OHRisk

Overview

OHRisk is a local command-line utility for checking open-source license exposure in software dependencies before a pull request is merged. It is aimed at development and compliance teams that prefer on-premise analysis and CI enforcement over a hosted scanner. The bottom line is that it combines broad report and workflow support with meaningful, documented blind spots, so it works best as a repeatable decision aid rather than a complete legal or dependency inventory.

Key features

OHRisk evaluates dependencies under SaaS and distributed-application profiles, then labels results low, review, high, or unknown. Those categories help teams focus attention on obligations that deserve investigation instead of treating every package identically. The project explicitly positions the tool as risk decision support, not legal advice; high-impact releases and ambiguous findings still require legal review.

Input coverage spans npm, Rust, Go, Python, Java, .NET, Ruby, and PHP projects, plus CycloneDX and SPDX software bills of materials. SBOM imports include CycloneDX JSON and XML, SPDX JSON and RDF, and SPDX tag-value. OHRisk can draw on local package evidence and selected remote evidence sources, with checksum and identity validation described for supported ecosystems. That combination is useful when package metadata needs corroboration, although it does not make every ecosystem equally complete.

Output choices include terminal, JSON, HTML, Markdown, SARIF 2.1.0, and CycloneDX 1.5 JSON. Developers can read results directly, while security pipelines can consume machine-readable artifacts. The bundled GitHub Actions composite action provides scan, ci, and diff commands, and the workflow guide documents sending SARIF to GitHub code scanning. Local waiver files can keep an exception from failing a CI threshold while preserving the waived finding in reports, which supports auditability without blocking every accepted risk.

Policy enforcement is supported, along with obligation tracking and attribution reports. The tool is distributed under the MIT License and is available as an npm package, with install commands for npm, pnpm, Yarn, or Bun. Runtime use requires Node.js 24.0.0 or newer; Bun itself is not required.

Coverage has clear boundaries. The README says Gradle graph reconstruction and remote Terraform Registry metadata, among other dependency sources and graph types, are not scanned yet. Projects relying on those inputs should treat OHRisk results as partial until those dependencies are reviewed by another method.

Pricing

OHRisk is free: the Ohrisk plan costs nothing and provides the open-source CLI under the MIT License. There is no free trial because the product is already offered as a free plan. The published plan carries no seat, scan, or usage quota, making it suitable for teams that can operate their own command-line and CI infrastructure. Its trade-off is operational rather than monetary: deployment is on-premise, so users must provide the environment and account for the stated Node.js runtime.

Platforms

OHRisk runs on Linux, macOS, and Windows. Its package-manager distribution and local execution suit developer workstations, while the GitHub Actions integration targets repository CI. On-premise deployment is the fit for organizations that want scan artifacts and waiver handling inside their own workflow.

Who it's for

Choose OHRisk if your team needs license checks before pull requests, supports several language ecosystems, and wants policy thresholds, obligation tracking, attribution reports, or SBOM exchange without paying for a hosted service. It is particularly appropriate where local evidence, visible waivers, and SARIF-based GitHub workflows matter.

Look elsewhere, or pair it with another scanner, when Gradle dependency graphs, Terraform Registry metadata, or other unsupported sources are central to your inventory. It is also not the right standalone authority for legal conclusions.

Pros and cons

Pros

• Broad workflow output: terminal, document, SARIF, and CycloneDX reports cover both human review and automation.
• CI-ready controls: GitHub Actions commands, threshold enforcement, and documented SARIF upload support pull-request processes.
• Traceable exceptions: waivers can bypass a failure without hiding the underlying finding.
• Wide input model: major language ecosystems and CycloneDX or SPDX SBOMs are supported.
• No license fee: the MIT-licensed CLI is free to run on all supported desktop platforms.

Cons

• Incomplete graph coverage: Gradle reconstruction and remote Terraform Registry metadata are not scanned yet.
• Not legal advice: risk ratings guide review but cannot replace counsel for consequential licensing decisions.
• Runtime requirement: Node.js 24.0.0 or later may complicate use in older build environments.
• Self-managed operation: on-premise execution places setup and maintenance responsibility on the user.

Alternatives

Open Source License Compliance Software is a useful starting list if you want to compare a wider field.

FOSSology is another free, open-source compliance toolkit with API, web, self-hosted, and desktop platform options; choose it when a broader service-style deployment matters more than OHRisk's local CLI focus.

ScanCode.io is free Apache-2.0 software that runs in Docker or on a Linux server, making it preferable when containerized or server execution is the priority.

OSS Review Toolkit is a free open-source toolkit with no paid limits stated; consider it when you want an alternative toolkit approach across Linux, macOS, Windows, or self-hosted environments.

OSSKB is a free, best-effort service whose transaction frequency may be limited, so it fits occasional lookups rather than a fully local CI control.

REUSE Tool is free, offline-capable, and needs no registration; choose it for a simpler local compliance workflow. licscan is a free standalone CLI at $0 per scan. Apache Flink CDC and DeepFilterNet are free open-source projects, but their primary purposes are unrelated to license-risk review.

Verdict

OHRisk is a strong fit for teams that want a free, local license-risk gate with flexible reports, GitHub Actions integration, and visible waiver handling. Its main reason to choose it is the combination of policy-oriented findings and developer-friendly CI outputs. Its main reason to look elsewhere is incomplete dependency-source coverage, especially for Gradle and Terraform-related inventories, together with the need for separate legal judgment.