# Quick start

## Run a scan

In your project's directory:

```bash
uvx licenseal check
```

[`uvx`](<https://docs.astral.sh/uv/>) runs licenseal without installing it. licenseal reads the manifests and lockfiles under the directory (`pyproject.toml`, `package-lock.json`, and the like), looks up dependency licenses in public registry metadata, and prints a [report](<https://licenseal.shcherbak.ai/get-started/read-the-report/index.md>). It needs Python 3.11 or newer and outbound HTTPS to the [registries](<https://licenseal.shcherbak.ai/security/network/index.md>).

> [!NOTE]
>
> **Private packages.** A package from a private registry is looked up by name on the public registry too, so that registry's operator sees its name and version. If the public registry has a package of the same name, the report shows that package's license. See [What leaves the process](<https://licenseal.shcherbak.ai/security/data-sent/#private-packages>).

## Install it

```bash
uv tool install licenseal    # or: pipx install licenseal
```

In a Python project, it can be a dev dependency instead:

```bash
uv add --dev licenseal       # or: pip install licenseal
```

Then run `licenseal check` (`uv run licenseal check` when it is a project dependency).

## When the check fails

The exit code is non-zero when a dependency is [flagged](<https://licenseal.shcherbak.ai/concepts/check-failures/index.md>) (a [violation, a warning, or an unknown license](<https://licenseal.shcherbak.ai/concepts/verdicts/index.md>) that nobody has [reviewed](<https://licenseal.shcherbak.ai/guides/review-findings/index.md>)) or the scan has analysis gaps (something it could not read).

The most common first failure is a manifest without an up-to-date lockfile. Commit the lockfile, or pass `--no-require-lockfile` to accept versions [estimated](<https://licenseal.shcherbak.ai/concepts/version-resolution/#estimates>) from the registry. For every other failure, see [Fix a failing check](<https://licenseal.shcherbak.ai/guides/fix-a-failing-check/index.md>).

## Review findings with Claude Code

```bash
licenseal install-skill
```

Then run `/licenseal-review` in [Claude Code](<https://claude.com/claude-code>). The bundled skill walks you through each flagged dependency and records your decisions in `licenseal.review.toml`: see [Claude Code skill](<https://licenseal.shcherbak.ai/guides/claude-code-skill/index.md>).

## Defaults

- The whole dependency tree is scanned, without dev dependencies. `--no-transitive` scans direct dependencies only; `--dev` adds dev dependencies.
- Violations always fail. Warnings, unknown licenses, and analysis gaps fail too, unless you pass `--no-strict`.
- The project license is read from a manifest in the scanned directory, never from a nested package. If that does not give a recognised license, the project is checked as `Proprietary`: permissive dependencies pass, copyleft ones are flagged ([details](<https://licenseal.shcherbak.ai/concepts/project-license/index.md>)).

The full rule is in [What fails a check](<https://licenseal.shcherbak.ai/concepts/check-failures/index.md>), and every option in the [CLI reference](<https://licenseal.shcherbak.ai/reference/cli/index.md>).

## Next

- [Read the report](<https://licenseal.shcherbak.ai/get-started/read-the-report/index.md>)
- [Run it in CI](<https://licenseal.shcherbak.ai/guides/ci/index.md>)
- [Claude Code skill](<https://licenseal.shcherbak.ai/guides/claude-code-skill/index.md>)
- [Review flagged dependencies](<https://licenseal.shcherbak.ai/guides/review-findings/index.md>)