licscan
Wyoming, USA
What it is
licscan is a free command-line tool for checking project dependencies for license risk and producing software bills of materials (SBOMs) and EU CRA evidence. It supports Go, Node.js, PHP, Python, Ruby, Rust, and Java projects. A configurable five-level policy model lets teams deny, warn about, or allow licenses, with exceptions. Reports can be generated as tables, JSON, HTML, Markdown, CycloneDX, SPDX, CRA PDFs, SARIF, or JUnit. CRA mode produces a PDF and a CRA-extended CycloneDX JSON SBOM containing manufacturer and product metadata. The maker says scans run locally without an account, telemetry, backend connection, or phone-home behavior, and that identical inputs produce identical results. Its GitHub Action can post verdicts on pull requests, fail builds for denied licenses, and upload SBOM artifacts. SARIF and JUnit outputs support other CI workflows. LicScan runs on Linux, macOS, and Windows, with installation options including Homebrew, curl, and go install. The listed free plan costs nothing and is Apache 2.0 licensed.
For and against
For
- Supports seven project ecosystems.
- Offers a configurable five-level license risk policy.
- Generates multiple SBOM and CI report formats.
- Runs locally without an account or telemetry.
Against
- Command-line tool rather than a listed web application.
- No free trial is listed.
The verdict
licscan combines dependency license checks, SBOM generation, and CI-oriented reporting in a free command-line tool. Its supported ecosystems and output formats are clearly specified for teams evaluating policy enforcement needs.
Who it suits
licscan suits developers and teams that need to check dependency licenses or generate SBOMs and EU CRA evidence. Its policy controls and CI integrations may fit projects that enforce license rules during builds.
Plans and prices
Free / open source
$0 per scan · Apache 2.0 · standalone CLI
Read 3 Oct 2026 · licscan.dev
On the record
- CRA evidence
- CRA mode generates a PDF report and a CRA-extended CycloneDX JSON SBOM with manufacturer and product metadata.licscan.dev · read 3 Oct 2026
- GitHub Actions
- The official GitHub Action can comment scan verdicts on pull requests, fail builds on denied licenses, and upload SBOM artifacts.licscan.dev · read 3 Oct 2026
- Installation
- Install options shown include Homebrew, curl, and go install.licscan.dev · read 3 Oct 2026
- License policy
- A configurable five-level risk model supports deny, warn, and allow exceptions.licscan.dev · read 3 Oct 2026
- Maker
- The website identifies codelake Technologies LLC as the maker.licscan.dev · read 3 Oct 2026
- Other CI integrations
- The maker describes SARIF support for GitHub Code Scanning and JUnit XML support for Jenkins, GitLab CI, and Azure DevOps.licscan.dev · read 3 Oct 2026
- Purpose
- LicScan scans project dependencies for license risk and generates SBOMs and EU CRA evidence.licscan.dev · read 3 Oct 2026
- Reports
- Output formats include table, JSON, HTML, Markdown, CycloneDX, SPDX, CRA PDF, SARIF, and JUnit.licscan.dev · read 3 Oct 2026
- Reproducibility
- The maker describes scans as deterministic, with the same inputs producing the same outputs.licscan.dev · read 3 Oct 2026
- Security and privacy
- The site says LicScan runs locally without an account, telemetry, backend connection, or phone-home behavior.licscan.dev · read 3 Oct 2026
- Support
- The maker directs bug reports to GitHub issues and provides [email protected] for contact.licscan.dev · read 3 Oct 2026
- Supported ecosystems
- It supports Go, Node.js, PHP, Python, Ruby, Rust, and Java projects.licscan.dev · read 3 Oct 2026
- Supported package managers
- The homepage lists seven ecosystems, with roadmap support for CocoaPods and pub.licscan.dev · read 3 Oct 2026
