licscan

LicScan is a repository-scanning command-line tool for teams that need dependency-license decisions and compliance deliverables without sending project data to a service. It suits developers and compliance engineers who can incorporate a CLI into local or CI workflows. The main compromise is its standalone, repository-focused operation rather than a hosted review workspace.

Overview

LicScan covers Go, Node.js, PHP, Python, Ruby, Rust, and Java projects. Its configurable five-level risk model supports deny, warn, and allow exceptions, so a team can express policy choices instead of treating every detected license alike. That is valuable where builds must stop on unacceptable licenses, while the flexibility also puts responsibility on the team to define and maintain sensible thresholds.

The maker says scans run locally without an account, telemetry, backend connection, or phone-home behavior. It also describes deterministic results, with identical inputs producing identical outputs. Those characteristics are strong reasons to choose LicScan for privacy-sensitive repositories and repeatable compliance pipelines. Projects built around CocoaPods or pub should wait for the stated roadmap support or use another scanner, since those ecosystems are not in the current list.

Key features

LicScan can render table, JSON, HTML, Markdown, CycloneDX, SPDX, CRA PDF, SARIF, and JUnit output. Human-readable formats help reviewers inspect findings, while CycloneDX and SPDX support SBOM exchange and SARIF or JUnit can feed established CI reporting systems. CRA mode goes further by producing a PDF plus a CRA-extended CycloneDX JSON SBOM containing manufacturer and product metadata, giving teams a focused evidence package for that requirement.

The official GitHub Action can comment verdicts on pull requests, fail builds when licenses are denied, and upload SBOM artifacts. SARIF support targets GitHub Code Scanning, and JUnit XML is described for Jenkins, GitLab CI, and Azure DevOps. These integrations make the policy engine operational rather than merely informative, although the tool remains a CLI that teams must wire into their own workflows.

Installation is available through Homebrew, curl, and go install. Repository scans run on the local machine, with on-premise deployment and attribution reports included in the offering.

Pricing

Free / open source — free ($0 per scan). The Apache 2.0 standalone CLI includes both policy enforcement and attribution reports, with no paid tier or trial requirement. It is the natural fit for individual developers and teams that can operate their own scans and CI jobs. Because this is a free, self-managed CLI rather than a hosted plan, organizations wanting a centralized service or managed operations should evaluate alternatives.

Platforms

LicScan runs on Linux, macOS, and Windows. Its supported project ecosystems are Go, Node.js, PHP, Python, Ruby, Rust, and Java, with CocoaPods and pub identified as roadmap targets. The maker is codelake Technologies LLC, headquartered in Wyoming, USA; bug reports go to GitHub issues and contact is available at [email protected].

Who it's for

Choose LicScan if your team wants license gates in pull requests or builds, needs SBOM and CRA artifacts in standard formats, and requires scans to stay local. It is particularly well suited to privacy-conscious engineering groups that value deterministic output and on-premise operation. It is a weaker match for organizations seeking a browser-based, centrally administered service or immediate support for ecosystems outside its current seven.

Pros and cons

• Pros: Five-level risk policy with deny, warn, and allow exceptions; unusually broad report selection including CRA PDF and extended CycloneDX; local, account-free operation with stated no-telemetry behavior; GitHub, SARIF, and JUnit paths for CI enforcement.
• Cons: Standalone repository CLI requires teams to build their own operating workflow; current ecosystem coverage excludes CocoaPods and pub; no hosted plan is offered for centralized administration.

Alternatives

Open Source License Compliance Software is the broader category guide for comparing open-source options. Pick ScanCode.io instead if you want a free Apache-2.0 system that runs as a Docker container or on a Linux server. FOSSology is another free, open-source license-compliance toolkit and system. Choose OHRisk for a free MIT-licensed open-source CLI. ScanCode Toolkit is a free software code-scanning tool. Apache Flink CDC is free Apache-licensed software distributed as released JARs and connectors. SBOM Workbench is a free download with a public repository and open-source distributed software. SourceTrust suits users wanting a web service, with a free public-repository option and a $29.00-per-month per-project plan. Apache RAT is a free, self-hosted Linux release-audit tool.

Verdict

LicScan is a strong choice for engineering teams that want enforceable dependency-license policy, reproducible local scans, and SBOM or CRA outputs inside existing CI. Its privacy posture and format coverage are the main reasons to choose it. Look elsewhere if you need a hosted management layer or current support for package ecosystems beyond its present scope.