OSI-licensed open source
Licensing tools help developers declare the licence of their own code and check the licences of what they depend on. They are small, scriptable and usually run in CI: annotate files with SPDX identifiers, generate an SBOM, then fail the build if a forbidden licence appears.
This page is the developer-side counterpart to our licence manager page, which covers organisation-wide servers like FOSSology. Here you will find REUSE, SPDX tools, Grant, Syft, go-licenses, Licensee, cargo-deny and pip-licenses, grouped by language and workflow. All are open source, with licences read from each repository on 2026-11-07.
Tools, licences and pricing checked against vendor and repository pages on November 7, 2026.
| Tool | Best for | Pricing | Licence |
|---|---|---|---|
| REUSE tool | Declaring licences clearly in your own repo | Free, open source | GPL-3.0-or-later |
| SPDX Tools (Java) | Validating and converting SPDX documents | Free, open source | Apache-2.0 |
| Grant | Policy checks on images and SBOMs | Free, open source | Apache-2.0 |
| Syft | Generating SBOMs as input to licence checks | Free, open source | Apache-2.0 |
| go-licenses | Go projects | Free, open source | Apache-2.0 |
| Licensee | Detecting the licence of a repository | Free, open source | MIT |
| cargo-deny | Rust projects | Free, open source | Apache-2.0 OR MIT |
| pip-licenses | Python environments | Free, open source | MIT |
Best for: Declaring licences clearly in your own repo · Free, open source
reuse is a tool for compliance with the REUSE recommendations, which standardise how projects declare copyright and licence information.
Best for: Validating and converting SPDX documents · Free, open source
A command-line utility for creating, converting, comparing and validating SPDX documents across multiple formats.
Best for: Policy checks on images and SBOMs · Free, open source
Grant is a CLI tool and Go library that checks licences in container images, SBOMs and filesystems, and works with Syft for policy enforcement.
Best for: Generating SBOMs as input to licence checks · Free, open source
Syft is a CLI tool and library for generating a Software Bill of Materials from container images and filesystems.
Best for: Go projects · Free, open source
A Go command-line tool that analyses a package's dependencies to produce licence reports, collect licence files and flag forbidden licences.
Best for: Detecting the licence of a repository · Free, open source
Licensee is a Ruby gem and CLI that detects a project's open-source licence by analysing licence files, package manifests and READMEs.
Best for: Rust projects · Free, open source
A Cargo subcommand that checks dependencies for licence compliance, banned crates, security advisories and untrusted sources.
Best for: Python environments · Free, open source
A CLI tool that lists the software licences of Python packages installed with pip.
One email a week with the tools, launches and releases added to TechLogHub. Unsubscribe in one click.
One email a week: new and trending developer tools, fresh comparisons, and what shipped. Unsubscribe in one click.
| If you need… | Start with |
|---|---|
| Declare licences in your own repo | REUSE tool |
| Create or validate SPDX documents | SPDX Tools (Java) |
| Container images and SBOM policy | Syft and Grant |
| Go dependencies | go-licenses |
| Rust dependencies | cargo-deny |
| Python environments | pip-licenses |
| Detect the licence of a repo | Licensee |
Quick answers to common questions
Tools that declare, detect, report and enforce software licences in code and dependencies.
They are lightweight CLIs for developers. Licence managers like FOSSology are servers with review workflows for compliance teams.
It helps. Syft produces one and Grant can check licences from it; SPDX tools can validate the document.
No. For issuing keys to your customers see our software licence key generator page.
List it on TechLogHub and we'll review it for this guide.
