MCP server licences, explained

Someone on your team wants to add an MCP server to a product you sell. Legal asks one question: can we ship this? Here is how to get an answer, and where the answer runs out.

This page is not legal advice. It describes what licence identifiers were declared and what our data does with them. It is not a legal opinion and it is not a substitute for reading a licence or asking a lawyer.

The one number that matters most

Half of the published MCP ecosystem does not tell you its licence.

Of 15,473 servers in the 2026-08-25 snapshot, 7,634 carry a licence that resolves to a real SPDX identifier. That is 51.0 %. The other 7,339 do not.

That is not a small footnote. It means a coin flip on whether the question is even answerable before you start reading anything.

What "does not resolve" actually looks like

Three things, and they are all different from "unlicensed":

GitHub reports NOASSERTION when it finds a licence file it cannot identify. That includes custom licences, modified templates, and files that just say "free to use, be nice". It is a statement that GitHub does not know, not a statement that the project is permissive. The single most-starred repository in this whole ecosystem reads NOASSERTION.

npm packages often carry free text where an identifier belongs. SEE LICENSE IN LICENSE is the common one. It is a pointer, not a licence, and it means someone has to open the file.

And plenty of repositories simply have no licence file. That is not the loose case it looks like: no licence file means no grant has been written down, whatever the README says about being open source. It is a question to take to a lawyer, not one to resolve by assumption.

An absent licence is not a permissive one. If you take one thing from this page, take that.

When it does resolve, the news is good

Of the 7,634 servers with a real identifier, the distribution is boring in the best way:

96.4 % of resolved licences are permissive. MIT and Apache-2.0 together are 94.9 %. If a licence resolves at all, it is usually a permissive one in this corpus, but you still need to read the licence that applies to your use.

Copyleft is 2.6 %, which is 202 servers. Source-available licences, meaning BUSL, Elastic and the PolyForm and FSL families, are 66 servers, 0.9 %.

The three answers, and why the third one is honest

A licence identifier is a fact. Whether it permits your commercial use is a judgement. Those are different things and they deserve different treatment.

Yes. MIT, Apache-2.0, BSD, ISC, MPL-2.0, 0BSD, Unlicense, CC0, Zlib and friends. MIT's own text asks for one thing in return: that the copyright notice and the permission notice travel with the software. Most of the others in this group ask for a variant of the same. Read the one you have, because the ask is usually a paragraph long. This covers 7,370 servers, 49.2 % of the whole corpus.

No. BUSL-1.1, Elastic-2.0, the FSL family, PolyForm Noncommercial and Shield, SSPL, anything NonCommercial or NoDerivatives. 67 servers in the corpus. These are real restrictions written by companies who meant them, and they vary: field-of-use limits, limits on offering the software as a competing service, noncommercial terms, no-derivatives terms, delayed conversion to a permissive licence after a change date. Read the actual text before you decide whether it blocks your use.

It depends on you, so nobody else can answer it. The whole GPL, AGPL, LGPL and EUPL family. Whether copyleft obligations bite depends on how you ship: an internal tool, a hosted service that users reach over a network, a binary you distribute. AGPL in particular is triggered by network use, which is exactly what an MCP server is for.

That third category is why our commercial_use_ok column is null on those rows rather than true or false. Null there means read it yourself. A dataset that answered would be inventing a fact about your deployment that it has no way of knowing.

Across the whole corpus, commercial_use_ok is unknown on 50.3 % of rows. That is a slightly different set from the 49.0 % with no resolvable licence: it is those rows, plus the copyleft rows where the licence resolved perfectly well and the answer still depends on you.

One licence identifier that nearly went wrong

Worth telling because it is the shape of error you should look for in anyone else's data.

A server in this corpus declared BSL-1.1. No licence carries that identifier. Boost is BSL-1.0, and the Business Source Licence is BUSL-1.1, so the only 1.1 in either family is BUSL. Resolving BSL-1.1 to Boost would have converted a restrictive non-compete licence into a permissive one and flipped a commercial-use verdict from false to true, on a row somebody might have shipped.

We resolved it to BUSL-1.1 and wrote down why. The general rule we work to: an alias is allowed only for an unambiguous misspelling, never as fuzzy matching. Everything else stays null.

Two licences we deliberately refuse to rule on

MulanPSL-2.0 and CC-BY-3.0-US both resolve to valid identifiers in our data, and both carry no commercial-use verdict. Not because they are restrictive, but because we have not established the judgement and are not going to assert one for the sake of a filled cell.

Recording an identifier is a fact you can verify from upstream metadata. Asserting that a licence permits commercial use is a judgement with consequences for whoever reads it. Where the judgement is not established, the field stays empty.

What this is not

None of this is legal advice, including the table above. It is a mechanical mapping of declared identifiers against a published list, and the list is in the schema so you can check it yourself.

Nor is a declared licence the same as a correct one. Upstream metadata is sometimes wrong, often stale, and occasionally contradicts the LICENSE file sitting in the same repository. What a dataset can honestly tell you is what was declared, and when it was read. The rest is a lawyer's job.

The data

Licence and commercial-use columns for all 15,473 servers, with the resolution rules published in full, are in the MCP Server Landscape 2026 dataset, €4 snapshot or €10/month API. The free 50-row sample carries both columns.

Before you ship anything: open the licence file.