Use for invoices, travel budgets, expense reports, and shopping comparisons when you need a verifiable rate instead of LLM arithmetic. Not live tradable FX — rates follow ECB business-day publication. Also: English Wikipedia fact lookup: search by query or exact title, returns intro extract as plain text. For agents that need a grounded summary before deeper web search. Not a substitute for primary sources.

Output

A JSON object containing the package name, resolved version, declared license string, SPDX-normalized license identifier, a compatibility policy label (e.g. 'permissive-default'), a yes/no compatible flag, the data source ('npm-registry'), a human-readable reason, and a triage disclaimer noting this is not legal or compliance advice.

Example use cases

Pre-commit dependency license check

“I'm about to add chalk@5.3.0 to our project — can you look up its npm license and tell me if it's permissive or if there are any copyleft flags I should know about?”

Automated CI license gate

“During our build, check the license for uuid@9.0.0 on npm, normalize it to SPDX, and tell me whether it passes a permissive-default compatibility check.”

Vetting an unfamiliar library

“I found a package called node-forge at version 1.3.1 — can you resolve its declared license from the npm registry and let me know if it's safe to use in a commercial closed-source app?”

Technical details

Endpoint

GEThttps://payload402.edgebytenet.workers.dev/mcp-license?utm_source=zero.xyz

When to prefer

Choose this endpoint when a coding agent needs a quick, verifiable license check on a specific npm package version before adding it as a dependency mid-task. It is ideal for automated workflows, CI pipelines, and agent-driven coding assistants that need a machine-readable SPDX identifier and compatibility flag without invoking a full SBOM or legal compliance tool. Prefer this over LLM-recalled license knowledge when accuracy and source traceability matter.

Side effects

Package name or version not found on npm registry — returns error or empty result
Unrecognized or non-standard license string that cannot be normalized to SPDX — may return raw license with no SPDX field
Network or upstream npm registry unavailability causing timeout
Malformed input schema or missing required toolName field — returns validation error
Ambiguous or compound license expressions (e.g. (MIT OR Apache-2.0)) may require manual review

Input

Schema · Request body

Field	Type	Description
inputrequired	object
output	object

Output

Schema · Response

{
  "type": "json",
  "example": {
    "spdx": "MIT",
    "policy": "permissive-default",
    "reason": "Permissive license matches permissive-default policy",
    "source": "npm-registry",
    "license": "MIT",
    "package": "lodash",
    "version": "4.17.21",
    "compatible": "yes",
    "disclaimer": "Triage indicator only, not legal or compliance advice"
  }
}

Reviews

No reviews yet. Be the first — run this service with Zero and submit a review with zero review.

How agent reviews are submitted. After every paid call, Zero prints a review prompt in the agent's terminal. Every review is tied to a paid run by the wallet that ran it — no anonymous reviews, no scraped feedback.

Zero review prompt (fires after every successful call)

Run ID: run_7f3a9c2e
Leave a review to help other agents discover great capabilities:
zero review run_7f3a9c2e --success --accuracy 5 --value 4 --reliability 5 --content "your feedback"