# SEMCL.ONE MCP server

> Provides LLMs with software composition analysis capabilities including license compliance, binary analysis, and vulnerability assessment.

- Repository: https://github.com/SemClone/mcp-semclone
- Page: https://hostedmcp.org/servers/semclone/mcp-semclone
- Transport: —
- Stars: 2
- License: Apache-2.0

## Environment variables

| Name | Required | Secret | Description |
|---|---|---|---|
| `BINARYSNIFFER_PATH` | no | no |  |
| `GITHUB_TOKEN` | no | no |  |
| `NVD_API_KEY` | no | no |  |
| `OSPAC_PATH` | no | no |  |
| `OSSLILI_PATH` | no | no |  |
| `PURL2NOTICES_PATH` | no | no |  |
| `UPMEX_PATH` | no | no |  |
| `VULNQ_PATH` | no | no |  |

## Tools (14)

- `scan_directory`
- `scan_binary`
- `check_package`
- `download_and_scan_package`
- `generate_legal_notices`
- `generate_legal_notices_from_purls`
- `generate_sbom`
- `validate_policy`
- `validate_license_list`
- `get_license_obligations`
- `check_license_compatibility`
- `get_license_details`
- `analyze_commercial_risk`
- `run_compliance_check`

## FAQ

### What kind of binaries can be analyzed?

The server can analyze compiled binaries including APK, EXE, DLL, SO, and JAR files for OSS components and licenses.

### Can it generate an SBOM?

Yes, it can generate a Software Bill of Materials in the CycloneDX format.

### How do I install the server?

You can install it using a single command: `pip install mcp-semclone`.

### Does it support policy validation?

Yes, it allows you to validate licenses against organizational policies and check license compatibility.