feat: Add Maven parent POM license resolution (v1.6.0)

[oscarvalenzuelab]

Enhancement

Add Maven-specific license resolution to handle packages where licenses are declared in parent POMs rather than in the package POM itself.

Problem

Maven packages often don't declare licenses directly in their package POM - the license is declared in a parent POM instead. When download_and_scan_package analyzed such packages, it would return no license information even though the license exists in the parent POM.

Example:

<!-- package POM - no license declared -->
<project>
  <parent>
    <groupId>org.example</groupId>
    <artifactId>parent</artifactId>
    <version>1.0</version>
  </parent>
  <!-- ... but license is in parent POM -->
</project>

Solution

Added Maven-specific license resolution using upmex's --registry and --api clearlydefined flags to query ClearlyDefined API, which automatically resolves parent POM licenses.

Workflow Enhancement

After scanning a Maven package (pkg:maven/...), if no license is found:

1. Detects it's a Maven package (purl.startswith('pkg:maven/'))
2. Calls upmex extract with --registry --api clearlydefined flags
3. ClearlyDefined API resolves parent POM licenses automatically
4. Updates result with license and license_source = 'parent_pom_via_clearlydefined'

Code Example

# Maven package with license in parent POM only
result = await download_and_scan_package(purl="pkg:maven/org.example/library@1.0.0")

# Before (v1.5.8):
#   declared_license: None

# After (v1.5.9):
#   declared_license: "Apache-2.0"
#   metadata.license_source: "parent_pom_via_clearlydefined"

Changes

mcp_semclone/server.py

Added Maven parent POM resolution (lines 2057-2078):

# MAVEN SPECIFIC: If no license found and it's a Maven package, try with --registry and --api
if not result["declared_license"] and purl.startswith("pkg:maven/"):
    logger.info(f"Maven package missing license, trying upmex with --registry --api clearlydefined")
    try:
        upmex_maven_result = _run_tool("upmex", [
            "extract",
            str(download_file),
            "--format", "json",
            "--registry",
            "--api", "clearlydefined"
        ])

        if upmex_maven_result.returncode == 0 and upmex_maven_result.stdout:
            maven_data = json.loads(upmex_maven_result.stdout)
            if maven_data.get("license"):
                result["declared_license"] = maven_data["license"]
                result["metadata"]["license"] = maven_data["license"]
                result["metadata"]["license_source"] = "parent_pom_via_clearlydefined"
                logger.info(f"Maven parent POM license found: {maven_data['license']}")
    except Exception as e:
        logger.warning(f"Maven parent POM resolution failed: {e}")

Updated tool docstring - Added Maven-specific documentation

Version Updates

• mcp_semclone/__init__.py: 1.5.8 → 1.5.9
• pyproject.toml: 1.5.8 → 1.5.9
• examples/strands-agent-ollama/requirements.txt: 1.5.8 → 1.5.9

CHANGELOG.md

Documented Maven parent POM enhancement with examples and impact

tests/test_server.py

Added test_maven_parent_pom_resolution:

• Verifies Maven package detection
• Confirms upmex called twice (normal + with --registry --api)
• Validates parent POM license extraction
• Checks license_source metadata tracking

Testing

pytest tests/test_server.py::TestDownloadAndScanPackage -v

Results:

tests/test_server.py::TestDownloadAndScanPackage::test_purl2notices_success PASSED [ 16%]
tests/test_server.py::TestDownloadAndScanPackage::test_deep_scan_fallback PASSED [ 33%]
tests/test_server.py::TestDownloadAndScanPackage::test_online_fallback PASSED [ 50%]
tests/test_server.py::TestDownloadAndScanPackage::test_all_methods_fail PASSED [ 66%]
tests/test_server.py::TestDownloadAndScanPackage::test_keep_download PASSED [ 83%]
tests/test_server.py::TestDownloadAndScanPackage::test_maven_parent_pom_resolution PASSED [100%]

============================== 6 passed in 0.22s

Impact

✅ Maven packages now correctly report licenses from parent POMs
✅ Automatic detection - no user configuration needed
✅ Transparent tracking with license_source field
✅ Graceful fallback if parent POM resolution fails
✅ Zero breaking changes - fully backward compatible

User Feedback

User identified the issue:

"for maven packages that don't have license declared, we should use upmex with parent pom feature"

This enhancement directly addresses that feedback by automatically resolving parent POM licenses for Maven packages.

Release

Version: 1.5.9
Type: Enhancement
Breaking Changes: None

[oscarvalenzuelab]

Enhancement Update

Added comprehensive handling of licenses from multiple sources for Maven packages:

Three License Sources Now Checked

1. Source file headers → osslili scans all source files
2. Package POM metadata → upmex extract reads package POM
3. Parent POM → upmex extract --registry --api clearlydefined resolves parent POM licenses

New Behavior

Combines licenses from all sources:

• Source header licenses (e.g., MIT, BSD) detected by osslili
• Parent POM licenses (e.g., Apache-2.0) resolved via ClearlyDefined
• Both added to detected_licenses array
• Parent POM license set as declared_license
• Marked with license_source: "parent_pom_via_clearlydefined"

Example Output

Maven package with MIT in source headers + Apache-2.0 in parent POM:

{
  "declared_license": "Apache-2.0",
  "detected_licenses": ["MIT", "Apache-2.0"],
  "metadata": {
    "license_source": "parent_pom_via_clearlydefined"
  },
  "scan_summary": "Deep scan completed. found 2 licenses. (includes parent POM license). 1 copyrights."
}

Testing

Added new test: test_maven_combined_source_and_parent_pom_licenses

All 7 tests pass:

tests/test_server.py::TestDownloadAndScanPackage::test_purl2notices_success PASSED
tests/test_server.py::TestDownloadAndScanPackage::test_deep_scan_fallback PASSED
tests/test_server.py::TestDownloadAndScanPackage::test_online_fallback PASSED
tests/test_server.py::TestDownloadAndScanPackage::test_all_methods_fail PASSED
tests/test_server.py::TestDownloadAndScanPackage::test_keep_download PASSED
tests/test_server.py::TestDownloadAndScanPackage::test_maven_parent_pom_resolution PASSED
tests/test_server.py::TestDownloadAndScanPackage::test_maven_combined_source_and_parent_pom_licenses PASSED ✨

User Feedback Addressed

"sometimes when license is not detect in the metadata or as license file, the license could also be in the source header of files, or in maven, in the parent pom, consider both"

✅ Now considers both source headers AND parent POM
✅ Combines results transparently
✅ Summary indicates multiple sources