Skip to content
SPECIFICTION
Get listed

licscan

licscan.dev

Free plan WindowsmacOSLinux
Visit licscan.dev
Spec score 7.7 #13 of 28 in Open Source License Compliance Software

What it is

licscan is a free command-line tool for checking project dependencies for license risk and producing software bills of materials and EU CRA evidence. It supports Go, Node.js, PHP, Python, Ruby, Rust, and Java projects. Its configurable five-level risk model can deny, warn about, or allow licenses, with exceptions. Output formats include table, JSON, HTML, Markdown, CycloneDX, SPDX, CRA PDF, SARIF, and JUnit. CRA mode creates a PDF and an extended CycloneDX JSON SBOM containing manufacturer and product metadata. LicScan runs locally without an account, telemetry, backend connection, or phone-home behavior; the maker describes scans as deterministic for the same inputs. Its official GitHub Action can post verdicts on pull requests, fail builds for denied licenses, and upload SBOM artifacts. SARIF and JUnit outputs support other CI workflows. It runs on Linux, macOS, and Windows, with installation options including Homebrew, curl, and go install. The free open-source plan is listed at free, with $0 per scan and an Apache 2.0 license.

Spec sheet

Purpose
LicScan scans project dependencies for license risk and generates SBOMs and EU CRA evidence.Read 3 Oct 2026 · licscan.dev
Support
The maker directs bug reports to GitHub issues and provides [email protected] for contact.Read 3 Oct 2026 · licscan.dev
Headquarters
Wyoming, USARead 28 Sep 2026 · licscan.dev
Maker
The website identifies codelake Technologies LLC as the maker.Read 3 Oct 2026 · licscan.dev
CRA evidence
CRA mode generates a PDF report and a CRA-extended CycloneDX JSON SBOM with manufacturer and product metadata.Read 3 Oct 2026 · licscan.dev
GitHub Actions
The official GitHub Action can comment scan verdicts on pull requests, fail builds on denied licenses, and upload SBOM artifacts.Read 3 Oct 2026 · licscan.dev
Installation
Install options shown include Homebrew, curl, and go install.Read 3 Oct 2026 · licscan.dev
License policy
A configurable five-level risk model supports deny, warn, and allow exceptions.Read 3 Oct 2026 · licscan.dev
Other CI integrations
The maker describes SARIF support for GitHub Code Scanning and JUnit XML support for Jenkins, GitLab CI, and Azure DevOps.Read 3 Oct 2026 · licscan.dev
Reports
Output formats include table, JSON, HTML, Markdown, CycloneDX, SPDX, CRA PDF, SARIF, and JUnit.Read 3 Oct 2026 · licscan.dev
Reproducibility
The maker describes scans as deterministic, with the same inputs producing the same outputs.Read 3 Oct 2026 · licscan.dev
Security and privacy
The site says LicScan runs locally without an account, telemetry, backend connection, or phone-home behavior.Read 3 Oct 2026 · licscan.dev
Supported ecosystems
It supports Go, Node.js, PHP, Python, Ruby, Rust, and Java projects.Read 3 Oct 2026 · licscan.dev
Supported package managers
The homepage lists seven ecosystems, with roadmap support for CocoaPods and pub.Read 3 Oct 2026 · licscan.dev

Plans and prices

Free / open source Free $0 per scan · Apache 2.0 · standalone CLI Read 3 Oct 2026 · licscan.dev

Every licscan plan and price →

Strong points and limits

Strong points

  • Runs locally without an account or telemetry.
  • Supports seven project ecosystems.
  • Offers multiple report and SBOM formats.
  • GitHub Action can fail builds on denied licenses.
  • Free under Apache 2.0, with $0 per scan.

Limits

  • Roadmap, rather than current support, lists CocoaPods and pub.
  • Runs on Linux, macOS, and Windows only.

Who it suits

licscan suits developers and teams checking dependency license risk or generating SBOMs and EU CRA evidence in local or CI workflows. Its supported ecosystems cover Go, Node.js, PHP, Python, Ruby, Rust, and Java projects.

Verdict

licscan provides local dependency-license checks and a broad set of evidence and CI outputs at no per-scan cost. Confirm that your project ecosystem is among the supported seven before adopting it.

Where Specifiction places it

Alternatives to licscanAll alternatives →