Document Open Access Logo

Blurred Compliance Boundaries: Analyzing Open Source License Conflicts in MCP-Based Agent Workflows

Authors Xing Cui , Jingzheng Wu , Tianyue Luo , Xiang Ling

PDF

File

Thumbnail PDF
PDF
LIPIcs.ESEM.2026.33.pdf
  • Filesize: 1.1 MB
  • 20 pages

Document Identifiers

Subject Classification

ACM Subject Classification
  • Software and its engineering → Empirical software validation
Keywords
  • MCP
  • license conflict detection
  • compositional license analysis
  • large language model
  • agent compliance

Metrics

Abstract

Background. Agent systems increasingly invoke heterogeneous third-party services through the Model Context Protocol (MCP), where service licenses, model licenses, and data licenses may be jointly applied during runtime execution. This emerging execution paradigm introduces cross-service compliance conflicts that are difficult to capture with conventional license analysis methods. Existing methods usually assume that the license set under analysis is statically predetermined, making them insufficient for handling novel term semantics in MCP licenses and for analyzing conflict patterns that arise from task-specific selected service subsets. 

Aims. This paper investigates compositional license conflicts in MCP-based agent workflows. We seek to characterize how license terms interact across compositional MCP services and to provide an automated analysis framework that detects conflicts and identifies license-compatible service replacements. 

Method. We propose MCP-Licentra, a license conflict analysis framework for MCP-based agent workflows. MCP-Licentra contains four integrated components. First, it extends an existing license term taxonomy with MCP-specific categories and constructs annotated training data for domain adaptation. Second, it fine-tunes License-Llama3-8B with supervised fine-tuning (SFT) and odds ratio preference optimization (ORPO) to recognize license terms and their associated attitudes. Third, it formulates task-specific service selection as a power-set legality verification problem, enabling conflict checking across possible service invocation subsets. Fourth, it recommends license-compatible replacements for conflicting services through semantic embedding retrieval and an iterative compliance checking algorithm under joint functional similarity and license compatibility constraints. 

Results. We evaluate MCP-Licentra on 3,811 real-world MCP services and 500 compositional service scenarios. MCP-Licentra achieves F1-scores of 88.82% and 86.44% for term identification and license understanding, respectively. For group-level conflict detection, it obtains an FPR of 3.15% and an FNR of 8.77%. For compositional conflict detection, it achieves an overall FPR of 4.90% and an FNR of 3.33%. In addition, MCP-Licentra reaches a resolution success rate of 71.23%, outperforming all baselines. 

Conclusion. The results show that MCP-based agent workflows introduce compositional compliance risks that are difficult to capture with conventional static license analysis. MCP-Licentra provides an automated framework and empirical evidence for detecting and mitigating such risks in agent systems.

Cite As Get BibTex

Xing Cui, Jingzheng Wu, Tianyue Luo, and Xiang Ling. Blurred Compliance Boundaries: Analyzing Open Source License Conflicts in MCP-Based Agent Workflows. In 20th International Symposium on Empirical Software Engineering and Measurement (ESEM 2026). Leibniz International Proceedings in Informatics (LIPIcs), Volume 394, pp. 33:1-33:20, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2026) https://doi.org/10.4230/LIPIcs.ESEM.2026.33

Author Details

Xing Cui
  • Institute of Software, Chinese Academy of Sciences, Beijing, China
  • University of Chinese Academy of Sciences, Beijing, China
Jingzheng Wu
  • Institute of Software, Chinese Academy of Sciences, Beijing, China
Tianyue Luo
  • Institute of Software, Chinese Academy of Sciences, Beijing, China
Xiang Ling
  • Institute of Software, Chinese Academy of Sciences, Beijing, China

Funding

This work is supported by the National Key R&D Program of China No. 2024YFB3108000, the Beijing Nova Program No. 202604841307, and the YuanTu Large Research Infrastructure.

References

  1. AboutCode Project. ScanCode - Open Source Code Scanning Engine. https://aboutcode.org/scancode/, 2024. Accessed: May 16, 2026.
  2. Anthropic. Claude 3.5 Sonnet. https://www.anthropic.com/news/claude-3-5-sonnet, 2024. Accessed: May 16, 2026.
  3. Steven Bird. Nltk: the natural language toolkit. In Proceedings of the COLING/ACL 2006 interactive presentation sessions, pages 69-72, 2006. Google Scholar
  4. Xing Cui, Jingzheng Wu, Xiang Ling, Tianyue Luo, Mutian Yang, and Wenxiang Ou. Exploring large language models for analyzing open source license conflicts: How far are we? In 2025 IEEE/ACM 47th International Conference on Software Engineering: Companion Proceedings (ICSE-Companion), pages 291-302. IEEE, 2025. URL: https://doi.org/10.1109/ICSE-COMPANION66252.2025.00083.
  5. Xing Cui, Jingzheng Wu, Yanjun Wu, Xu Wang, Tianyue Luo, Sheng Qu, Xiang Ling, and Mutian Yang. An empirical study of license conflict in free and open source software. In 2023 IEEE/ACM 45th International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP), pages 495-505. IEEE, 2023. URL: https://doi.org/10.1109/ICSE-SEIP58684.2023.00050.
  6. DeepSeek-AI. DeepSeek-R1. https://huggingface.co/deepseek-ai/DeepSeek-R1, 2025. Accessed: May 16, 2026.
  7. Herman Errico, Jiquan Ngiam, and Shanita Sojan. Securing the model context protocol (mcp): Risks, controls, and governance. arXiv preprint, 2025. URL: https://doi.org/10.48550/arXiv.2511.20920.
  8. FOSSology Project. FOSSology - Open Source License Compliance Software. https://www.fossology.org/, 2024. Accessed: May 16, 2026.
  9. GR Gangadharan, Vincenzo D’Andrea, Stefano De Paoli, and Michael Weiss. Managing license compliance in free and open source software development. Information Systems Frontiers, 14(2):143-154, 2012. URL: https://doi.org/10.1007/S10796-009-9180-1.
  10. Daniel M German, Yuki Manabe, and Katsuro Inoue. A sentence-matching method for automatic license identification of source code files. In Proceedings of the 25th IEEE/ACM International Conference on Automated Software Engineering, pages 437-446, 2010. Google Scholar
  11. Wael H Gomaa, Aly A Fahmy, et al. A survey of text similarity approaches. international journal of Computer Applications, 68(13):13-18, 2013. Google Scholar
  12. Hechuan Guo, Yongle Hao, Yue Zhang, Minghui Xu, Peizhuo Lv, Jiezhi Chen, and Xiuzhen Cheng. A measurement study of model context protocol ecosystem. arXiv preprint, 2025. URL: https://arxiv.org/abs/2509.25292.
  13. Yongjian Guo, Puzhuo Liu, Wanlun Ma, Zehang Deng, Xiaogang Zhu, Peng Di, Xi Xiao, and Sheng Wen. Systematic analysis of mcp security. arXiv preprint, 2025. URL: https://doi.org/10.48550/arXiv.2508.12538.
  14. Zikang Guo, Benfeng Xu, Chiwei Zhu, Wentao Hong, Xiaorui Wang, and Zhendong Mao. Mcp-agentbench: Evaluating real-world language agent performance with mcp-mediated tools. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 40(37), pages 30888-30896, 2026. URL: https://doi.org/10.1609/AAAI.V40I37.40347.
  15. Jiwoo Hong, Noah Lee, and James Thorne. Orpo: Monolithic preference optimization without reference model. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 11170-11189, 2024. URL: https://doi.org/10.18653/V1/2024.EMNLP-MAIN.626.
  16. Xinyi Hou, Yanjie Zhao, Shenao Wang, and Haoyu Wang. Model context protocol (mcp): Landscape, security threats, and future research directions. ACM Transactions on Software Engineering and Methodology, 2025. Google Scholar
  17. Huihao Jing, Haoran Li, Wenbin Hu, Qi Hu, Xu Heli, Tianshu Chu, Peizhao Hu, and Yangqiu Song. Mcip: Protecting mcp safety via model contextual integrity protocol. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 1177-1194, 2025. URL: https://doi.org/10.18653/V1/2025.EMNLP-MAIN.62.
  18. Georgia M Kapitsaki, Frederik Kramer, and Nikolaos D Tselikas. Automating the license compatibility process in open source software with spdx. Journal of systems and software, 131:386-401, 2017. URL: https://doi.org/10.1016/J.JSS.2016.06.064.
  19. Georgia M Kapitsaki and Demetris Paschalides. Identifying terms in open source software license texts. In 2017 24th Asia-Pacific Software Engineering Conference (APSEC), pages 540-545. IEEE, 2017. URL: https://doi.org/10.1109/APSEC.2017.62.
  20. Yuan Li, Zhengzhong Liu, and Eric Xing. Data mixing optimization for supervised fine-tuning of large language models. arXiv preprint, 2025. URL: https://doi.org/10.48550/arXiv.2508.11953.
  21. Pengfei Liu, Weizhe Yuan, Jinlan Fu, Zhengbao Jiang, Hiroaki Hayashi, and Graham Neubig. Pre-train, prompt, and predict: A systematic survey of prompting methods in natural language processing. ACM computing surveys, 55(9):1-35, 2023. URL: https://doi.org/10.1145/3560815.
  22. Ziang Liu, Xin Liu, Yingli Zhang, Song Li, Weina Niu, Qingguo Zhou, Rui Zhou, and Xiaokang Zhou. Towards a comprehensive framework for verifying open-source software license compatibility. Empirical Software Engineering, 31(1):15, 2026. URL: https://doi.org/10.1007/S10664-025-10751-W.
  23. Meta AI. Llama-4-Scout-17B-16E. https://huggingface.co/meta-llama/Llama-4-Scout-17B-16E, 2025. Accessed: May 16, 2026.
  24. Grigoris Ntousakis, Julian James Stephen, Michael V Le, Sai Sree Laya Chukkapalli, Teryl Taylor, Ian M Molloy, and Frederico Araujo. Securing mcp-based agent workflows. In Proceedings of the 4th Workshop on Practical Adoption Challenges of ML for Systems, pages 50-55, 2025. URL: https://doi.org/10.1145/3766882.3767177.
  25. Open Source Initiative. Open Source Initiative (OSI). https://opensource.org/, 2024. Accessed: May 16, 2026.
  26. OpenAI. GPT-4.5. https://openai.com/index/gpt-4-5-system-card/, 2025. Accessed: May 16, 2026.
  27. Demetris Paschalides and Georgia M Kapitsaki. Validate your spdx files for open source license violations. In Proceedings of the 2016 24th ACM SIGSOFT international symposium on foundations of software engineering, pages 1047-1051, 2016. URL: https://doi.org/10.1145/2950290.2983939.
  28. PulseMCP. Filesystem MCP Server. https://www.pulsemcp.com/servers/quarkiverse-filesystem, 2025. Accessed: May 16, 2026.
  29. PulseMCP. GitHub Projects MCP Server. https://www.pulsemcp.com/servers/taylor-lindores-reeves-github-projects, 2025. Accessed: May 16, 2026.
  30. PulseMCP. MCP Server Directory. https://www.pulsemcp.com/servers, 2025. Accessed: May 16, 2026.
  31. PulseMCP. Notion MCP Server. https://www.pulsemcp.com/servers/notion, 2025. Accessed: May 16, 2026.
  32. PulseMCP. Todoist MCP Server. https://www.pulsemcp.com/servers/todoist, 2025. Accessed: Mar 16, 2026.
  33. Shi Qiu, Daniel M German, and Katsuro Inoue. Empirical study on dependency-related license violation in the javascript package ecosystem. Journal of Information Processing, 29:296-304, 2021. URL: https://doi.org/10.2197/IPSJJIP.29.296.
  34. Qwen Team. Qwen3-32B. https://huggingface.co/Qwen/Qwen3-32B, 2025. Accessed: May 16, 2026.
  35. Brandon Radosevich and John Halloran. Mcp safety audit: Llms with the model context protocol allow major security exploits. arXiv preprint, 2025. URL: https://doi.org/10.48550/arXiv.2504.03767.
  36. RAIL Initiative. Responsible AI Licenses (RAIL). https://www.licenses.ai/, 2024. Accessed: May 16, 2026.
  37. Partha Pratim Ray. A survey on model context protocol: Architecture, state-of-the-art, challenges and future directions. Authorea Preprints, 2025. Google Scholar
  38. Lawrence Rosen. Open source licensing: Software freedom and intellectual property law.(2004). Google Scholar
  39. SPDX Project. Software Package Data Exchange (SPDX). https://spdx.dev/, 2024. Accessed: May 16, 2026.
  40. TLDRLegal. TLDRLegal - Software Licenses Explained in Plain English. https://www.tldrlegal.com/, 2024. Accessed: May 16, 2026.
  41. Sihan Xu, Ya Gao, Lingling Fan, Linyu Li, Xiangrui Cai, and Zheli Liu. Liresolver: License incompatibility resolution for open source software. In Proceedings of the 32nd ACM SIGSOFT international symposium on software testing and analysis, pages 652-663, 2023. URL: https://doi.org/10.1145/3597926.3598085.
  42. Sihan Xu, Ya Gao, Lingling Fan, Zheli Liu, Yang Liu, and Hua Ji. Lidetector: License incompatibility detection for open source software. ACM Transactions on Software Engineering and Methodology, 32(1):1-28, 2023. URL: https://doi.org/10.1145/3518994.
  43. Weiwei Xu, Hao He, Kai Gao, and Minghui Zhou. Understanding and remediating open-source license incompatibilities in the pypi ecosystem. In 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE), pages 178-190. IEEE, 2023. URL: https://doi.org/10.1109/ASE56229.2023.00175.
  44. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, et al. Qwen3 technical report. arXiv preprint, 2025. URL: https://arxiv.org/abs/2505.09388.
  45. Yanzhao Zhang, Mingxin Li, Dingkun Long, Xin Zhang, Huan Lin, Baosong Yang, Pengjun Xie, An Yang, Dayiheng Liu, Junyang Lin, Fei Huang, and Jingren Zhou. Qwen3 Embedding: Advancing Text Embedding and Reranking Through Foundation Models. arXiv preprint, 2025. URL: https://doi.org/10.48550/arXiv.2506.05176.
Any Issues?
X

Feedback on the Current Page

CAPTCHA

Thanks for your feedback!

Feedback submitted to Dagstuhl Publishing

Could not send message

Please try again later or send an E-mail
© 2023-2026 Schloss Dagstuhl – LZI GmbH Schloss Dagstuhl – LZI GmbH About DROPS Imprint Privacy Contact