Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

OHRisk

Free#10 of 28 in Open Source License Compliance SoftwareOpen Source Package Health Tools

OHRisk: A free, open-source CLI for local license gates, CI checks, waivers, and SBOM output. Ranked #10 of 28 in Open Source License Compliance Software by our editors (8.1/10); pricing: Free plan; best for local developers needing license gates.

8.1/10Editor score
Visit OHRisk
OHRisk8.1 Visit OHRisk

At a glance

  • Editor score
    8.1 / 10
  • Pricing
    Free plan
  • Best for
    Local developers needing license gates
  • Free plan
    Yes
  • Paid from
    Free
  • Policy enforcement
    Both
  • Facts checked
    20 Sep 2026
OHRisk screenshot

  • Where it wins

    • Local scanning with usage profiles for SaaS and distributed applications
    • Configurable CI thresholds, waivers, and dependency-difference analysis
    • CycloneDX SBOMs plus SARIF, HTML, Markdown, JSON, and terminal reports

  • Where it doesn't

    • Verified CI integration coverage is limited to GitHub Actions
    • Requires Node.js and command-line workflows
    • Positioned as a risk decision aid, not legal advice

Our verdict on OHRisk

OHRisk is a free, open-source command-line tool from 0disoft for developers assessing open-source license risk before merging or shipping dependencies. It runs on Windows, macOS, and Linux, with self-hosted and on-premise deployment options. The npm package runs on Node.js and analyzes dependency manifests, lockfiles, and SBOM inputs. Usage profiles for SaaS and distributed applications help classify findings in the context of how software is used, making OHRisk a focused fit for local development teams that want license gates close to the code.

Its strongest area is the connection between local analysis and release controls. CI threshold gating lets teams set configurable fail levels, while license-risk waivers and baselines provide workflows for handling accepted exceptions. Dependency-difference analysis against a Git baseline can focus review on what changed rather than requiring every dependency to be assessed as a new decision. The GitHub Actions composite action extends this workflow into CI, and reports can be generated as terminal output, HTML, Markdown, JSON, SARIF, or CycloneDX SBOMs. Deterministic third-party notices generation adds a repeatable way to produce attribution material.

OHRisk also supports obligation tracking, attribution reports, multiple source scan methods, and SBOM imports in CycloneDX JSON/XML, SPDX JSON/RDF, and SPDX tag-value formats. That breadth suits teams that need local control and machine-readable outputs without adopting a larger hosted platform. The trade-off is ecosystem scope: the verified integration is GitHub Actions, so teams centered on other CI systems may need to adapt their workflow. OHRisk should appeal to developers who prefer an open-source, local CLI with configurable policy decisions; organizations seeking broader native integrations or legal guidance should consider a different approach.

Your product? Our editors can test OHRisk in depth and publish a review, labelled as paid · from $149/mo →

OHRisk pricing

Plans Free planFree Free to use — no paid tier required for the core job.
See plans on github.com

OHRisk fact sheet

Free planYes
Paid fromFree
Policy enforcementBoth
Obligation trackingYes
Attribution reportsYes
SBOM import formatsCycloneDX JSON/XML; SPDX JSON/RDF; SPDX tag-value
Deployment optionsOn-premise
Source scan methodsMultiple
DeploymentSelf-hosted
PlatformsWindows, macOS, Linux
SupportDocs
Built forSolo, Small business (editorial estimate)
Integrations1 integrations: GitHub Actions
PricingFree plan
Websitegithub.com
Facts checked20 Sep 2026

OHRisk integrations

OHRisk lists 1 integrations on its own site.

  • GitHub Actions

Alternatives to OHRisk

See all OHRisk alternatives →

Also Ranked In

OHRisk is ranked in 2 of our directories.

Used OHRisk? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used OHRisk for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Your rating

0 characters · at least 80, up to 3,000

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Featured on iTechGuides — OHRisk 8.1/10

OHRisk is listed in our Open Source License Compliance Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/ohrisk/"><img src="https://www.itechguides.com/best/badge/ohrisk.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update