How licensing works
Every component JustClaw-It serves was written by someone else and published under a licence. This page explains how we find that licence, which licences get through, what we attach to every result, and what remains your job. For the field-by-field reference, see Licences & attribution.
1. We record each repository's licence
An automated licence check reads every source repository's licence and records its SPDX identifier, for example MIT or Apache-2.0, together with the licence class below. The check runs again every month, so a repository that changes its licence is re-classified.
Some repositories don't produce a usable licence, and each of these counts as "not cleared":
- No licence at all. Without a licence, the code is all rights reserved: you have no right to copy it.
- A licence that can't be identified: a licence file exists but doesn't match a known licence.
- Not checked yet. A repository without a licence record is left out, not let in.
2. Each licence falls into a class
| class | examples | served? |
|---|---|---|
| permissive | MIT, BSD-2-Clause, BSD-3-Clause, Apache-2.0, ISC, 0BSD, Unlicense, CC0-1.0, Zlib, BSL-1.0 | yes |
| weak copyleft | MPL-2.0, LGPL-2.1, LGPL-3.0, EPL-2.0, CDDL-1.0 | yes, flagged |
| strong copyleft | GPL, AGPL, SSPL, OSL, EUPL | no |
| no licence | (none) | no |
| unknown | unidentified licence, not yet checked | no |
-only and -or-later variants (for example LGPL-2.1-or-later) belong to the same class as their base licence. An identifier we don't recognise is never guessed into a better class: it stays unknown and is left out.
3. The public library only reads cleared code
The gate sits in the database, not in the app. The public service's database account has no read access to the component tables. It can only call a handful of read functions, and those read through a view that contains permissive and weak-copyleft components only. A bug in the app therefore can't return a component from a strong-copyleft, unlicensed or unknown repository, because the app has no way to see one. Asking for such a component by id returns "not available".
Our own private and client projects are never part of the public library, whatever their licence.
4. Every result carries its licence
Search results and pulled source carry:
license: the SPDX identifier, for exampleMITlicense_kind:permissiveorweak-copyleftattribution: the source repository, the copyright holder where it could be read, a copyleft flag, and a ready-made attribution linesource_url: a GitHub permalink to the file
When your agent calls get_component, the source starts with a comment block in the file's own comment style (//, #, --, /* */ or <!-- -->). It carries the attribution line and "Provided via justclaw.it.com; keep this notice with the code." For a weak-copyleft file it adds one more line: modifications to this file must remain under its licence.
5. You choose how strict to be
search_components takes a license filter:
| value | returns |
|---|---|
any (default) | everything the public library serves: permissive and weak copyleft |
permissive | MIT, BSD, Apache, ISC and the rest of the permissive class only |
commercial-safe | permissive and weak copyleft |
open-source | any open-source licence; on the public library that is the same as any |
Shipping a closed-source product and want no file-level obligations at all? Use license: "permissive".
6. What stays your job
We do the checking and labelling; you stay responsible for compliance in what you ship (see the terms). In practice:
- Keep the header in every file that contains pulled code, even after you change it.
- Ship the licence notices. The MIT licence requires its copyright and permission notice in "all copies or substantial portions of the Software". Apache-2.0 (section 4(b) and 4(d)) also asks you to keep any NOTICE file and mark files you changed. A
THIRD_PARTY_LICENSESfile listing each component, its repository, licence and copyright holder covers this;list_licensesand /licenses give you the list for the whole library. - Weak copyleft is file-level. Under MPL-2.0, changes to an MPL-licensed file must stay under the MPL, but section 3.3 lets you distribute a "Larger Work" that combines that file with other code under terms of your choice, including proprietary code. Keep such files separate and unmodified where you can.
- Check anything important yourself. Licence data comes from automated detection, and a repository's licence can change after we check it.
The justclaw-it-pull skill does steps 1 and 2 for your agent.
Wrong licence or want your code removed?
Email mike+mcpsupport@two7.design with the repository URL. We review takedown and correction requests promptly.
Sources: SPDX identifiers are listed at spdx.org/licenses. Licence obligations are taken from the licence texts linked above, checked on 1 November 2026. This page describes how JustClaw-It works; it is not legal advice.