A few current options, since the existing answer predates most of these (disclosure: I built the last one)
**Quick list:** `npx license-checker` walks node_modules and prints declared licenses. Fast, widely used. Limitation: it mostly trusts the `license` field in package.json, so missing/nonstandard metadata comes back as UNKNOWN or a guess.
**Policy enforcement in CI:** `license-checker --failOn "GPL-3.0"` or the `licensee` tool if you want an allowlist model.
**Deeper resolution:** I built `npx licenseproof scan` because the metadata-trusting approach broke down on real trees, it resolves through SPDX expression parsing (including OR/AND/WITH), then license-file fingerprinting, then README scanning, and tells you which step produced each answer at what confidence. It also categorizes (permissive/copyleft) and flags conflicts against your project's own license with plain-English explanations. Free, offline, no telemetry.
For most one-off "what's in here" checks, license-checker is fine. When metadata is missing or legal is asking, you need something that reads the actual license files.
A few options depending on what you need (disclosure: I built the last one):
**Quick list:** `npx license-checker` walks node_modules and prints declared licenses. Fast, widely used. Limitation: it mostly trusts the `license` field in package.json, so missing/nonstandard metadata comes back as UNKNOWN or a guess.
**Policy enforcement in CI:** `license-checker --failOn "GPL-3.0"` or the `licensee` tool if you want an allowlist model.
**Deeper resolution:** I built `npx licenseproof scan` because the metadata-trusting approach broke down on real trees, it resolves through SPDX expression parsing (including OR/AND/WITH), then license-file fingerprinting, then README scanning, and tells you which step produced each answer at what confidence. It also categorizes (permissive/copyleft) and flags conflicts against your project's own license with plain-English explanations. Free, offline, no telemetry.
For most one-off "what's in here" checks, license-checker is fine. When metadata is missing or legal is asking, you need something that reads the actual license files.
