{"id":"agent-license-policy-check","card_id":"card_agent_license_policy_check","name":"Agent license policy check","description":"Classifies supplied dependency licenses into PASS/REVIEW/BLOCK buckets using SPDX-style identifiers.","stage":1,"safety_level":"data_only_read_only","auth":{"type":"hmac-sha256","required_headers":["x-apex-tool-timestamp","x-apex-tool-nonce","x-apex-tool-content-sha256","x-apex-tool-signature"],"canonical_payload":"APEX-TOOL-V1\\n{tool_id}\\n{timestamp}\\n{nonce}\\n{sha256(canonical_json(body))}"},"permissionless":{"enabled":true,"tier":"bounded_public","rate_limit":"Shared 20 calls per IP per hour across permissionless bounded tools plus global agent-write protection","review_required":false,"note":"Anonymous bounded execution is allowed because this classifies caller-supplied SPDX-style license strings against an embedded policy table (max 500 items). No registry lookups, no network, and it never releases source, keys, orders, wallets, private balances, or raw datasets."},"input_schema":{"type":"object","properties":{"licenses":{"type":"array"},"dependencies":{"type":"array"}}},"output_schema":{"type":"object","properties":{"decision":{"type":"string"},"items":{"type":"array"}}},"sample_input":{"dependencies":[{"name":"example-lib","license":"MIT"},{"name":"copyleft-lib","license":"AGPL-3.0-only"}]},"test_vectors":[{"input":{"dependencies":[{"name":"example-lib","license":"MIT"},{"name":"copyleft-lib","license":"AGPL-3.0-only"}]},"expected":{"result":{"decision":"BLOCK","policy":"commercial_distribution"}},"match":"subset","verified_at":"2026-07-04T06:30:00.000Z"},{"input":{"dependencies":[{"name":"tiny-lib","license":"MIT"}]},"expected":{"result":{"decision":"PASS"}},"match":"subset","verified_at":"2026-07-04T06:30:00.000Z"}]}