Skip to content
SPECIFICTION
Get listed

OHRisk

github.com

Free plan WindowsmacOSLinux
Visit github.com
Spec score 7.5 #3 of 14 in Open Source Package Health Tools

What it is

OHRisk is a local command-line tool for assessing open-source license risk in software dependencies. It evaluates dependencies against SaaS or distributed-app usage profiles and reports findings as low, review, high, or unknown. Inputs span package information from npm, Rust, Go, Python, Java, .NET, Ruby, and PHP, plus CycloneDX or SPDX software bills of materials. It can use local package evidence and selected remote evidence sources, with checksum and identity validation described for supported ecosystems. Reports can be generated for the terminal or as JSON, HTML, Markdown, SARIF 2.1.0, or CycloneDX 1.5 JSON. A bundled GitHub Actions composite action supports scan, ci, and diff commands; the guide also documents SARIF upload to GitHub code scanning. Local waiver files can keep findings visible in reports while excluding them from CI threshold failures. OHRisk is free under the MIT License and distributed as an npm package, also runnable with pnpm, Yarn, or Bun. The packaged CLI requires Node.js 24.0.0 or later. It is a risk decision aid, not a replacement for legal review.

Spec sheet

Purpose
Ohrisk is a local CLI that catches open-source license risk before a pull request ships.Read 29 Sep 2026 · github.com
License
The repository provides Ohrisk under the MIT License.Read 29 Sep 2026 · github.com
Maker
The GitHub maker profile is named 0disoft (ZeroDi) and lists Republic of Korea as its location.Read 29 Sep 2026 · github.com
CI integration
A bundled GitHub Actions composite action supports scan, ci, and diff commands, and the guide documents SARIF upload to GitHub code scanning.Read 29 Sep 2026 · github.com
Dependency coverage
The README lists supported dependency inputs across ecosystems including npm, Rust, Go, Python, Java, .NET, Ruby, PHP, and CycloneDX or SPDX SBOMs.Read 29 Sep 2026 · github.com
Install
Ohrisk is distributed as an npm package and can also be run using pnpm, Yarn, or Bun package-manager commands.Read 29 Sep 2026 · github.com
License evidence
Ohrisk can use local package evidence and selected remote evidence sources with checksum and identity validation described for supported ecosystems.Read 29 Sep 2026 · github.com
Not legal advice
Ohrisk describes itself as a risk decision aid and says it does not replace legal review.Read 29 Sep 2026 · github.com
Outputs
It can generate terminal, JSON, HTML, Markdown, SARIF 2.1.0, and CycloneDX 1.5 JSON reports.Read 29 Sep 2026 · github.com
Risk profiles
It evaluates dependencies under SaaS or distributed-app usage profiles and reports low, review, high, or unknown findings.Read 29 Sep 2026 · github.com
Runtime
The packaged CLI runs on Node.js version 24.0.0 or later, and users do not need Bun installed.Read 29 Sep 2026 · github.com
Scope limitation
The README states several dependency sources and graph types are not scanned yet, including Gradle graph reconstruction and remote Terraform Registry metadata.Read 29 Sep 2026 · github.com
Waivers
Local waiver files can suppress findings from CI threshold failures while keeping waived findings visible in reports.Read 29 Sep 2026 · github.com

Plans and prices

Ohrisk Free Open-source CLI · MIT License Read 29 Sep 2026 · github.com

Every OHRisk plan and price →

Strong points and limits

Strong points

  • Free plan and MIT-licensed.
  • Supports dependency inputs across several ecosystems.
  • Generates terminal, JSON, HTML, Markdown, SARIF, and CycloneDX reports.
  • Waivers remain visible while avoiding CI threshold failures.
  • Bundled GitHub Actions action supports scan, ci, and diff.

Limits

  • Requires Node.js 24.0.0 or later.
  • Some dependency sources and graph types are not scanned yet.
  • Does not replace legal review.

Who it suits

OHRisk suits teams that want to assess dependency-license risk in CI or produce reports in several formats. It is for technical teams comfortable with a local CLI and Node.js 24.0.0 or later.

Verdict

OHRisk combines multiple dependency inputs, report formats, and CI workflows in a free local CLI. Check its stated coverage gaps and treat its results as risk guidance rather than legal review.

Where Specifiction places it

Alternatives to OHRiskAll alternatives →