licscan

LicScan is a command-line tool for checking dependency licenses and producing compliance artifacts. It is best suited to teams that want to make license decisions part of repository and CI workflows. Its case is strongest when local, repeatable scans and EU CRA evidence matter; it is a weaker fit for teams seeking a hosted review service.

Overview

LicScan scans repository dependencies in Go, Node.js, PHP, Python, Ruby, Rust, and Java projects. Its configurable five-level risk model supports deny, warn, and allow exceptions, turning license review into an enforceable policy rather than just an inventory. That flexibility is useful across different risk tolerances, though teams need to decide how their policy should treat each license.

The maker says scans run locally without an account, telemetry, backend connection, or phone-home behavior, and that identical inputs produce identical outputs. Those properties suit teams that want to keep scanning within their own environment and produce repeatable results. The repository-focused standalone CLI is less suited to organizations that need a hosted, centralized workflow. CocoaPods and pub are roadmap items, so projects using them do not have current ecosystem support.

Key features

LicScan can produce table, JSON, HTML, Markdown, CycloneDX, SPDX, CRA PDF, SARIF, and JUnit reports. The range serves both people reviewing results and CI systems consuming artifacts. CRA mode generates a PDF report and a CRA-extended CycloneDX JSON SBOM with manufacturer and product metadata, making the tool relevant to teams assembling that evidence rather than only tracking license risk.

The official GitHub Action can comment scan verdicts on pull requests, fail builds when licenses are denied, and upload SBOM artifacts. SARIF support also connects with GitHub Code Scanning, while JUnit XML is supported for Jenkins, GitLab CI, and Azure DevOps. These integrations make the CLI more practical in established pipelines, although the available workflow remains centered on repository scans.

Installation options include Homebrew, curl, and go install. The maker directs bug reports to GitHub issues and offers [email protected] for contact.

Pricing

The Free / open source plan costs nothing ($0 per scan · Apache 2.0 · standalone CLI). It includes a free plan with no per-scan charge, and the stated deployment option is on-premise. There is no free trial, but no trial is needed to access the free plan. This suits individuals and teams that can run a CLI in their own environment; the plan is not a hosted service with centralized review features.

Platforms

LicScan supports Linux, macOS, and Windows. Its listed installation methods include Homebrew, curl, and go install, giving developers several ways to add the CLI to their working environment.

Who it's for

LicScan is a strong fit for software teams that need license policy enforcement alongside SBOM or CRA evidence, especially when scans should remain local and feed into CI. It is less appropriate for projects built around CocoaPods or pub today, or for teams that want a hosted interface instead of a repository-scanning CLI.

Pros and cons

• Pros: A configurable five-level policy model can deny, warn on, or allow licenses, supporting decisions beyond a simple dependency list.
• Pros: CRA PDF and extended CycloneDX output add manufacturer and product metadata for teams preparing CRA evidence.
• Pros: Local operation without account, telemetry, or backend connection, plus deterministic outputs, suits privacy-sensitive and repeatable workflows.
• Cons: The standalone CLI and repository scan model do not provide a hosted, centralized review service.
• Cons: CocoaPods and pub are only roadmap items, leaving those package-manager users without current support.

Alternatives

Open Source License Compliance Software is a broader category to explore when comparing tools.

Choose FOSSology if you want an open-source license compliance toolkit and system, with API, web, and self-hosted platforms among its supported options. Apache Flink CDC is another free option for Linux, macOS, Windows, and self-hosted environments. DeepFilterNet is free and open source under MIT or Apache-2.0. OHRisk is a free open-source CLI under the MIT License. OSS Review Toolkit is a free open-source toolkit with no paid limits stated. OSSKB is a free API and web service, though it is best-effort and transaction frequency may be limited. REUSE Tool needs no registration and can be used offline. SBOM Workbench is a free download with a public GitHub repository.

Verdict

Choose LicScan if you need a free, local CLI that can enforce license policy and generate SBOM and CRA artifacts within repository or CI workflows. Its main advantage is combining those outputs with privacy-conscious, repeatable scanning. Look elsewhere if your project depends on CocoaPods or pub, or if a hosted, centralized service is essential.