licenseal

licenseal is a free, open-source command line tool that checks the license of every dependency in a project, transitive ones included, against the license that project itself ships under. It covers ten ecosystems and is aimed at developers and teams who need to know before a release, rather than after one, whether the packages they depend on are compatible with how they distribute their product. The tool is deliberately narrow in what it promises: it reads manifests and lockfiles, looks up each package's license in public registry metadata, and returns a verdict that CI can gate on instead of a list of license names for a person to interpret. A dependency's license binds the product that ships it, whether or not anyone on the team consciously chose that dependency. Most of a dependency tree is transitive, meaning those packages were chosen by nobody on the team and simply arrived underneath something else. In practice a conflict tends to surface late: in a customer's procurement review, in an investor's due diligence, or in the week of a release, when swapping the offending package out costs the most. licenseal exists to move that check to every pull request, so the same information arrives while changing a dependency is still cheap. The tool reads ten ecosystems in one place: Python, JavaScript and TypeScript, Rust, Go, Java and the JVM, .NET, PHP, Ruby, Elixir and Erlang, and R. In a project's directory you run a single command, uvx licenseal check. It reads your manifests and lockfiles, follows the whole dependency tree, looks up each package's license in public registry metadata, and judges it against the license you ship under. Because resolution is driven by lockfiles and registry metadata rather than by scanning source files, the same command and the same style of output apply across all ten ecosystems. Transitive checking is on by default, and the output is organised to be actionable. A flagged package is listed under the direct dependency that brought it in, so you know what to remove or replace rather than being handed a flat list of unfamiliar package names. Each dependency gets one of four verdicts: compatible, warning, violation or unknown. A run also returns an exit code that CI can gate on, which is the practical difference between a report somebody might read and a check that actually stops a merge. licenseal installs nothing. It builds nothing and downloads no package, so the registries it talks to see a package's name and version and nothing else, and the tool can reach fourteen registry hosts and no others. That constraint matters for teams that run dependency checks inside locked-down CI environments or on machines where installing arbitrary packages is not acceptable: the check does not modify the environment it runs in and does not add supply-chain exposure in order to measure supply-chain exposure. Strictness is the default rather than a configuration option. A license that cannot be read from structured metadata is reported as unknown, and something the tool could not read at all, such as a manifest without an up-to-date lockfile, fails the check instead of passing quietly. The consequence is that a clean result means something: if licenseal produces no violations, it is because the tree was actually walked and judged, not because a file was missing or a lookup silently gave up. A bundled Claude Code skill extends a check into a review workflow. Running /licenseal-review walks you through each flagged dependency, asks how you distribute, host or modify your product, and records each decision with its reason in licenseal.review.toml. Real incompatibilities stay flagged, while decisions a person has made deliberately are preserved in the repository rather than in someone's memory or a chat thread. Because the entry is tied to that version or commit, an upgrade comes back for review instead of quietly inheriting an old approval. The approach is to accept a license only when the maintainer declared it in a structured field. Reading LICENSE files would mean matching text, which is easy to spoof and misses edited licenses, and fetching every dependency's code would be slow and would touch far more than a license checker should. The trade-off is explicit: git dependencies, which carry no registry metadata behind them, are reported as UNKNOWN today. When a license lives only in a repository, UNKNOWN is where the review starts, not where it ends: you check the license once, record it in licenseal.review.toml with a reason, and CI passes from then on. Benefits follow from that design. Compatibility is caught in a pull request rather than during a release, the reason a dependency was accepted is stored next to the code, and review effort is spent only where the tool could not reach a structured answer. In a benchmark of 50 widely used open-source repositories across the ten ecosystems, licenseal flagged 485 license-compatibility issues at default settings: 405 warnings and 80 outright violations. That is the scale of the problem the tool is pointing at, in repositories that are already widely used. Typical use is a CI step that runs licenseal on every pull request, with the exit code deciding whether a dependency change merges. It also fits pre-release checks, where a team wants a final pass over the whole tree before shipping, and the preparation work that precedes a customer's procurement review or an investor's due diligence. During development it answers the narrower question of what a newly added package drags in transitively, and for licenses that only exist in a repository it provides a place to record a deliberate decision. licenseal is aimed at developers and engineering teams who ship software built on open-source dependencies and who need license compatibility to be a check rather than an occasional manual audit. It runs on Python 3.11 or later, through uv or pipx, while the project being checked can be in any of the ten supported ecosystems. It is free and open source under Apache-2.0. It is explicitly not legal advice, not an SBOM generator and not a vulnerability scanner; it tells you where a person needs to look and keeps that person's decisions in the repository. The takeaway is simple: licenseal turns dependency licensing from a late, manual, expensive review into a routine check that runs on every pull request, with a verdict CI can act on, transitive packages accounted for by default, and every human decision about an unclear license written down in the repository where the next person can find it.