Know every license in your dependency tree. Prove it to anyone.

licenseproof scans your npm and Python lockfiles, resolves the real license of every package, including the ones with missing or lying metadata, and flags conflicts against your project's license in plain English. Free scanner. Lawyer-ready reports when you need them.

npx licenseproof scan
See a real report Get the report tier ($29)
Terminal recording of licenseproof scan finding a GPL license conflict in a real npm dependency

The moment this tool exists for

A customer's procurement team asks for your open-source license inventory. An acquirer's lawyers ask during diligence. A compliance checklist asks before the enterprise deal closes. You have 800 transitive dependencies and an afternoon. licenseproof turns that afternoon into ninety seconds: scan, review the flags, hand over a report that looks like you take this seriously, because you do.

How it works

1

Scan free, forever

npx licenseproof scan reads package-lock, pnpm, yarn, uv, poetry, or requirements.txt. Every package resolved through five fallback steps: SPDX expressions, license-file fingerprinting, README. Each answer is tagged with its source and confidence. Unknown never hides. Unknown does not mean safe.

2

Read the flags in plain English

Conflicts and review items are explained like a colleague would: what the license is, why it matters for your project's license, what to do next. AGPL gets called out loudly. CI mode: --fail-on conflict.

3

Generate the artifact

One command renders an audit-ready HTML or PDF report, THIRD_PARTY_NOTICES, and SBOMs (CycloneDX free, SPDX in the report tier). Offline. Your code never leaves your machine.

Pricing

Free, forever The full scanner: every ecosystem, JSON output, CI exit codes, CycloneDX SBOM. No account, no telemetry, no network calls.

Individual

$29 perpetual

  • Audit-ready HTML + PDF reports
  • THIRD_PARTY_NOTICES generation
  • SPDX SBOM
  • 1 year of reference-data updates
  • The tool never stops working, ever
Buy Individual ($29)

Agency

$99 perpetual

  • Everything in Individual
  • Licensed for client work
  • Generate reports for unlimited client projects
  • 1 year of reference-data updates
Buy Agency ($99)

Keys are delivered by email, usually within a few hours. Perpetual means perpetual: past your update year, everything keeps working. You just don't pull newer reference data unless you renew.

Honest scope

licenseproof produces informational license categorization. It is not legal advice, and no automated tool can be. What it gives you: complete inventory, transparent resolution (every answer says where it came from and how confident it is), and explanations your lawyer can verify quickly instead of assembling from scratch. When something can't be identified, it says UNKNOWN out loud rather than guessing.

Get the sample report + launch updates

FAQ

Is it open source?

Source-available under the Elastic License 2.0. The complete source ships inside the npm package and a public repo is up: free to use, audit, and modify, not licensed for resale. The scanner tier is free forever.

Does my code get uploaded anywhere?

No. Zero network calls, zero telemetry, verifiable in the source. Reports generate on your machine.

What ecosystems?

npm, pnpm, yarn (classic + berry). Python: uv, poetry, requirements.txt, pyproject. Mixed repos scan both at once. Conda and Pipenv not yet.

What if a license can't be identified?

It's flagged UNKNOWN and shown, never dropped. Unknown does not mean safe.

Refunds?

If the report doesn't do what this page says, email within 14 days for a full refund.

Is the PDF a screenshot?

No. A real print-rendered document with per-page provenance footers (tool version, data version, timestamp). Built to be filed.