license-comply

license-comply is a self-hosted tool for examining open-source license risks in Python project dependencies. It reads dependency declarations from pyproject.toml or requirements.txt and, by default, includes installed transitive dependencies. Findings are classified as clean, notice, warning, or critical, with plain-English explanations and remediation steps. Organizations can use policy files to allow, deny, or flag licenses for review. Reports are available in the terminal and in Markdown, HTML, and JSON formats; CI mode provides exit codes for build pipelines. The tool retrieves license metadata through the PyPI JSON API and caches lookup results locally for seven days by default. Optional executive summaries use Claude by default or OpenAI and require an API key. The tool handles SPDX OR and AND expressions, but not complex nested expressions. Its free plan is free and covers Python dependencies with Python 3.9 or later. The project relies on PyPI metadata rather than reading package LICENSE files, so inaccurate or missing metadata may lead to incorrect results. It supports Python packages only, does not detect copied code, and says its output is not legal advice. Its maker, Sam Clearwater, built it to help lawyers and compliance professionals understand what the tool does.

license-comply offers policy-based license checks and multiple report formats for Python dependencies. Its metadata-based analysis has limits, and its results are not legal advice.

license-comply is intended for people reviewing license compliance risks in Python projects, including lawyers and compliance professionals without deep software engineering backgrounds. It can also suit teams that want policy checks and reports in build pipelines.

Overview

license-comply is a self-hosted license compliance tool for Python projects, best suited to teams that need policy checks and readable reports in their development workflow. It is a practical way to flag dependencies for review, provided its metadata-based results are treated as a starting point.

Key features

The tool reads dependencies from pyproject.toml and requirements.txt, then checks installed transitive dependencies by default. That broader scan can bring indirect packages into a project’s review, where a direct-dependency-only check would leave them out.

Findings are grouped as clean, notice, warning, or critical, with plain-English explanations and remediation steps. That makes the output more approachable for compliance professionals and lawyers who may not work in software engineering every day, while giving developers a concrete next step for flagged packages.

Custom policy files let organizations allow, deny, or flag licenses for review. This is useful when a team wants its own rules reflected in checks, but policies cannot compensate for inaccurate package metadata.

Results can be produced in the terminal or as Markdown, HTML, and JSON. CI mode and exit codes support build pipeline checks, making the tool a better fit for ongoing review than for a one-time report alone. It can also look up license metadata through the PyPI JSON API; those results are cached locally for seven days by default. Optional executive summaries use Claude by default or OpenAI and require an API key, so they add a separate setup requirement.

The central limitation is that license-comply reads declared PyPI metadata rather than inspecting package LICENSE files. Missing or incorrect metadata can lead to incorrect findings, and the tool does not identify copied code. It supports Python packages only, and its SPDX handling covers OR and AND expressions but not complex nested expressions. Use it to guide investigation, not to determine legal obligations on its own.

Pricing

Both listed plans are free at free. The Open-source plan is for Python dependencies and requires Python 3.9 or later; the Open source plan is for Python packages and has the same Python version requirement. No paid tier is described, so there is no upgrade price to weigh. These plans are narrow in ecosystem coverage: teams that need license checks for npm, Go modules, or other package types will need another tool.

Platforms

license-comply is self-hosted and supports on-premise deployment, which suits organizations that want to run checks in their own environment. Its source scan method is repository-based, and Python 3.9 or later is required.

Who it's for

This is a good fit for Python teams that want configurable license rules, transitive dependency checks, and reports that can serve both developers and nontechnical compliance colleagues. Lawyers and compliance professionals can use the plain-English findings to understand potential issues, while engineering teams can connect the checks to CI pipelines.

Look elsewhere if your review spans multiple programming ecosystems, depends on reading license text directly, or needs copied-code detection. The project also advises consulting qualified legal counsel for situation-specific guidance.

Pros and cons

• Pros: Transitive dependencies are scanned by default, helping teams include indirect packages in their review.
• Pros: Policy rules, four report formats, and CI exit codes support both organization-specific checks and pipeline use.
• Pros: Plain-English explanations and remediation steps make findings more useful to compliance readers as well as developers.
• Cons: Results rely on PyPI metadata rather than the package’s actual LICENSE text, so errors or gaps in metadata can mislead.
• Cons: Python-only coverage and no copied-code detection limit its usefulness for broader software audits.
• Cons: Complex nested SPDX expressions are not handled, which can constrain interpretation of some license declarations.

Alternatives

Open Source License Compliance Software is a directory of options to compare if you are still choosing a license compliance tool.

Consider Double Open Compliance if you want a freemium option with API, self-hosted, and web platforms. ScanCode.io is another free choice, with API, desktop, server, and web platforms. For a web-based option with free public repository use and a paid per-project tier, consider SourceTrust.

Apache RAT is a free, self-hosted Linux release audit tool. FOSSA may suit teams seeking a freemium service with a free trial and a free plan capped at five projects and ten contributing developers. For self-hosted alternatives, FOSSLight Hub is free and released under AGPL-3.0, while FOSSology is a free toolkit available across desktop, server, API, and web platforms. Licensable offers free public repository use and private repository access during its open beta.

Verdict

Choose license-comply if you manage Python dependencies and want free, self-hosted policy checks with reports that can feed both CI and compliance review. Its strongest case is the combination of customizable rules and accessible explanations. If your process requires direct license text analysis, other ecosystems, or a legal determination, choose a broader review approach and involve qualified counsel.