# licenseal > Catch incompatible dependency licenses before they block a release. A fast license compatibility checker for ten ecosystems. licenseal is a command-line tool. `licenseal check` reads the manifests and lockfiles under a directory, resolves the whole dependency tree, looks up each dependency's license in public registry metadata, and compares it with the project's own license. It exits non-zero on a violation and, by default, on a warning, an unknown license, or anything the scan could not read; a decision about a flagged dependency is recorded in `licenseal.review.toml`. It does not install dependencies, run package managers, or download package archives, and its verdicts are not legal advice. ## Get started - [Quick start](): Run a first licenseal scan, install the command, and learn what makes the check fail. - [Read the report](): What each column of the licenseal report shows, what is printed under the table, what to do about a flagged row, and how to write the report to a file. ## Guides - [Run it in CI](): Add licenseal to a CI pipeline: the workflow, lockfiles, publishing the report, and adjusting the gate. - [Claude Code skill](): Install the bundled Claude Code skill and let it walk you through each flagged dependency. - [Fix a failing check](): What to do when licenseal check fails: a violation, a warning, an unknown license, an analysis gap, a review entry that no longer matches, or a scan that could not run. - [Review flagged dependencies](): Record a reviewed license for a flagged dependency in licenseal.review.toml, so that the check passes and the decision stays on record. - [Migrate to 1.0.0](): What to change in a project, its review file, its checked-in report, and its scripts when upgrading licenseal from 0.4.x to 1.0.0. ## How it works - [How a scan works](): The four steps of a licenseal scan: read the manifests and lockfiles, resolve the dependency tree, classify each license, and report a verdict. - [What is scanned](): Which directory licenseal scans, the directories it skips, how to exclude one, and how to scan one package of a monorepo. - [Dependency resolution](): How licenseal finds the whole dependency tree: from the lockfile first, and from the registry where no lockfile covers a dependency. - [Versions and estimates](): Which version of a dependency licenseal reports, when a version or a license is an estimate, and what happens when a lookup fails. - [Off-registry dependencies](): How licenseal reports a dependency that comes from a git repository, a URL, or a path instead of a package registry. - [Project license](): Where licenseal reads your project's own license from, and what it assumes when it finds none. - [How licenseal decides](): The four verdicts, the risk level of each license family, the compatibility matrix, and the rules for specific license pairs. - [License expressions](): How licenseal reads a license string: OR, AND and WITH, malformed expressions, license lists, and R's file LICENSE. - [What fails a check](): Strict mode, flagged dependencies, analysis gaps, and manifests without a lockfile: what makes licenseal check exit non-zero. ## Ecosystems - [Supported ecosystems](): The ten ecosystems licenseal scans, with the registry, manifest files and lockfiles read for each. - [Python](): Python: the files licenseal reads, what counts as a dev dependency, what is off-registry, and what is not evaluated. - [JavaScript and TypeScript](): JavaScript and TypeScript: the files licenseal reads, what counts as a dev dependency, what is off-registry, and what is not evaluated. - [Rust](): Rust: the files licenseal reads, what counts as a dev dependency, what is off-registry, and what is not evaluated. - [Go](): Go: the files licenseal reads, what counts as a dev dependency, what is off-registry, and what is not evaluated. - [Java and the JVM](): Java and the JVM: the files licenseal reads, what counts as a dev dependency, what is off-registry, and what is not evaluated. - [.NET](): .NET: the files licenseal reads, what counts as a dev dependency, what is off-registry, and what is not evaluated. - [PHP](): PHP: the files licenseal reads, what counts as a dev dependency, what is off-registry, and what is not evaluated. - [Ruby](): Ruby: the files licenseal reads, what counts as a dev dependency, and what is off-registry. - [Elixir and Erlang](): Elixir and Erlang: the files licenseal reads, what counts as a dev dependency, and what is off-registry. - [R](): R: the files licenseal reads, what counts as a dev dependency, what is off-registry, and what is not evaluated. ## Reference - [CLI reference](): Every licenseal command and option, with defaults and exit codes. - [Review file](): The keys of a licenseal.review.toml entry and the rules an entry must meet. - [JSON report](): The JSON document that licenseal check -f json writes: an example, the top-level fields, and the summary block. - [Dependency fields](): Every field of a dependencies entry in the JSON report. - [URLs and next steps](): Which URLs of the JSON report can be trusted, and the actionability block of a flagged entry. - [Diagnostics](): The diagnostics block of the JSON report: what the scan could not read, read with a caveat, or estimated. ## Security - [Security model](): What licenseal reads, what it never does, and which files can decide a verdict. - [What leaves the process](): What licenseal sends to public registries, what it never sends, and when a private package's name is disclosed. - [Network egress](): The fourteen public registry hosts licenseal can contact, what each is asked, and the rules that hold for all of them. - [License sources](): For each registry host: when it is asked, which field a license is read from, and when the license is an estimate. ## Optional - [Changelog](): What changed in each licenseal release, and how to upgrade.