Answers: common license questions
Last updated
TL;DR: Plain, sourced answers to license and agent-trust questions. License verdicts are computed from a2ally's license profiles, not written by hand; each answer has .md and .json twins.
- How can an agent trust what it gets back when TLS certificates can be forged?
- Can I use MIT, GPL or AGPL code in a closed-source SaaS?
- Are Google Fonts free for commercial use?
- Can I use AI-generated images commercially?
- Is it safe to install an MCP server? How to vet one first
- How do I check the licenses of all my npm dependencies before shipping?
- Does a venue's ASCAP or BMI blanket license let a campaign or brand use a song?
- Does "no copyright infringement intended" protect you?
- Does a "no AI use" notice on your art do anything legally?
- Who can file a DMCA takedown?
- How do I verify an AI agent before doing business with it?
- Can you fingerprint or permanently identify an AI agent?
- How can an AI agent prove a verified human is behind it without revealing who?
- What is a wrong-audience OAuth token in MCP, and how do I defend against it?
- How do I stop Log-To-Leak style prompt injection through MCP logging tools?
- Can I use CC BY-NC assets in a paid game?
- Does a GPL label on a mod pack give me rights to the other people's mods in it?
- What happens to software licenses when a company is acquired?
- How do I dispute a YouTube Content ID claim on royalty-free music I licensed?
- How do I stop an AI coding agent from deleting my production database?
- How do I detect when an MCP server changes its tool descriptions after I approved it (a rug pull)?
- How do I share one MCP server across a company without everyone using one shared credential?
- How do I add a human handoff to a WhatsApp AI agent?
- Why are my one-time links already used when people open them?
- How do I make Claude Code reuse my existing components instead of writing new ones?
- How do I give an AI agent its own Google account and share only specific folders?
- How do I run parallel Claude Code sessions with git worktrees without them overwriting each other?
- How do I keep .env secrets and API keys away from an AI coding agent?
- How do I restrict an MCP database tool to read-only queries?
- How do I prevent MCP tool shadowing when an agent connects to several servers?
- How do I scope OAuth tokens per task for an AI agent instead of giving it one broad token?
- How do I give an MCP server least-privilege access to GitHub?
- Do Suno commercial rights lock in when you make the song, or can you upgrade later?
- How do I test that my MCP server's tool errors don't leak environment variables or secrets?
- How do I tell if a Claude Code or Cursor plugin is safe to install?
- How do I pin MCP server versions and review what changed before upgrading?
- Can I use Midjourney images commercially on every plan?
- How do I check font licenses before shipping a web app?
- Who owns code written by an AI coding agent?
- Are MCP tool annotations like readOnlyHint a security guarantee?
- Can I use ElevenLabs AI voices commercially?
- Can I use FLUX or Stable Diffusion images commercially?
- Can I use ChatGPT output commercially?
- How do I cap or truncate MCP tool output so it doesn't flood the context window?
- How do I give an AI coding agent its own git identity for commits?
- Can I use Suno or Udio music in YouTube videos (and monetize them)?
- How do I log every tool call my AI agent makes, for audit?
- How do I protect a local MCP server from DNS rebinding?
- Open weights vs open license: can I use an open-weight model's outputs commercially?
- How do I cache MCP tool results safely?
- How do I restrict which sites my AI coding agent can reach on the network?
- How do I vet a VS Code, Cursor or Open VSX extension before installing it?
- How do I make an AI coding agent's commits go through pull requests instead of straight to main?
- How do I check whether an AGENTS.md or CLAUDE.md file in a downloaded folder or a parent directory is safe?
- How do I make sure AI-generated code handles time zones correctly?
- How do I keep an audit trail of which human authorized an AI agent's actions?
- How do I make an AI agent check database invariants before and after a migration?
- How do I rotate API keys and tokens after installing a malicious VS Code or Cursor extension?
- How do I health-check OAuth token refresh for an MCP server connection?
- How do I judge an AI agent's work history or reputation before hiring it?
- How do I stop an AI coding assistant from just agreeing with me?
- How do I write MCP tool descriptions so agents pick the right tool?
- Can I clone a game's mechanics with an AI coding assistant? What's copyrightable in a game?
- How do I read an x402 402 Payment Required response as a price before my agent pays?
- How do I validate an A2A agent card before my agent connects to another agent?
- How do I require human approval before an AI agent spends money?
- How do I stop an AI agent from paying twice when it retries a request?
- How do I treat Slack messages, tickets and logs that an MCP server returns as untrusted, and add write access safely?
- How do I give an AI agent a scoped, expiring credential instead of a long-lived API key?
- How do I show a human the actual change (diff, target, amount) before they approve an AI agent's action, instead of the agent's summary?
- How do I sandbox an AI agent to one folder plus a network allowlist?
- How do I tell ChatGPT-User and other AI assistant fetches apart from AI training crawlers in my server logs?
- How do I make my website readable to AI agents with llms.txt and markdown versions of pages?
- How do I set a spending cap for an AI agent that pays with x402?
- How do I stop an AI coding agent from installing hallucinated packages (slopsquatting)?
- Which license should I choose for my open-source MCP server?
- How do I check if AI-generated code copied open-source code?
- How do I prove what an AI model said at a specific time?
- How do I make LLM eval results reproducible and tamper-evident?
- How do I accept x402 payments on my API?
- Are icon libraries like Lucide, Font Awesome and react-icons free for commercial use?
- How do I give an AI agent a virtual card with a spending limit?
- How do I build a kill switch for an autonomous AI agent?
- How do I ask the user to confirm an action from inside an MCP server (elicitation)?
- Can I use Claude output commercially?
- How do I rate limit an AI agent's API calls per key?
- Can I use Google Gemini output commercially?
- How do I revoke an AI agent's access immediately?
- Can I use GitHub Copilot code commercially?
- How do I verify an MCP server package was built from its repo (npm provenance, PyPI attestations)?
- Can I use code written with Cursor commercially?
- How do I prove my small business books weren't edited after the fact?
- How do I stop an AI agent from looping forever and burning tokens?
- How can a CPA audit what an AI agent did in the books?
- How do I keep segregation of duties when an AI agent pays bills?
- How do I verify which AI agent is hitting my site with Web Bot Auth signatures?
- Does robots.txt stop AI crawlers, and how do I block AI training without leaving AI search?
- How do I give each AI agent its own budget when they call paid APIs?
- How do I see how much each AI agent spends on LLM API calls?
- Who is liable when an AI chatbot gives a customer wrong information?
- How do I check AI-generated citations for hallucinations?
- Can I use Llama 3 commercially?
- Can I use Unsplash photos in ads?
- Can I use Pexels photos commercially?
- MIT vs Apache 2.0: what is the difference?
- Is CC BY-NC OK for YouTube?
- Can I train an AI model on CC BY images?
- Can I use GPL code in proprietary software?
- Can I use Gemma commercially?
- Can I use Wikimedia Commons images?
- How do I check the license of an npm or PyPI package?
- Can I train an AI model on CC BY-ND content?
- Can I use CC BY-NC content in a commercial product?
- What is the difference between MIT-0 and MIT?
- Can I use EPL-2.0 code in proprietary software?
- Can I use BUSL-1.1 (Business Source License) software in production?
- Can I use OpenStreetMap data commercially?
- Can I train AI on CDLA-Permissive-2.0 data?
- Can I use GPL-2.0 code commercially?
- What is the difference between GPL-2.0 and GPL-3.0?
- Can I use an LGPL-2.1 library in proprietary software?
- What is the difference between LGPL-2.1 and LGPL-3.0?
- Can I train an AI model on CC BY-NC-SA content?
- Can I use CC BY-ND content commercially?
- Can I use CC0 commercially?
- Can I use CC BY 4.0 commercially?
- Can I use CC BY-SA 4.0 commercially?
- Can I use CC BY-NC 4.0 commercially?
- Can I use CC BY-ND 4.0 commercially?
- Can I use CC BY-NC-SA 4.0 commercially?
- Can I use CC BY-NC-ND 4.0 commercially?
- Can I use MIT commercially?
- Can I use Apache 2.0 commercially?
- Can I use BSD 3-Clause commercially?
- Can I use ISC commercially?
- Can I use LGPL 3.0 commercially?
- Can I use AGPL 3.0 commercially?
- Can I use MPL 2.0 commercially?
- Can I use Unlicense commercially?
- Can I use OFL 1.1 commercially?
- Can I use ODbL 1.0 commercially?
- Can I use BUSL 1.1 commercially?
- Can I use Elastic 2.0 commercially?
- Can I use CreativeML OpenRAIL-M commercially?
- Can I use Mistral Research (MRL) commercially?
- Can I use Qwen License commercially?
- Can I use DeepSeek License commercially?
- Can I use Llama 3.2 Community commercially?
- Can I use Llama 3.3 Community commercially?
- Can I train an AI model on CC0 material?
- Can I train an AI model on CC BY-SA 4.0 material?
- Can I train an AI model on CC BY-NC 4.0 material?
- Can I train an AI model on CC BY-ND 4.0 material?
- Can I train an AI model on ODbL 1.0 material?
- Can I train an AI model on CDLA Permissive 2.0 material?
- Can I train an AI model on MIT material?
- Can I train an AI model on Apache 2.0 material?
- Can I train an AI model on GPL 3.0 material?
- Can I train an AI model on Pexels License material?
- MIT vs BSD 3-Clause: what is the difference?
- MIT vs GPL 3.0: what is the difference?
- Apache 2.0 vs GPL 3.0: what is the difference?
- GPL 3.0 vs LGPL 3.0: what is the difference?
- GPL 3.0 vs AGPL 3.0: what is the difference?
- CC BY 4.0 vs CC BY-SA 4.0: what is the difference?
- CC0 vs CC BY 4.0: what is the difference?
- CC BY-NC 4.0 vs CC BY-NC-SA 4.0: what is the difference?
- MPL 2.0 vs LGPL 3.0: what is the difference?
- ODbL 1.0 vs CC BY 4.0: what is the difference?
- MIT vs Unlicense: what is the difference?
- Apache 2.0 vs BSD 3-Clause: what is the difference?
- Can I train AI on Unsplash photos?
- Can I use Pexels videos on a monetized YouTube channel?
- Can I use Wikipedia text commercially?
- Can I use an npm package in a commercial product?
- Can I use a PyPI package in closed-source software?
- Can I use a Hugging Face model commercially?
- Can I use code from GitHub in my product?
- Can I train an AI model on code from GitHub?
Each answer has a .md and .json twin.
Get a free API key in one call
No card and no email needed. 100 free credits; the license and policy checks stay free without a key.
curl -s -X POST https://www.a2ally.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export A2ALLY_API_KEY=rs_... # the api_key from the reply (shown once)
curl -s https://www.a2ally.com/v1/licenses/check -H "Authorization: Bearer $A2ALLY_API_KEY" \
-H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'