# CLI reference

```bash
licenseal check                 # scan the current project and exit non-zero when the check fails
licenseal init-review-file      # scaffold a licenseal.review.toml for flagged dependencies
licenseal install-skill         # install the Claude Code review skill into the project
licenseal --version             # print the version and exit
```

## `licenseal check`

| Flag | Default | Notes |
| --- | --- | --- |
| `--path DIRECTORY`, `-p DIRECTORY` | `.` | Directory to scan (see [What is scanned](<https://licenseal.shcherbak.ai/concepts/discovery/index.md>)) |
| `--format FMT`, `-f FMT` | `table` | `table`, `json`, or `markdown` |
| `--output FILE`, `-o FILE` | — | Write the report to FILE instead of stdout |
| `--dev / --no-dev` | `--no-dev` | Include dev dependencies |
| `--strict / --no-strict` | `--strict` | Also fail on warnings, unknowns, and [analysis gaps](<https://licenseal.shcherbak.ai/concepts/check-failures/#analysis-gaps>) (violations always fail). See [What fails a check](<https://licenseal.shcherbak.ai/concepts/check-failures/index.md>) |
| `--require-lockfile / --no-require-lockfile` | `--require-lockfile` | Whether a [manifest without a lockfile](<https://licenseal.shcherbak.ai/concepts/check-failures/#a-manifest-without-a-lockfile>) is an analysis gap. `--no-require-lockfile` accepts the estimated or incomplete result and reports it without failing. No effect with `--no-transitive`. |
| `--transitive / --no-transitive` | `--transitive` | Full-tree scan, or direct dependencies only |
| `--max-depth N` | `50` | Cap the depth of a registry walk (see [Dependency resolution](<https://licenseal.shcherbak.ai/concepts/dependency-resolution/index.md>)), 1 to 100. A usage error with `--no-transitive` |
| `--max-workers N` | `16` | Concurrent registry requests, 1 to 32 |
| `--exclude-dirs PATH[,PATH...]` | — | Skip subdirectories during discovery, beyond the [directories that are always skipped](<https://licenseal.shcherbak.ai/concepts/discovery/#directories-that-are-skipped>). Comma-separated, repeatable, relative to `--path` or absolute. A subdirectory with its own `.git` is skipped without it. |

Common invocations:

```bash
licenseal check                              # full-tree scan (default; lockfile-first, registry fallback)
licenseal check --no-transitive              # direct dependencies only (use when publishing a library)
licenseal check --dev                        # also include dev dependencies
licenseal check --no-strict                  # don't fail on warnings, unknowns, or analysis gaps (violations still fail)
licenseal check --no-require-lockfile        # no lockfile committed: accept versions and transitives estimated from the registry
licenseal check -f json -o report.json       # machine-readable output for CI tooling
licenseal check -f markdown -o LICENSES.md   # Markdown audit, suitable for a PR comment
licenseal check --exclude-dirs third_party,scratch  # skip subtrees not already in the default skip set
```

## `licenseal init-review-file`

| Flag | Default | Notes |
| --- | --- | --- |
| `--path DIRECTORY`, `-p DIRECTORY` | `.` | Project directory, where `licenseal.review.toml` is written. Without `--from-report` it is scanned as `check` scans it by default |
| `--dev / --no-dev` | `--no-dev` | Include dev dependencies |
| `--from-report FILE` | — | Read [flagged](<https://licenseal.shcherbak.ai/concepts/check-failures/index.md>) dependencies from a saved JSON report instead of scanning (no registry request). A usage error together with `--dev` / `--no-dev`, `--max-workers`, or `--exclude-dirs`, which only apply to a scan |
| `--merge` | — | Add new flagged entries to an existing review file; existing entries are kept. Without it, the command stops with an error rather than change an existing file |
| `--max-workers N` | `16` | Concurrent registry requests, 1 to 32 |
| `--exclude-dirs PATH[,PATH...]` | — | Skip subdirectories during discovery, as for `check` |

The workflow is in [Review flagged dependencies](<https://licenseal.shcherbak.ai/guides/review-findings/index.md>).

## `licenseal install-skill`

| Flag | Default | Notes |
| --- | --- | --- |
| `--path DIRECTORY`, `-p DIRECTORY` | `.` | Project directory to install into (`.claude/skills/`) |
| `--force` | — | Overwrite a hand-edited skill. An unedited earlier install is refreshed without it |

See [Claude Code skill](<https://licenseal.shcherbak.ai/guides/claude-code-skill/index.md>).

## Exit codes

| Code | Meaning |
| --- | --- |
| `0` | The check passed, or the command did what it was asked |
| `1` | The check failed (see [What fails a check](<https://licenseal.shcherbak.ai/concepts/check-failures/index.md>)), or the command ended with an error |
| `2` | A usage error: an unknown command or option, a value an option does not accept (a `--path` that is not a directory, `--max-workers 99`), or a combination the command rejects |

An error prints an `Error:` line on stderr and no report; a failed check prints the report. [Fix a failing check](<https://licenseal.shcherbak.ai/guides/fix-a-failing-check/index.md>) covers both.

## Environment

Registry requests go through the proxy that `HTTPS_PROXY` or `ALL_PROXY` names, and `NO_PROXY` exempts hosts from it: see [Proxies](<https://licenseal.shcherbak.ai/security/network/#proxies>).