@pipeworx/clearlydefined

Connect: https://gateway.pipeworx.io/clearlydefined/mcp · Install: one-click buttons

No MCP client? Skip the connection: POST https://gateway.pipeworx.io/v1/tools/search_packs {"query":"..."} to find a tool below, GET /v1/tools/<name> for its schema, POST the same URL with arguments for the data — see For AI agents.

Tools: 3

ClearlyDefined — the licence, copyright attribution and provenance actually found inside an open-source package, from the Linux Foundation’s curated dataset.

Tools

• clearlydefined_search(pattern, limit?, type?) — find component coordinates by name fragment across npm, Maven, PyPI, RubyGems, NuGet, crates.io, Packagist, Go and GitHub.
• clearlydefined_definition(type, provider, namespace?, name, revision, include_files?, file_limit?) — the curated record for one exact version: declared SPDX licence, every licence expression discovered in the files, the copyright holders to attribute, the upstream source repo + commit, release date, hashes, and 0-100 scores.
• clearlydefined_harvest_status(type, provider, namespace?, name, revision) — which scanners (ScanCode, Licensee, REUSE, FOSSology) analysed that revision, and at which versions — i.e. how much evidence sits behind the definition.

Auth

Keyless.

Data sources

• https://api.clearlydefined.io/definitions?pattern= — coordinate search.
• https://api.clearlydefined.io/definitions/{type}/{provider}/{namespace}/{name}/{revision} — one definition.
• https://api.clearlydefined.io/harvest/{coordinates}?form=list — harvest records.

Things the next person would otherwise rediscover

• Coordinates are five segments and the namespace is never omitted — an absent namespace is the literal -, as in npm/npmjs/-/express/4.18.2.
• ?pattern= is a prefix scan and does not always answer. Measured 2026-09-17: lodash, express and requests returned in seconds; log4j-core never returned inside 55 seconds. The pack bounds it at 30s and the error tells the caller to use exact coordinates instead. Other query shapes on /definitions (?type=&provider=&name=&sort=) answered 502.
• A definition can exist with no licence evidence at all, which is a different answer from MIT. The payload carries an explicit license_evidence: "present" | "none_found" so a null declared_license is never read as “unlicensed” by accident.
• /definitions/.../revisions is NOT a revision list — the API treats revisions as a literal version string and returns an empty definition for it.

Related packs

osv answers the vulnerability question and deps-dev the dependency question about the same components. This one answers the licence-compliance question.

Tools

• clearlydefined_search — Find ClearlyDefined component coordinates by name pattern across npm, Maven, PyPI, RubyGems, NuGet, crates.io, Packagist, Go and GitHub. Returns coordinate strings like “npm/npmjs/-/express/4.18.2” th
• clearlydefined_definition — Get the curated licence and attribution record for one exact component version from ClearlyDefined: declared SPDX licence, every licence expression discovered in the files, the copyright holders that
• clearlydefined_harvest_status — List which harvesting tools (ScanCode, Licensee, REUSE, FOSSology, clearlydefined) have analysed one exact component version, and at which tool versions. Use it to judge how much evidence sits behind