license-audit

Analyze dependency licenses for Python projects.

license-audit tells you what license your project can use, flags incompatible combinations, and generates compliance documents suitable for CI gating.

Features

• License detection across the full transitive tree, from PEP 639 metadata, the legacy License field, trove classifiers, and user overrides.
• Pairwise compatibility checking against the OSADL compatibility matrix (~120 licenses).
• Outbound license recommendations ranked by permissiveness.
• Compliance reports as Markdown, JSON, or third-party-notices.
• CI exit codes that distinguish policy violations from undetected licenses.
• Reads the licenses straight from your installed environment: provision it however you like (uv, Poetry, pip), then point license-audit at it.

Installation

pip install license-audit

Or with uv:

uv add license-audit --dev

Quickstart

Provision your dependencies first, then run license-audit inside that environment:

uv sync
uv run license-audit analyze

Or point it at an existing virtualenv:

license-audit --target .venv analyze

───────────────────── License Analysis: my-project ─────────────────────
Source: /path/to/my-project/.venv

                         Dependency Licenses
┏━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━┳━━━━━━━━━━┓
┃ Package  ┃ Version ┃ License      ┃ Category   ┃ Source ┃ Parent   ┃
┡━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━╇━━━━━━━━━━┩
│ click    │ 8.3.1   │ BSD-3-Clause │ permissive │ pep639 │ (direct) │
│ pydantic │ 2.12.5  │ MIT          │ permissive │ pep639 │ (direct) │
│ rich     │ 14.3.0  │ MIT          │ permissive │ pep639 │ (direct) │
└──────────┴─────────┴──────────────┴────────────┴────────┴──────────┘

Recommended Outbound Licenses (most -> least permissive):
  -> MIT
     Apache-2.0
     BSD-2-Clause
     BSD-3-Clause
     ISC
  ... and 111 more

──────────────────────────────── Summary ───────────────────────────────
  Total dependencies: 3
  Unknown licenses:   0
  Copyleft licenses:  0
  Policy check:       PASSED

Commands

See the commands reference for details.

CI quickstart

Add to your pipeline to gate on license policy:

jobs:
  license-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
      - run: uv sync --locked
      - run: uv run license-audit check

Exit codes:

For GitLab, pre-commit, handling unknowns, and the new-dependency workflow, see the CI integration guide.

Configuration

[tool.license-audit]
fail-on-unknown = true
policy = "permissive"  # permissive | weak-copyleft | strong-copyleft | network-copyleft
allowed-licenses = ["MIT", "Apache-2.0", "BSD-3-Clause"]
denied-licenses = ["GPL-3.0-only"]
target = ".venv"  # optional; defaults to ./.venv, else the active environment

[tool.license-audit.overrides]
some-internal-package = "MIT"
dual-licensed-pkg = "Apache-2.0 OR MIT"

[tool.license-audit.license-classifications]
"CNRI-Python" = "permissive"  # your judgement for licenses OSADL doesn't cover

[tool.license-audit.ignored-packages]
pandas-stubs = "Stubs only, not redistributed"

Full reference: user guide -> configuration.

Documentation

Full documentation lives at https://dgeragh.github.io/license-audit:

• Configuration reference
• CI integration guide
• How it works
• Comparison with other tools
• Limitations

License

MIT. See LICENSE.

This project bundles data from the OSADL Open Source License Obligations Checklists project, licensed under CC-BY-4.0. See THIRD_PARTY_NOTICES.md for full attribution.