Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

licscan review

Free#9 of 28 in Open Source License Compliance Software

A free CLI for blocking license-policy violations and exporting compliance evidence in CI.

8.2/10Editor score
Visit licscan
licscan8.2 Visit licscan

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

licscan is a local command-line tool for engineering teams that need dependency license checks and software-bill-of-materials output. It scans manifests and lockfiles for Go, Node.js, PHP, Python, Ruby, Rust, and Java projects. The tool runs on Windows, macOS, and Linux as a standalone local binary, with no account or telemetry. Its policy model supports configurable allow, warn, and deny decisions, including CI build failures when dependencies violate policy.

The published Free plan costs $0 per scan and includes local scanning, license policy checks, CycloneDX and SPDX SBOM generation, and EU Cyber Resilience Act evidence export. The free offering also covers attribution notices through THIRD_PARTY_LICENSES files and report output in JSON, HTML, Markdown, SARIF, and JUnit formats. There are no separate paid tiers to compare, so licscan fits teams seeking an open-source compliance utility rather than a tiered hosted service.

CI and ecosystem fit are central to the product. licscan provides an official GitHub Action and integrations for GitHub Actions, GitLab CI, Jenkins, Azure DevOps, and GitHub Code Scanning. It can export CycloneDX 1.5 and SPDX 2.3 SBOMs, generate EU CRA PDF and SBOM evidence, and classify licenses by risk level. Teams that want local, repository-based enforcement across the supported ecosystems should consider licscan. Teams needing broader language coverage or a visual, account-based workflow should choose an alternative.

licscan pros and cons

  • Where it wins
    • Free open-source scanning with no account or telemetry
    • Supports seven package ecosystems and configurable license policies
    • Exports SBOMs, attribution notices, reports, and EU CRA evidence
  • Where it doesn't
    • Command-line workflow may not suit teams wanting a visual interface
    • Coverage is limited to seven package ecosystems
    • No paid tiers or expanded commercial feature set are published

licscan fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update