license-comply vs SourceTrust
license-comply
github.comSourceTrust
sourcetrust.devSide by side
| Figure | license-comply | SourceTrust |
|---|---|---|
| Price from | Free | $24.92/mo |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | — | Yes |
| Self-hosted | Yes | — |
| Plans published | 2 | 6 |
| Spec score · Open Source License Compliance Software | 8.0 (#11) | 7.6 (#20) |
| Integrations | Looks up license metadata through the PyPI JSON API and supports optional AI summaries using Claude or OpenAI, which require an API key. | The site lists GitHub, GitLab, and Azure DevOps repository connections, plus lockfile and SBOM imports. |
| Purpose | Scans Python project dependencies for open-source licenses and analyzes compliance risks based on project type. | SourceTrust helps teams review third-party software licenses and publish a shareable license compliance page for products they ship. |
| Support | The project invites bug reports and feature requests through GitHub issues and welcomes pull requests. | SourceTrust offers a live walkthrough and lists [email protected] for platform questions. |
Plans
SourceTrust
- Open sourceFree
- Per project — monthly$29 a month
- Per project — yearly$299 a year
- Extra watched branch$550 a month
- Custom domain$49,499 a month
- Security monitoringPrice not published
In their own words
license-comply
license-comply has no write-up on Specifiction yet; its figures are above.
SourceTrust
SourceTrust helps teams review third-party software licenses and publish shareable compliance pages for shipped products. It collects direct and transitive dependencies from repositories, lockfiles, and SBOMs into one inventory. The service retrieves each shipped package, compares it with the registry digest, and reads the license text inside. Nothing is published until a team reviews and confirms the record, while packages needing a decision are flagged. Connections include GitHub, GitLab, and Azure DevOps, with lockfile and SBOM imports across 14 formats and 9 ecosystems. Outputs include a hosted attestation page, THIRD_PARTY_LICENSES.md, NOTICE, CycloneDX, SPDX, JSON, CSV, plist, and branded PDF. Repository synchronization and publish-drift checks identify changes from the published snapshot. Pages can be password-protected or excluded from search engines. Eligible public GitHub projects can publish for $0 under fair use and attribution. Yearly project billing is $299.00 per year.