JustClaw-It

com.it.justclaw/justclaw-itVersion 1.13.0

Licence-cleared code for coding agents, with attribution. Free search, MCP prompts and a skill pack.

Status

Responds250 msNov 14, 2026, 14:02 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:02 UTC
Latency: 250 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://justclaw.it.com/mcpResponds250 msNov 14, 2026, 14:02 UTC

No sign-in

Claude Code

claude mcp add --transport http justclaw-it https://justclaw.it.com/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: justclaw-it
Remote MCP server URL: https://justclaw.it.com/mcp

Cursor

{
  "mcpServers": {
    "justclaw-it": {
      "url": "https://justclaw.it.com/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"justclaw-it","type":"http","url":"https://justclaw.it.com/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

10 tools

Tools of JustClaw-It
	Description		Read-only	Idempotent	Open world
`check_component_security`Check components or repositories for known security advisories before or after you reuse them: severity, CVSS, summary and the versions that fix each one. Cost: 0 credits (free; needs a free key). Advisories are repository-wide: OSV advisories for the packages each repository publishes (refreshed weekly), plus published CVE/GHSA ids from web reports. "none_known" means no advisory in our data, not that the code is safe. Parameters: component_ids -- up to 25 ids from search_components / get_component. names -- up to 25 repositories as "owner/repo" or a GitHub URL (a bare repo name matches every owner's). Returns JSON {"results": [...], "summary", "coverage", "note"}; each result has status "advisories" (max_severity, by_severity, the most severe advisories with summary, fixed_versions and links), "none_known" (with packages_checked) or "not_found". packages -- up to 50 {"ecosystem": "npm"\|"PyPI"\|"Go"\|"crates.io", "name", "version"}: a verdict per exact version ("vulnerable", "no_known_advisories", "unknown", "unpinned" without a version). Every key gets counts and max severity; Pro also gets advisory ids, ranges and fixed versions. Example: check_component_security(component_ids=["<id>"], names=["nestjs/nest"], packages=[{"ecosystem": "npm", "name": "lodash", "version": "4.17.20"}])	Check components or repositories for known security advisories before or after you reuse them: severity, CVSS, summary and the versions that fix each one. Cost: 0 credits (free; needs a free key). Advisories are repository-wide: OSV advisories for the packages each repository publishes (refreshed weekly), plus published CVE/GHSA ids from web reports. "none_known" means no advisory in our data, not that the code is safe. Parameters: component_ids -- up to 25 ids from search_components / get_component. names -- up to 25 repositories as "owner/repo" or a GitHub URL (a bare repo name matches every owner's). Returns JSON {"results": [...], "summary", "coverage", "note"}; each result has status "advisories" (max_severity, by_severity, the most severe advisories with summary, fixed_versions and links), "none_known" (with packages_checked) or "not_found". packages -- up to 50 {"ecosystem": "npm"\|"PyPI"\|"Go"\|"crates.io", "name", "version"}: a verdict per exact version ("vulnerable", "no_known_advisories", "unknown", "unpinned" without a version). Every key gets counts and max severity; Pro also gets advisory ids, ranges and fixed versions. Example: check_component_security(component_ids=["<id>"], names=["nestjs/nest"], packages=[{"ecosystem": "npm", "name": "lodash", "version": "4.17.20"}])	No	Yes	Yes	No
`compose_starter`Pro feature. Assemble a starter project from 3-8 complementary licence-cleared components for what you are building: file tree, files with attribution headers, a README listing every source and licence, a NOTICE file and install commands. Cost: 10 credits per call (Pro plan; other plans get an upgrade message and are not charged). Parameters: prompt (required) -- what you are building, e.g. "saas with stripe billing and magic-link login". stack -- optional, e.g. "nextjs" or "python fastapi". Returns JSON with files, tree, readme, notice, install commands and credits_charged. Example: compose_starter(prompt="todo api with jwt auth", stack="python fastapi")	Pro feature. Assemble a starter project from 3-8 complementary licence-cleared components for what you are building: file tree, files with attribution headers, a README listing every source and licence, a NOTICE file and install commands. Cost: 10 credits per call (Pro plan; other plans get an upgrade message and are not charged). Parameters: prompt (required) -- what you are building, e.g. "saas with stripe billing and magic-link login". stack -- optional, e.g. "nextjs" or "python fastapi". Returns JSON with files, tree, readme, notice, install commands and credits_charged. Example: compose_starter(prompt="todo api with jwt auth", stack="python fastapi")	No	Yes	Yes	No
`find_similar`Find alternatives to a component you already have: other licence-cleared implementations of the same job, to compare scores, licences and stacks. Cost: 0 credits (free; needs a free key). Parameters: id (required) -- a component id from search_components. limit -- how many (default 8). Returns JSON {"results": [...]} in the same shape as search_components (no code body). Example: find_similar(id="<id from search_components>", limit=5)	Find alternatives to a component you already have: other licence-cleared implementations of the same job, to compare scores, licences and stacks. Cost: 0 credits (free; needs a free key). Parameters: id (required) -- a component id from search_components. limit -- how many (default 8). Returns JSON {"results": [...]} in the same shape as search_components (no code body). Example: find_similar(id="<id from search_components>", limit=5)	No	Yes	Yes	No
`get_component`Pull one component's full source code to reuse in the project, with its licence, copyright holder, GitHub permalink and an attribution header to keep with the copied code. Cost: 1 credit per call (needs a free key; refunded if the id is not available). Re-pulling a component you already pulled still costs 1 credit. Parameters: id (required) -- a component id from search_components or find_similar. Returns JSON with the full source, licence, attribution header, GitHub permalink, repo, path, language and quality scores. Example: get_component(id="<id from search_components>")	Pull one component's full source code to reuse in the project, with its licence, copyright holder, GitHub permalink and an attribution header to keep with the copied code. Cost: 1 credit per call (needs a free key; refunded if the id is not available). Re-pulling a component you already pulled still costs 1 credit. Parameters: id (required) -- a component id from search_components or find_similar. Returns JSON with the full source, licence, attribution header, GitHub permalink, repo, path, language and quality scores. Example: get_component(id="<id from search_components>")	No	Yes	Yes	No
`get_component_bundle`Pro feature. Pull a component together with the files it imports from its own repository, so it runs without hunting for helpers: each file with source and licence/attribution header, plus a manifest of files, npm/pip packages and install commands. Cost: 3 credits per call (Pro plan; other plans get an upgrade message and are not charged). Parameters: component_id (required) -- an id from search_components. Returns JSON with the files, manifest, licences and credits_charged. Example: get_component_bundle(component_id="<id from search_components>")	Pro feature. Pull a component together with the files it imports from its own repository, so it runs without hunting for helpers: each file with source and licence/attribution header, plus a manifest of files, npm/pip packages and install commands. Cost: 3 credits per call (Pro plan; other plans get an upgrade message and are not charged). Parameters: component_id (required) -- an id from search_components. Returns JSON with the files, manifest, licences and credits_charged. Example: get_component_bundle(component_id="<id from search_components>")	No	Yes	Yes	No
`library_stats`Live size of the library: total licence-cleared components, how many carry full source, source repositories, languages and repositories by licence class. Use it to tell the user how much is searchable. Cost: 0 credits (free; needs a free key). No parameters. Returns JSON counts, refreshed every 15 minutes. Example: library_stats()	Live size of the library: total licence-cleared components, how many carry full source, source repositories, languages and repositories by licence class. Use it to tell the user how much is searchable. Cost: 0 credits (free; needs a free key). No parameters. Returns JSON counts, refreshed every 15 minutes. Example: library_stats()	No	Yes	Yes	No
`licence_report`Licence report for your project's dependencies from its lockfiles: the licence each public package declares (deps.dev registry metadata), its JustClaw-It class (permissive, weak-copyleft, copyleft, none, unknown) and whether it is usable in closed-source software you sell. Dual licences ("A OR B") are classified by the most permissive option and say so; unknown never counts as permissive. Attribution evidence, not legal advice, licence clearance or certification. Cost: format="summary" is free. "cyclonedx" (CycloneDX 1.6 JSON), "spdx" (SPDX 2.3 JSON) and "notice" (THIRD-PARTY NOTICES text) cost 5 credits per document, one format per call, refunded when the files cannot be parsed or contain no packages. Signed-in callers only (API key or account sign-in). Limits: up to 4 files, 2 MB each, 5,000 packages per report; 10 reports a day (Pro: 100); at most 500 live registry lookups per report (the rest are "pending -- re-run later"). Your files are parsed in memory and never stored or logged; private packages (file:, link:, workspace:, git, path deps, private registries we can recognise) are reported as "private -- not looked up" and never sent anywhere. We cannot always tell a private-registry package from a public one: list your private scopes in private_scopes and they are never looked up. Parameters: files (required) -- list of {"name": "<file name>", "content": "<file text>"}; supported: package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, uv.lock, requirements.txt (pinned == only), go.mod, go.sum, Cargo.lock. format -- summary \| cyclonedx \| spdx \| notice (default summary). private_scopes -- optional names or scopes never to look up, e.g. ["@acme", "github.com/acme"]. Returns JSON: the summary (counts per class, not_sellable with reasons, unknown, private, pending), or {format, document, summary, credits_cha	Licence report for your project's dependencies from its lockfiles: the licence each public package declares (deps.dev registry metadata), its JustClaw-It class (permissive, weak-copyleft, copyleft, none, unknown) and whether it is usable in closed-source software you sell. Dual licences ("A OR B") are classified by the most permissive option and say so; unknown never counts as permissive. Attribution evidence, not legal advice, licence clearance or certification. Cost: format="summary" is free. "cyclonedx" (CycloneDX 1.6 JSON), "spdx" (SPDX 2.3 JSON) and "notice" (THIRD-PARTY NOTICES text) cost 5 credits per document, one format per call, refunded when the files cannot be parsed or contain no packages. Signed-in callers only (API key or account sign-in). Limits: up to 4 files, 2 MB each, 5,000 packages per report; 10 reports a day (Pro: 100); at most 500 live registry lookups per report (the rest are "pending -- re-run later"). Your files are parsed in memory and never stored or logged; private packages (file:, link:, workspace:, git, path deps, private registries we can recognise) are reported as "private -- not looked up" and never sent anywhere. We cannot always tell a private-registry package from a public one: list your private scopes in private_scopes and they are never looked up. Parameters: files (required) -- list of {"name": "<file name>", "content": "<file text>"}; supported: package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, uv.lock, requirements.txt (pinned == only), go.mod, go.sum, Cargo.lock. format -- summary \| cyclonedx \| spdx \| notice (default summary). private_scopes -- optional names or scopes never to look up, e.g. ["@acme", "github.com/acme"]. Returns JSON: the summary (counts per class, not_sellable with reasons, unknown, private, pending), or {format, document, summary, credits_cha	No	Yes	Yes	Yes
`list_categories`List the function tags (categories) in the library with how many components each has; the values search_components accepts as `category`. Cost: 0 credits (free; needs a free key). Parameters: limit -- how many tags, most-used first (default 40). Returns JSON {"categories": [{"tag": ..., "count": ...}, ...]}. Example: list_categories(limit=20)	List the function tags (categories) in the library with how many components each has; the values search_components accepts as `category`. Cost: 0 credits (free; needs a free key). Parameters: limit -- how many tags, most-used first (default 40). Returns JSON {"categories": [{"tag": ..., "count": ...}, ...]}. Example: list_categories(limit=20)	No	Yes	Yes	No
`list_licenses`List every source repository in the library with its SPDX licence and copyright holder, i.e. the NOTICE data behind the attribution on each component. Use it to build a NOTICE file or to check a repo's licence. Cost: 0 credits (free; needs a free key). No parameters. Returns JSON {"licenses": [...]}, one entry per source repository. Example: list_licenses()	List every source repository in the library with its SPDX licence and copyright holder, i.e. the NOTICE data behind the attribution on each component. Use it to build a NOTICE file or to check a repo's licence. Cost: 0 credits (free; needs a free key). No parameters. Returns JSON {"licenses": [...]}, one entry per source repository. Example: list_licenses()	No	Yes	Yes	No
`search_components`Find existing, licence-cleared code (functions, classes, handlers, modules) mined from real open-source repositories, before writing it from scratch. Cost: 0 credits (free). Works without an API key with a small per-network limit; a free key raises the limits. Every result is licence-cleared with attribution: its SPDX licence, copyright holder and a GitHub permalink come with it. Parameters: query (required) -- describe the job in plain words, e.g. "verify stripe webhook signature in python". limit -- results per page (default 8; capped by plan). category -- a function tag from list_categories, e.g. "auth". language -- python, typescript, javascript, go, rust, java, ... . license -- 'permissive' (MIT/BSD/Apache/ISC; use it when the code goes into a product), 'commercial-safe' (adds weak copyleft such as MPL-2.0), 'open-source' or 'any' (default). min_composite -- minimum 0-10 quality score, e.g. 7. offset -- pagination. max_per_repo -- cap per source repo (0 = no cap). exclude_vulnerable -- Pro: drop components whose imported npm/PyPI libraries' latest release has a known high/critical advisory. Returns JSON {"results": [...]}, each with id, name, description, repo, path, language, license, composite and five sub-scores, similarity and permalink. No code body: pass the id to get_component for the source. Example: search_components(query="express jwt auth middleware", language="javascript", license="permissive", min_composite=7)	Find existing, licence-cleared code (functions, classes, handlers, modules) mined from real open-source repositories, before writing it from scratch. Cost: 0 credits (free). Works without an API key with a small per-network limit; a free key raises the limits. Every result is licence-cleared with attribution: its SPDX licence, copyright holder and a GitHub permalink come with it. Parameters: query (required) -- describe the job in plain words, e.g. "verify stripe webhook signature in python". limit -- results per page (default 8; capped by plan). category -- a function tag from list_categories, e.g. "auth". language -- python, typescript, javascript, go, rust, java, ... . license -- 'permissive' (MIT/BSD/Apache/ISC; use it when the code goes into a product), 'commercial-safe' (adds weak copyleft such as MPL-2.0), 'open-source' or 'any' (default). min_composite -- minimum 0-10 quality score, e.g. 7. offset -- pagination. max_per_repo -- cap per source repo (0 = no cap). exclude_vulnerable -- Pro: drop components whose imported npm/PyPI libraries' latest release has a known high/critical advisory. Returns JSON {"results": [...]}, each with id, name, description, repo, path, language, license, composite and five sub-scores, similarity and permalink. No code body: pass the id to get_component for the source. Example: search_components(query="express jwt auth middleware", language="javascript", license="permissive", min_composite=7)	No	Yes	Yes	No

Details

Registry status: Active
Published: Nov 8, 2026
Updated: Nov 8, 2026
Website: https://justclaw.it.com/⁠ (opens in a new tab)
Repository: https://github.com/justclaw-it/justclaw-it-mcp⁠ (opens in a new tab)
Categories (suggested): AI models Developer tools SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing