Scorecard checks whether a licence is published: 6 points for a LICENSE, LICENCE, COPYING or COPYRIGHT file (or files in a LICENSES directory named by SPDX identifier), 3 for the file being at the top level, and 1 for an FSF or OSI licence being identified. GitHub-hosted projects are read through the GitHub licence API.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.