Skip to content

Quick start#

Run a scan#

In your project's directory:

uvx licenseal check

uvx runs licenseal without installing it. licenseal reads the manifests and lockfiles under the directory (pyproject.toml, package-lock.json, and the like), looks up dependency licenses in public registry metadata, and prints a report. It needs Python 3.11 or newer and outbound HTTPS to the registries.

Note

Private packages. A package from a private registry is looked up by name on the public registry too, so that registry's operator sees its name and version. If the public registry has a package of the same name, the report shows that package's license. See What leaves the process.

Install it#

uv tool install licenseal    # or: pipx install licenseal

In a Python project, it can be a dev dependency instead:

uv add --dev licenseal       # or: pip install licenseal

Then run licenseal check (uv run licenseal check when it is a project dependency).

When the check fails#

The exit code is non-zero when a dependency is flagged (a violation, a warning, or an unknown license that nobody has reviewed) or the scan has analysis gaps (something it could not read).

The most common first failure is a manifest without an up-to-date lockfile. Commit the lockfile, or pass --no-require-lockfile to accept versions estimated from the registry. For every other failure, see Fix a failing check.

Review findings with Claude Code#

licenseal install-skill

Then run /licenseal-review in Claude Code. The bundled skill walks you through each flagged dependency and records your decisions in licenseal.review.toml: see Claude Code skill.

Defaults#

  • The whole dependency tree is scanned, without dev dependencies. --no-transitive scans direct dependencies only; --dev adds dev dependencies.
  • Violations always fail. Warnings, unknown licenses, and analysis gaps fail too, unless you pass --no-strict.
  • The project license is read from a manifest in the scanned directory, never from a nested package. If that does not give a recognised license, the project is checked as Proprietary: permissive dependencies pass, copyleft ones are flagged (details).

The full rule is in What fails a check, and every option in the CLI reference.

Next#