Apache RAT
Apache RAT is a free release-audit tool for checking software distributions, with particular attention to license headers.
What Apache RAT is
Apache RAT is a free release-audit tool for checking software distributions, with particular attention to license headers. Version 0.18 includes a command-line client, an Ant task library, and a Maven plugin. Its options can include or exclude files, apply approved-license lists, and produce reports such as missing-header or unapproved-license output. The Maven plugin can write a text report to target/rat.txt or add one to a generated site. The command-line tool can add Apache-2.0 license headers and copyright notices to files not excluded by configuration. License definitions can be added through XML; extending matchers, formats, reports, or interfaces requires relevant expertise. RAT flags possible issues rather than making a final judgment: reports need interpretation, project-specific tuning may be needed, and heuristics may miss problems. Building RAT requires Java 17, and the project recommends Apache Maven 3.9.13 or later. The downloads page offers binary and source archives for version 0.18. The project recommends verifying downloaded releases using signatures and provides PGP signatures and SHA-512 checksums. Apache Creadur licenses the software under Apache License, Version 2.0.
Good
- Provides command-line, Ant, and Maven interfaces.
- Supports file inclusion and exclusion patterns.
- Can report missing headers and unapproved licenses.
- Can add Apache-2.0 headers and copyright notices.
- Licensed under Apache License, Version 2.0.
Watch out
- Requires Java 17 to build.
- Heuristics may miss issues.
- Reports need interpretation and may require project-specific tuning.
Who it suits
Apache RAT suits teams reviewing software releases for license headers and approved-license issues, especially those using command-line, Ant, or Maven workflows. It is intended for on-premise deployment, and its reports require human interpretation.
Verdict
Apache RAT offers several ways to incorporate license checks into release workflows and can report or add headers. Treat its findings as prompts for review, since its heuristics may miss issues and project configuration may need tuning.
Plans and prices
From Apache RAT's own pricing page, checked 8 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Apache RAT | Free | Open-source release audit tool · latest release 0.18 |
The facts
Each one read from Apache RAT's own pages, with the date it was checked.
What it does
- Caveat
- RAT relies on heuristics that may miss issues, and its reports require interpretation and may need project-specific tuning.checked 8 Oct 2026
- Configuration
- Command-line options support file inclusion and exclusion, license approval lists, and report output styles including missing-header and unapproved-license reports.checked 8 Oct 2026
- Download integrity
- The project recommends verifying downloaded release files with signatures from its main distribution directories and provides PGP signatures and SHA512 checksums.checked 8 Oct 2026
- Extensibility
- Users can add license definitions through XML, and can extend matchers, definition formats, reports, and user interfaces with the relevant expertise.checked 8 Oct 2026
- File selection
- RAT supports including and excluding files with patterns, standard collections, files of patterns, and file-size exclusions.checked 8 Oct 2026
- Header editing
- The command-line tool can add Apache-2.0 license headers and copyright notices to files that are not excluded by its configuration.checked 8 Oct 2026
- Integrity checks
- The project recommends verifying downloaded releases with signatures from its main distribution directories; it also provides PGP signatures and SHA-512 checksums.checked 8 Oct 2026
- Interfaces
- RAT 0.18 ships with a command-line client, an Ant task library, and a Maven plugin.checked 8 Oct 2026
- License
- Apache Creadur licenses its software to the public under the Apache License, Version 2.0.checked 8 Oct 2026
- License review
- RAT is a release audit tool focused on licenses and is intended to improve the accuracy and efficiency of checking releases for licenses.checked 8 Oct 2026
- Limitations
- RAT highlights possible issues, its reports require interpretation, it may need tuning, and its heuristics may miss issues.checked 8 Oct 2026
- Maven reports
- The Maven plugin can write a text report to target/rat.txt or add a report to the generated site.checked 8 Oct 2026
- Output formats
- The package includes stylesheets for missing-header reports, unapproved-license reports, plain output, and pretty-printed XML.checked 8 Oct 2026
- Primary use
- RAT is intended to improve the accuracy and efficiency of checking software releases for licenses.checked 8 Oct 2026
- Purpose
- Apache RAT audits software distributions, with a focus on license headers.checked 8 Oct 2026
- Release
- The downloads page lists Apache Creadur RAT 0.18 as the latest release and offers binary and source archives.checked 8 Oct 2026
- Runtime
- RAT requires Java 17; its documentation recommends Java 21 for generating Javadocs due to an existing JDK error.checked 8 Oct 2026
- Runtime requirements
- Building RAT requires Java 17, and the project recommends Apache Maven 3.9.13 or later.checked 8 Oct 2026
- Security reporting
- The Apache Security Team asks that potential vulnerabilities be reported first to a private Apache security mailing list.checked 8 Oct 2026
- Support
- The project invites users to contribute patches, report bugs, and talk to the community.checked 8 Oct 2026
Alternatives to Apache RAT
- 1
DeepFilterNet
Free planOpen sourceAPILinuxmacOSSelf-hosted7.6Free plan - 2
FOSSology
Free planOpen sourceWebAPILinuxmacOS7.5Free plan - 3
ScanCode.io
Free planWebAPILinuxmacOS7.0Free plan - 4
SourceTrust
Free planWeb6.7From $299 a year - 5
FOSSA
Free planWebAPILinuxSelf-hosted6.4Free plan - 6
DejaCode
WebAPILinuxSelf-hosted6.3From $500 a month