OHRisk

6.9easy start · #11 of 28
in Open Source License Compliance Software

Free to practise onyes
Free trialnot on record
Well documentedyes
Runs where you workyes

Runs on Linux, Mac, Windows.

OHRisk is ranked #11 of 28 in open source license compliance software on The Geeks Club. It runs on Linux, macOS, Windows. There is a free plan.

OHRisk plans and pricing

All plans

Ohrisk Free Open-source CLI · MIT License github.com · 29 Sept 2026

Compared on open source license compliance software

Free plan: Yes
Policy enforcement: both
Obligation tracking: Yes
Attribution reports: Yes
SBOM import formats: CycloneDX JSON/XML; SPDX JSON/RDF; SPDX tag-value
Deployment options: on-premise
Source scan methods: multiple

Best OHRisk alternatives

See all 12

FOSSA 0 of 4 in the starter kit Lesson 17.6 FOSSology 0 of 4 in the starter kit Lesson 27.2 ScanCode Toolkit 0 of 4 in the starter kit Lesson 37.2 DejaCode 0 of 4 in the starter kit Lesson 47.1 Double Open Compliance 0 of 4 in the starter kit Lesson 57.1 REUSE Tool 0 of 4 in the starter kit Lesson 67.1

The record

Purpose: Ohrisk is a local CLI that catches open-source license risk before a pull request ships.
Risk profiles: It evaluates dependencies under SaaS or distributed-app usage profiles and reports low, review, high, or unknown findings.
Not legal advice: Ohrisk describes itself as a risk decision aid and says it does not replace legal review.
Outputs: It can generate terminal, JSON, HTML, Markdown, SARIF 2.1.0, and CycloneDX 1.5 JSON reports.
CI integration: A bundled GitHub Actions composite action supports scan, ci, and diff commands, and the guide documents SARIF upload to GitHub code scanning.
Dependency coverage: The README lists supported dependency inputs across ecosystems including npm, Rust, Go, Python, Java, .NET, Ruby, PHP, and CycloneDX or SPDX SBOMs.
License evidence: Ohrisk can use local package evidence and selected remote evidence sources with checksum and identity validation described for supported ecosystems.
Waivers: Local waiver files can suppress findings from CI threshold failures while keeping waived findings visible in reports.
Scope limitation: The README states several dependency sources and graph types are not scanned yet, including Gradle graph reconstruction and remote Terraform Registry metadata.
Runtime: The packaged CLI runs on Node.js version 24.0.0 or later, and users do not need Bun installed.
Install: Ohrisk is distributed as an npm package and can also be run using pnpm, Yarn, or Bun package-manager commands.
License: The repository provides Ohrisk under the MIT License.
Maker: The GitHub maker profile is named 0disoft (ZeroDi) and lists Republic of Korea as its location.
Price from: Free

Where it ranks on The Geeks Club

Best Open Source License Compliance Software in 2026#11 of 28

Is OHRisk yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OHRisk

Sources

github.com/0disoft/ohrisk· checked 29 Sept 2026
github.com/0disoft/ohrisk/blob/main/docs/github-ac· checked 29 Sept 2026
github.com/0disoft/ohrisk/blob/main/LICENSE· checked 29 Sept 2026
github.com/0disoft· checked 29 Sept 2026