Commands

license-audit provides the five commands detailed below. All commands accept the global flags --target, --policy, and --config; refresh takes no configuration and ignores them.

analyze

Default analysis output: a per-package table with version, license expression, category, source, and parent, plus recommended outbound licenses, action items, and a summary. Pass --format json for the same analysis as machine-readable JSON (see the JSON report schema).

license-audit analyze
license-audit analyze --format json
license-audit --target /path/to/project analyze
license-audit --target /path/to/.venv analyze

check

License policy gate for CI. See CI integration for the full guide.

license-audit check
license-audit check --fail-on-unknown      # explicit (default)
license-audit check --no-fail-on-unknown   # tolerate unknown licenses

Exit codes: 0 = pass, 1 = policy violation (incompatible pairs, denied licenses, or category exceeded) or the check could not run, 2 = unknown licenses and nothing else (when --fail-on-unknown). A violation always wins: exit 2 means resolving the unknowns is the only thing left to do. Results print to stderr, so stdout redirection doesn't swallow them.

recommend

Outbound license recommendation based on the most restrictive dependency.

license-audit recommend

The output names the single most restrictive dependency, lists compatible outbound licenses ranked by permissiveness, and prints guidance specific to the strongest copyleft level present (e.g. weak-copyleft caveats for LGPL/MPL trees, attribution suggestions for fully permissive trees).

report

Compliance document for distribution or review.

license-audit report                                       # markdown to stdout
license-audit report --format json                         # JSON to stdout
license-audit report --format notices                      # notices to stdout
license-audit report --output COMPLIANCE.md                # write to file
license-audit report --format notices --output NOTICES.md

Format	Use case
markdown (default)	Human-readable compliance summary. Includes a Licenses Requiring Review section with the full license text of any dependency whose license could not be classified.
json	Machine-readable, suitable for downstream tooling. See the JSON report schema
notices	THIRD_PARTY_NOTICES.md with full license texts

refresh

Re-downloads the OSADL compatibility matrix and copyleft data into the user cache. Run after upgrading license-audit, or whenever you suspect the bundled data is stale.

license-audit refresh

The command writes to a platform-appropriate cache directory (resolved via platformdirs).

Global flags

These apply to every command except refresh, which takes no input:

Flag	Purpose
--target PATH	Project directory or virtualenv to analyze. See target resolution.
--policy LEVEL	Override the configured policy level (permissive, weak-copyleft, strong-copyleft, network-copyleft).
--config PATH	pyproject.toml (or its directory) to read config and the project name from. See target resolution.
--version	Print version and exit.