licenses-deny 0.1.3

A Python package that audits package licenses and provenance against user-defined allow/deny policies.

licenses-deny

Simple CLI to inspect Python environment dependencies for license compliance, banned packages, and allowed sources.

Requirements

• Python 3.11+
• Virtual environment activated before running checks (required by the tool)

Installation

pip install licenses-deny

Usage

# Initialize template configuration near project root
licenses-deny init

# List installed packages with detected license/source
licenses-deny list

# Run checks (licenses + bans + sources)
licenses-deny check

# Run only license checks in strict mode
licenses-deny check licenses --strict

Configuration

licenses-deny.toml follows a cargo-deny inspired layout:

[licenses]
allow = ["MIT", "Apache-2.0"]
deny = ["GPL-3.0", "AGPL-3.0"]
unlicensed = "deny" # allow | deny | warn
exceptions = [
  { package = "example-special", allow = ["MPL-2.0"], reason = "Reviewed internally" },
]
# [[licenses.clarify]]
# package = "example"
# expression = "GPL-2.0"
# version = ">= 2.0"
# link = ""

[licenses.private]
ignore = false
registries = []

[bans]
deny = [{ name = "leftpad", reason = "Security review failed" }]
skip = []

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = []
allow-git = []
[sources.allow-org]
github = ["my-company"]

Development

# Install in editable mode
pip install -e .

# Run CLI directly from source
python -m licenses_deny --help