License grace period and failed license checks

The license grace period keeps mcp-core running when it cannot reach AddoCore. If a license check fails because of a network error, a timeout or a server error, your tools keep working for 96 hours on top of the regular 72-hour check interval. A real rejection from AddoCore is different: that blocks tools at once.

How does the license check work?

mcp-core checks its license once at startup and then every 72 hours. That interval is a hard minimum: the server never checks more often on its own schedule. Each check is a signed POST request to the LICENSE_ENDPOINT from your .env, authenticated with your LICENSE_KEY.

From version 1.2.0 mcp-core only accepts an answer that AddoCore signed. It checks the signature with a key that is built into the image, and checks that the answer belongs to this request and this license and is less than 5 minutes old. An answer from any other address does not count, so LICENSE_ENDPOINT has to stay the address from your AddoCore account.

A successful answer is written to ./state/.license-cache.json together with the time of the check. A failed attempt never overwrites that file. The server keeps working from the last good answer, and the license grace period is measured from that moment.

From version 1.2.0 the cache holds the answer exactly as AddoCore signed it. mcp-core checks that signature every time it reads the file, so a cache that was edited by hand counts as no license at all, and the grace period is measured from the time inside the signed answer. Seat tokens are no longer in the file, only a hash of each one. When you update from 1.1.x, mcp-core removes the old cache at the first start and fetches a signed one right away. If that first check fails, it tries again every 15 minutes.

How long does the license grace period last?

The license grace period lasts 96 hours by default. AddoCore sends the value with every successful check as grace_period_hours, so the number your server uses always comes from the license server, not from your .env.

The clock runs from the last successful check:

• 0 to 72 hours: the license is valid.
• 72 to 168 hours: the check is overdue and the license is in grace. Every tool keeps working.
• after 168 hours: the license counts as expired and tool calls are refused.

A failed check is not retried sooner. The next attempt follows the normal 72-hour schedule. In practice: if a check fails at hour 72, the next one runs at hour 144, still inside the window. Fix the network and run a manual refresh instead of waiting.

Which license states does mcp-core use?

mcp-core works with five license states. You see the state in the mcp_status tool and in the /health endpoint:

• unlicensed: no check has ever succeeded. Message: “No valid license found yet. Check LICENSE_KEY and LICENSE_ENDPOINT, or wait for the first license check to complete (this happens automatically at startup).”
• invalid: AddoCore answered and said no. Tools are blocked at once, without a license grace period.
• valid: the last successful check is less than 72 hours old.
• grace: the check is overdue. Message: “License check overdue (last successful check: …). Still working within the 96h grace period.”
• expired: the grace window has passed. Message: “License check failed for longer than the grace period allows (last successful check: …). Tools are disabled until the license server is reachable again — check your network/firewall, or contact support if this persists.”

What happens to tools after the license grace period ends?

After the license grace period, the tools stay visible in Claude, but every call returns an error with the message above. That is deliberate: a tool that silently disappears tells you nothing, a refused call tells you what to fix.

The built-in mcp_status tool keeps working in every state, so you can always ask Claude why a tool fails. The first successful check after the problem is fixed restores everything. No restart and no reinstall.

Why does a rejected license skip the grace period?

The license grace period exists for “the server was out of reach”, not for “the server answered and said no”. AddoCore only sends valid: false for a real rejection:

• the license key is unknown or revoked
• the license is suspended, for example after an unpaid renewal
• the license has reached its maximum number of active installations

These block tool calls immediately. Temporary problems on the AddoCore side return an HTTP 5xx status instead, which your server treats as a failed check, so the license grace period applies. The same goes for a 401 signature error and a 429 rate limit response: neither overwrites the cache. The codes are listed in MCP error codes.

How do you find the cause of a failed check?

Work through these steps on the server:

• Ask Claude to run mcp_status and note the license state and the date of the last successful check.
• Run docker logs mcp-core and look for a line starting with Check failed. It shows either an HTTP status or (network error) with the reason.
• For a network error, check that the server can make outbound HTTPS requests to addocore.com. A firewall or proxy rule is the usual cause.
• For a 401, check that LICENSE_KEY in .env is unchanged and that the server clock is correct.
• If the log says LICENSE_ENDPOINT or LICENSE_KEY not set, the .env is incomplete.
• If the log says Check answer rejected (1.2.0 and newer), the answer did not come from AddoCore or does not belong to this request: LICENSE_ENDPOINT points somewhere else, a proxy changed the answer, or the server clock is more than 5 minutes off. Set LICENSE_ENDPOINT back to the address from your AddoCore account and check the clock. Until then the server keeps working on its last signed check.

Then force a new check:

docker exec mcp-core npm run refresh-license

The log shows Check OK valid=true status=active when it works.

Can you get an email when a check fails?

Yes, for rejections. Under My Account → Options, turn on “Email me when a license check fails”. It is off by default. AddoCore sends it when a check reaches the server and is refused: revoked, suspended or over the activation limit. A network failure on your side never reaches AddoCore, so that case produces no email; the mcp_status tool and the logs are where you see it.

Releasing an activation or renewing a license are covered in MCP license management and MCP license renewal.

The license grace period gives you about a week from the last good check to fix connectivity. Check mcp_status first whenever a tool reports a license problem, and read Entitlements vs. tool modes next to see why a tool is missing altogether.