## MCP server licences, explained

Someone on your team wants to add an MCP server to a product you sell. Legal asks one question:
can we ship this? Here is how to get an answer, and where the answer runs out.

**This page is not legal advice.** It describes what licence identifiers were declared and what
our data does with them. It is not a legal opinion and it is not a substitute for reading a
licence or asking a lawyer.

### The one number that matters most

Half of the published MCP ecosystem does not tell you its licence.

Of 15,473 servers in the 2026-08-25 snapshot, 7,634 carry a licence that resolves to a real SPDX
identifier. That is 51.0 %. The other 7,339 do not.

That is not a small footnote. It means a coin flip on whether the question is even answerable
before you start reading anything.

### What "does not resolve" actually looks like

Three things, and they are all different from "unlicensed":

GitHub reports `NOASSERTION` when it finds a licence file it cannot identify. That includes
custom licences, modified templates, and files that just say "free to use, be nice". It is a
statement that GitHub does not know, not a statement that the project is permissive. The single
most-starred repository in this whole ecosystem reads `NOASSERTION`.

npm packages often carry free text where an identifier belongs. `SEE LICENSE IN LICENSE` is the
common one. It is a pointer, not a licence, and it means someone has to open the file.

And plenty of repositories simply have no licence file. That is not the loose case it looks
like: no licence file means no grant has been written down, whatever the README says about being
open source. It is a question to take to a lawyer, not one to resolve by assumption.

An absent licence is not a permissive one. If you take one thing from this page, take that.

### When it does resolve, the news is good

Of the 7,634 servers with a real identifier, the distribution is boring in the best way:

| Licence | Servers | Share of licensed |
|---|---:|---:|
| MIT | 6,274 | 82.2 % |
| Apache-2.0 | 966 | 12.7 % |
| AGPL-3.0 | 113 | 1.5 % |
| ISC | 92 | 1.2 % |
| GPL-3.0 | 49 | 0.6 % |
| everything else | 140 | 1.8 % |

96.4 % of resolved licences are permissive. MIT and Apache-2.0 together are 94.9 %. If a
licence resolves at all, it is usually a permissive one in this corpus, but you still need to
read the licence that applies to your use.

Copyleft is 2.6 %, which is 202 servers. Source-available licences, meaning BUSL, Elastic and
the PolyForm and FSL families, are 66 servers, 0.9 %.

### The three answers, and why the third one is honest

A licence identifier is a fact. Whether it permits your commercial use is a judgement. Those
are different things and they deserve different treatment.

**Yes.** MIT, Apache-2.0, BSD, ISC, MPL-2.0, 0BSD, Unlicense, CC0, Zlib and friends. MIT's own
text asks for one thing in return: that the copyright notice and the permission notice travel
with the software. Most of the others in this group ask for a variant of the same. Read the one
you have, because the ask is usually a paragraph long. This covers 7,370 servers, 49.2 % of the
whole corpus.

**No.** BUSL-1.1, Elastic-2.0, the FSL family, PolyForm Noncommercial and Shield, SSPL,
anything NonCommercial or NoDerivatives. 67 servers in the corpus. These are real restrictions
written by companies who meant them, and they vary: field-of-use limits, limits on offering the
software as a competing service, noncommercial terms, no-derivatives terms, delayed conversion
to a permissive licence after a change date. Read the actual text before you decide whether it
blocks your use.

**It depends on you, so nobody else can answer it.** The whole GPL, AGPL, LGPL and EUPL family.
Whether copyleft obligations bite depends on how you ship: an internal tool, a hosted service
that users reach over a network, a binary you distribute. AGPL in particular is triggered by
network use, which is exactly what an MCP server is for.

That third category is why our `commercial_use_ok` column is `null` on those rows rather than
`true` or `false`. Null there means read it yourself. A dataset that answered would be inventing
a fact about your deployment that it has no way of knowing.

Across the whole corpus, `commercial_use_ok` is unknown on 50.3 % of rows. That is a slightly
different set from the 49.0 % with no resolvable licence: it is those rows, plus the copyleft
rows where the licence resolved perfectly well and the answer still depends on you.

### One licence identifier that nearly went wrong

Worth telling because it is the shape of error you should look for in anyone else's data.

A server in this corpus declared `BSL-1.1`. No licence carries that identifier. Boost is
`BSL-1.0`, and the Business Source Licence is `BUSL-1.1`, so the only 1.1 in either family is
BUSL. Resolving `BSL-1.1` to Boost would have converted a restrictive non-compete licence into
a permissive one and flipped a commercial-use verdict from false to true, on a row somebody
might have shipped.

We resolved it to `BUSL-1.1` and wrote down why. The general rule we work to: an alias is
allowed only for an unambiguous misspelling, never as fuzzy matching. Everything else stays
null.

### Two licences we deliberately refuse to rule on

`MulanPSL-2.0` and `CC-BY-3.0-US` both resolve to valid identifiers in our data, and both carry
no commercial-use verdict. Not because they are restrictive, but because we have not
established the judgement and are not going to assert one for the sake of a filled cell.

Recording an identifier is a fact you can verify from upstream metadata. Asserting that a
licence permits commercial use is a judgement with consequences for whoever reads it. Where the
judgement is not established, the field stays empty.

### What this is not

None of this is legal advice, including the table above. It is a mechanical mapping of declared
identifiers against a published list, and the list is in the schema so you can check it
yourself.

Nor is a declared licence the same as a correct one. Upstream metadata is sometimes wrong,
often stale, and occasionally contradicts the LICENSE file sitting in the same repository. What
a dataset can honestly tell you is what was declared, and when it was read. The rest is a
lawyer's job.

### The data

Licence and commercial-use columns for all 15,473 servers, with the resolution rules published
in full, are in the [MCP Server Landscape 2026](/mcp-landscape/) dataset, €4 snapshot or €10/month API. The
[free 50-row sample](/mcp-landscape/sample/) carries both columns.

Before you ship anything: open the licence file.

---

Machine surfaces: [llms.txt](https://labs.lubbee.net/llms.txt) · [products.json](https://labs.lubbee.net/api/products.json) · HTML: https://labs.lubbee.net/mcp-landscape/mcp-server-licenses-explained/
Contact: venture@lubbee.net