license-comply
license-comply is a free, self-hosted scanner for open-source licenses in Python project dependencies.
What license-comply is
license-comply is a free, self-hosted scanner for open-source licenses in Python project dependencies. It reads pyproject.toml or requirements.txt and normally includes installed transitive dependencies. Findings are labeled clean, notice, warning, or critical, with plain-language explanations and remediation steps. Policy files let organizations allow, deny, or flag licenses for review. Reports can be produced in the terminal, Markdown, HTML, or JSON, while CI mode supplies exit codes for build pipelines. The tool retrieves license metadata through the PyPI JSON API and caches lookup results locally for seven days by default. Optional summaries use Claude or OpenAI and require an API key. It supports SPDX OR and AND expressions, but not complex nested expressions. It is Python-only, relies on declared PyPI metadata rather than license files, and does not detect copied code. Its output is not legal advice.
Good
- Free plan supports Python 3.9 or later
- Scans transitive dependencies by default
- Offers terminal, Markdown, HTML, and JSON reports
- Custom policies allow, deny, or flag licenses
- CI mode provides build-pipeline exit codes
Watch out
- Supports Python packages only
- Relies on PyPI metadata, not license files
- Does not detect copied code
- AI summaries require an API key
Who it suits
It is intended for lawyers and compliance professionals who need understandable reports without deep software-engineering backgrounds. Python teams can also use its policy and CI features.
Verdict
license-comply provides structured license-risk findings and policy enforcement for Python dependencies. Its metadata and ecosystem limits mean results need appropriate review.
Plans and prices
From license-comply's own pricing page, checked 7 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Open source | Free | Python packages only · requires Python 3.9 or later |
| Open-source | Free | Python dependencies only · Python 3.9+ |
The facts
Each one read from license-comply's own pages, with the date it was checked.
What it does
- AI summaries
- Optional executive summaries use Claude by default or OpenAI and require an API key.checked 7 Oct 2026
- Caching
- PyPI lookup results are cached locally for seven days by default.checked 7 Oct 2026
- Custom policies
- Policy files let organizations allow, deny, or flag licenses for review.checked 7 Oct 2026
- Dependency discovery
- Reads dependencies from pyproject.toml or requirements.txt and scans installed transitive dependencies by default.checked 7 Oct 2026
- Ecosystem limitation
- It supports Python packages and does not yet support npm, Go modules, or other ecosystems.checked 7 Oct 2026
- Integrations
- Looks up license metadata through the PyPI JSON API and supports optional AI summaries using Claude or OpenAI, which require an API key.checked 7 Oct 2026
- Intended audience
- The author says the tool is intended to help lawyers and compliance professionals who may not have deep software engineering backgrounds understand what it does and why.checked 7 Oct 2026
- Legal limitation
- The project says its output is not legal advice and recommends consulting qualified legal counsel for situation-specific advice.checked 7 Oct 2026
- License expression support
- It handles SPDX OR and AND expressions but not complex nested expressions.checked 7 Oct 2026
- Limits
- The tool relies on declared PyPI metadata rather than scanning license files, supports Python packages only, and does not detect copied code.checked 7 Oct 2026
- Metadata limitation
- The tool relies on PyPI metadata rather than scanning the actual text of package LICENSE files, so inaccurate or missing metadata may produce incorrect results.checked 7 Oct 2026
- Policy rules
- A customizable policy engine lets organizations allow, deny, or flag licenses for review.checked 7 Oct 2026
- Purpose
- Scans Python project dependencies for open-source licenses and analyzes compliance risks based on project type.checked 7 Oct 2026
- Report formats
- Reports can be generated in terminal, Markdown, HTML, and JSON formats.checked 7 Oct 2026
- Reports
- Generates terminal, Markdown, HTML, and JSON reports, with CI mode and exit codes for build pipelines.checked 7 Oct 2026
- Risk analysis
- Findings are rated clean, notice, warning, or critical and include plain-English explanations and remediation steps.checked 7 Oct 2026
- Risk reports
- Reports findings as clean, notice, warning, or critical, with plain-English explanations and remediation steps.checked 7 Oct 2026
- Security reporting
- The security policy asks users to report vulnerabilities through GitHub private vulnerability reporting and says not to open a public issue for them.checked 7 Oct 2026
- Support
- The project invites bug reports and feature requests through GitHub issues and welcomes pull requests.checked 7 Oct 2026
The company
- Maker
- The project says it was built by Sam Clearwater, a technology and AI lawyer.checked 7 Oct 2026
Alternatives to license-comply
- 1
DeepFilterNet
Free planOpen sourceAPILinuxmacOSSelf-hosted7.6Free plan - 2
FOSSology
Free planOpen sourceWebAPILinuxmacOS7.5Free plan - 3
ScanCode.io
Free planWebAPILinuxmacOS7.0Free plan - 4
SourceTrust
Free planWeb6.7From $299 a year - 5
FOSSA
Free planWebAPILinuxSelf-hosted6.4Free plan - 6
DejaCode
WebAPILinuxSelf-hosted6.3From $500 a month