License Detector

The license your dependencies actually ship — reconciled against what they claim.

License Detector resolves a repository's dependency lockfiles, determines each package's license by reading the license text the package actually ships and reconciling it against the declared metadata, evaluates the result against a policy you control, and reports a pass / needs-review / blocked verdict.

Most scanners report the label a package declares. License Detector reads the fine print — so it catches the gap (the classic "declares MIT but ships ISC"), modified license text, and dual/OR licensing that label-only tools miss.

This repository is the open-source engine + CLI (Elastic License 2.0). The hosted GitHub App — PR checks, a dashboard, and media/asset-rights scanning on every pull request — lives at licensedetector.com.

---

Install

go install go.licensedetector.com/cmd/license-detector@latest

Requires Go 1.26+. The CLI is a single static binary with an embedded license corpus — no service, no database, and it works offline against its on-disk cache.

Quick start

# Scan the current repo against the built-in zero-config policy
license-detector scan .

# Explain one package's verdict, with the evidence behind it
license-detector explain npm/left-pad@1.3.0

# Identify a single local license file (what is it? has the text been modified?)
license-detector identify LICENSE

# Write a starter policy.yaml you can customize
license-detector init

# Policy-free inventory (never gates) — every dependency + its license
license-detector list .

scan discovers a .license-detector.yaml / policy.yaml by walking up from the target path; pass --policy <file> to point at one explicitly, or - to read it from stdin.

Output formats

scan renders to --format <fmt>:

Format	Use
text (default)	human-readable verdict table
json	machine-readable results
csv	spreadsheet / inventory
spdx, cyclonedx	SBOM export
sarif, github	CI code-scanning surfaces
markdown, html, notice, obligations, table, yaml	docs, notices, attribution

license-detector scan . --format cyclonedx -o sbom.json
license-detector scan . --format sarif -o results.sarif

Using it in CI

scan sets its exit code so it can gate a build:

Exit	Meaning
0	no blocked dependencies (and no configured --strict/--fail-on gate tripped)
1	a blocked dependency (or a configured gate tripped)
2	usage error (bad flags/args/policy, unreadable repo)
3	runtime failure (scan pipeline, render, or --output write failed)

# Fail the job on any blocked dependency
license-detector scan . || exit 1

For a hosted, zero-config experience — a Check Run + self-updating comment on every PR — install the GitHub App.

Full reference & shell integration

The CLI can emit its own complete reference — every command and flag — so you never have to guess:

license-detector docs -o cli-reference.html   # self-contained HTML reference of the whole CLI
license-detector man > license-detector.1     # man page (roff), for packaging
license-detector help                         # top-level help; add --help to any subcommand
license-detector scan --help                  # full flag reference for a command

Shell completion for bash, zsh, or fish:

license-detector completion zsh > _license-detector   # then put it on your $fpath

For a single package's evidence as machine-readable JSON:

license-detector explain npm/left-pad@1.3.0 --format json

Ecosystems

21 ecosystems, discovered anywhere in the tree (monorepos included):

Cargo · CocoaPods · Composer · Conan · Conda · Go modules · Gradle · Hackage · Hex · Julia · Maven · npm · NuGet · opam · pip / PyPI · pub (Dart) · renv (CRAN) · RubyGems · shards (Crystal) · Swift · Unity

Offline & caching

license-detector scan . --offline        # resolve from the disk cache only, no network
license-detector scan . --cache-dir ./x  # override the cache location

--offline degrades uncached dependencies to needs-review; pair it with --fail-on partial to fail on anything unresolved.

Deep scan (assets)

A deep scan additionally reads the rights baked into media you ship — stock and press-agency credits, rights-managed markers, and C2PA content credentials (including AI-generation provenance) across images, video, audio, and 3D models:

license-detector scan . --deep

License

Elastic License 2.0 — see LICENSE. Free to use, copy, modify, and redistribute, with the ELv2 limitations (no providing the software as a hosted/managed service to third parties, no circumventing the license key, no removing notices).

Copyright © 2026 Solid Gradient LLC (Scott Goci).

Contact

• General & support: scott@licensedetector.com · licensedetector.com
• Security: security@licensedetector.com (see CONTRIBUTING.md)

Contributing & this mirror

This repo is a one-way mirror of the oss/ module from a private monorepo — see CONTRIBUTING.md for how issues and changes flow. The hosted product and its source (the server, billing, dashboard) are separate and proprietary.