CLI

The license your dependencies actually ship — reconciled against what they claim.

License Detector resolves a repository's dependency lockfiles, determines each package's license by reading the license text the package actually ships and reconciling it against the declared metadata, evaluates the result against a policy you control, and reports a pass / needs-review / blocked verdict.

Most scanners report the label a package declares. License Detector reads the fine print — so it catches the gap (the classic "declares MIT but ships ISC"), modified license text, and dual/ OR licensing that label-only tools miss.

This repository is the open-source engine + CLI (Elastic License 2.0). The hosted GitHub App — PR checks, a dashboard, and media/asset-rights scanning on every pull request — lives at licensedetector.com .

Requires Go 1.26+ . The CLI is a single static binary with an embedded license corpus — no service, no database, and it works offline against its on-disk cache.

For a hosted, zero-config experience — a Check Run + self-updating comment on every PR — install the GitHub App .

Elastic License 2.0 — see LICENSE . Free to use, copy, modify, and redistribute, with the ELv2 limitations (no providing the software as a hosted/managed service to third parties, no circumventing the license key, no removing notices).