Can you reuse an agent skill or MCP server? What the licenses say

Short answer: using a skill or MCP server and copying it are different questions. Before your agent copies, forks, edits or republishes a skill, open its LICENSE file (not just GitHub's badge) and confirm a license that allows it; with no license, you have no granted right to copy it. Running an MCP server is usually fine under permissive licenses, but AGPL-3.0 adds duties if you modify it and serve it over a network. In the 3,289 third-party skills, MCP servers and repos our library indexes, 78.4% have a permissive license GitHub detects, 9.9% have none, 7.9% have one GitHub cannot classify and 3.8% are copyleft.

Installing is not the only thing that happens to a skill: a SKILL.md gets pasted into a repo, a prompt pack is forked and edited, a server is patched and redeployed. Each of those is copying or modifying, and that is what licenses govern. This post counts what the licenses actually are, using the license GitHub detects for each repo in the Upskill library build of 2026-11-12. It is general information, not legal advice; for anything commercial, read the license text or ask a lawyer.

What the licenses are, by type

Permissive means MIT, Apache-2.0, BSD, ISC, CC0, CC-BY or Unlicense; copyleft means GPL, AGPL, LGPL, MPL or CC-BY-SA. Items are counted once per library entry, and a repo that publishes several skills counts once per skill, so big skill packs weigh more than single-skill repos. MIT alone covers 1,763 items and Apache-2.0 742.

Two patterns stand out. Skills are mostly permissive or unlicensed and almost never copyleft, while MCP servers and repos carry nearly all the copyleft (77 AGPL-3.0 items, 39 of them MCP servers). And roughly one item in 6 (17.8%) has no license GitHub can name.

"No license" is not "free to use"

A public repo without a license is still under its author's copyright. GitHub's terms let other users view and fork it on GitHub, but that does not give you the right to copy it into your own project, change it or republish it. For a skill, that matters more than it seems: the useful part is the text itself, so pasting it into your agent's repo or a shared prompt pack is copying.

If an unlicensed skill is worth having, ask the author to add a license, or link to it and write your own version of the idea instead of copying the words.

NOASSERTION means "read the file", not "danger"

GitHub reports NOASSERTION when it finds a license file it cannot match to one standard license. In our data that often means mixed licensing in large, well-known projects. For example, the LICENSE file of Langfuse says that content under its enterprise ("ee") directories has its own license, while the rest is open source; GitHub cannot express that in one badge. A skill pack can also license each skill separately in its own folder. Either way the answer is in the text, not the badge.

Using vs copying: skills and MCP servers differ

• Skills and prompts are usually copied. The agent loads the text, and teams often vendor it into their repo. Treat a skill like code you are copying: keep the license and copyright notice with it, and do not republish unlicensed text.
• MCP servers are usually run. Running a server to use its tools is use, which permissive licenses allow without conditions. GPL duties start when you distribute a copy, modified or not. AGPL-3.0 goes further: if you modify the server and let other people use it over a network, you must offer them your modified source. That is relevant to anyone hosting a patched MCP server for a team or customers.
• Hosted MCP servers are governed by terms, not licenses. A remote server's repo may hold MIT client code, but the service you call is covered by the vendor's terms of service and pricing.

How our library treats licenses

The library lists 3,289 third-party items but republishes very little. We cache and show the full SKILL.md or prompt text only for catalog items under a permissive license (27 catalog items show full text today, house items included); everything else gets a summary and a link to the source. Each item page shows the license GitHub detects.

Our curated catalog has 118 items: 26 house items written by Avatar 8 LLC and 92 third-party ones. Of those 92, 68 are permissive, 4 copyleft and 20 have no license GitHub can classify. Most of those 20 are published by the company behind the product they connect to; we have not parsed their license files, and we list them because we link to them rather than copy their text.

In discovery, a missing license counts against a candidate. Since 2026-10-17, reviewer notes mention "no clear license" on 75 of the 229 candidates we rejected. The primary reason is usually broader: 37 rejections fall under "too little evidence of use, stale, or no clear license". Full breakdown: what 229 rejections taught us.

A license check your agent can run in a minute

1. Open the LICENSE file at the commit you plan to use. Do not rely on the badge or the README's claim.
2. Look for folder licenses. Check for LICENSE files inside skill folders and directories such as ee/, enterprise/ or pro/.
3. Decide whether you are using or copying. Running a server or loading a skill from its source is use. Vendoring, editing or republishing text is copying.
4. Copying permissive code: keep the notice. Keep the copyright and license text next to the copied files, and note your changes for Apache-2.0.
5. Copyleft: keep changes separate or comply. Run GPL and AGPL servers as they are; if you change them and share or host the result, publish your changes under the same license.
6. No license: link, don't copy. Ask the author for a license or write your own version.
7. Record what you checked. Note the license and commit next to the item in your agent's tool list, and check again when you update.

What builders are asking

Of the 198 public posts about skills and MCP servers we collected on 2026-10-25, only 3 mention a license at all: 2 builders announcing their own tool as MIT-licensed, and one unrelated mention of software license checks. Nobody in the sample asked whether a skill can be reused. A small sample is a hint, not demand data; we read it as license checks not yet being a habit, not as licenses not mattering.

What we have not measured

We use GitHub's detected license per repository. We have not parsed per-folder or per-file licenses, so a repo marked MIT can still contain files under other terms, and NOASSERTION repos are not broken down further. We have not reviewed any project's terms of service. Nothing here is legal advice.

Let a coach pick and prune

Agent Coach matches vetted skills and MCP servers to your agent's job, shows each item's license and scan result, and checks in daily on what to keep or remove. It is free. API and MCP details are in the developer docs; the scan method is in our security research. Paste one line into your agent:

Read https://upskill.coach/start and follow it.

Related: how to vet a tool before installing it, skills vs MCP servers.

FAQ

Can I copy an agent skill from GitHub into my own project?

Only if its license allows it. MIT, Apache-2.0, BSD and ISC allow copying and modifying if you keep the copyright and license notice (Apache-2.0 also asks you to mark changes). With no license, default copyright applies and you have no granted right to copy, modify or redistribute it. In our library, 78.4% of 3,289 third-party items have a permissive license GitHub detects. This is general information, not legal advice.

What does NOASSERTION mean on a GitHub repo?

GitHub's license detector found a license file but could not match it to one standard license. Often the repo has mixed licensing (for example a separate license for an enterprise folder) or a modified standard license. Open the LICENSE file and read it; do not treat NOASSERTION as either safe or unsafe.

Do I need to check the license of an MCP server I only run?

Yes, but the question is different. Running a server to use its tools is use, which permissive licenses allow freely. Copyleft matters when you distribute it (modified or not), and AGPL-3.0 also when you modify it and let others use it over a network: then you must offer them your modified source. 39 of the 871 MCP servers in our library are AGPL-3.0.

Does a hosted (remote) MCP server have a license?

The client code or docs in its repo may have one, but the service itself is governed by the vendor's terms of service and pricing, not by an open-source license. Read the terms, especially on data retention and automated use.

Is an unlicensed skill unsafe?

Not necessarily; license and security are separate checks. A missing license is a legal and maintenance signal, not a security finding. In our discovery reviews, "no clear license" was noted on 75 of 229 rejected candidates.

Questions or corrections: ops@avatar33.com.