Catch incompatible dependency licenses before release
A free, open-source CLI that checks every dependency license, transitive ones included, against your project's license, in 10 ecosystems. It reads lockfiles and registry metadata, installs nothing, and gives CI a verdict, not a list.
Hi Product Hunt! I'm Sergii, and I build licenseal.
A dependency's license binds the product that ships it, whether anyone on the team chose that dependency or not, and most of a dependency tree is transitive: chosen by nobody. A conflict usually surfaces late, in a customer's procurement review, an investor's due diligence or the week of a release, when swapping the package out costs the most.
licenseal moves that check to every pull request. In your project's directory, run:
uvx licenseal check
It reads your manifests and lockfiles, follows the whole dependency tree, looks up each package's license in public registry metadata and judges it against the license you ship under. You get a verdict for each dependency (compatible, warning, violation or unknown) and an exit code CI can gate on: a verdict, not a list.
What it does
Ten ecosystems in one tool: Python, JavaScript / TypeScript, Rust, Go, Java / JVM, .NET, PHP, Ruby, Elixir / Erlang and R.
Transitive by default. A flagged package is listed under the direct dependency that brought it in, so you know what to remove.
No dependency installs. It builds nothing and downloads no package. The registries see a package's name and version, nothing else, and it can reach fourteen registry hosts and no others.
Strict by default. A license it can't read from structured metadata is unknown, and something it couldn't read, such as a manifest without an up-to-date lockfile, fails the check instead of passing quietly.
A Claude Code skill. Run /licenseal-review and it walks you through each flagged dependency, asks how you distribute, host or modify your product, and records each decision with its reason in licenseal.review.toml. Real incompatibilities stay flagged.
In a benchmark of 50 widely used open-source repositories across the ten ecosystems, licenseal flagged 485 license-compatibility issues at default settings: 405 warnings and 80 outright violations.
What it isn't: legal advice, an SBOM generator or a vulnerability scanner. It tells you where a person needs to look, and keeps that person's decisions in the repository.
It's free and open source (Apache-2.0). It runs on Python 3.11 or later, through uv or pipx; the project you check can be in any of the ten ecosystems.
I'd love your feedback. Where has a license surprised you late? And which lockfile or ecosystem should it read next?
“Catch incompatible dependency licenses before release”
licenseal launched on Product Hunt on October 28th, 2026 and earned 82 upvotes and 5 comments, placing #18 on the daily leaderboard. A free, open-source CLI that checks every dependency license, transitive ones included, against your project's license, in 10 ecosystems. It reads lockfiles and registry metadata, installs nothing, and gives CI a verdict, not a list.
On the analytics side, licenseal competes within Open Source, Legal, Developer Tools and GitHub — topics that collectively have 639.1k followers on Product Hunt. The dashboard above tracks how licenseal performed against the three products that launched closest to it on the same day.
Who hunted licenseal?
licenseal was hunted by Sergii Shcherbak. A “hunter” on Product Hunt is the community member who submits a product to the platform — uploading the images, the link, and tagging the makers behind it. Hunters typically write the first comment explaining why a product is worth attention, and their followers are notified the moment they post. Around 79% of featured launches on Product Hunt are self-hunted by their makers, but a well-known hunter still acts as a signal of quality to the rest of the community. See the full all-time top hunters leaderboard to discover who is shaping the Product Hunt ecosystem.
For a complete overview of licenseal including community comment highlights and product details, visit the product overview.
Sergii Shcherbak
Hi Product Hunt! I'm Sergii, and I build licenseal.
A dependency's license binds the product that ships it, whether anyone on the team chose that dependency or not, and most of a dependency tree is transitive: chosen by nobody. A conflict usually surfaces late, in a customer's procurement review, an investor's due diligence or the week of a release, when swapping the package out costs the most.
licenseal moves that check to every pull request. In your project's directory, run:
It reads your manifests and lockfiles, follows the whole dependency tree, looks up each package's license in public registry metadata and judges it against the license you ship under. You get a verdict for each dependency (compatible, warning, violation or unknown) and an exit code CI can gate on: a verdict, not a list.
What it does
Ten ecosystems in one tool: Python, JavaScript / TypeScript, Rust, Go, Java / JVM, .NET, PHP, Ruby, Elixir / Erlang and R.
Transitive by default. A flagged package is listed under the direct dependency that brought it in, so you know what to remove.
No dependency installs. It builds nothing and downloads no package. The registries see a package's name and version, nothing else, and it can reach fourteen registry hosts and no others.
Strict by default. A license it can't read from structured metadata is unknown, and something it couldn't read, such as a manifest without an up-to-date lockfile, fails the check instead of passing quietly.
A Claude Code skill. Run /licenseal-review and it walks you through each flagged dependency, asks how you distribute, host or modify your product, and records each decision with its reason in licenseal.review.toml. Real incompatibilities stay flagged.
In a benchmark of 50 widely used open-source repositories across the ten ecosystems, licenseal flagged 485 license-compatibility issues at default settings: 405 warnings and 80 outright violations.
What it isn't: legal advice, an SBOM generator or a vulnerability scanner. It tells you where a person needs to look, and keeps that person's decisions in the repository.
It's free and open source (Apache-2.0). It runs on Python 3.11 or later, through uv or pipx; the project you check can be in any of the ten ecosystems.
I'd love your feedback. Where has a license surprised you late? And which lockfile or ecosystem should it read next?
GitHub: https://github.com/shcherbak-ai/licenseal
Docs: https://licenseal.shcherbak.ai