ProvenantLicense · Copyright · Packages · SBOM
Know what's inside your code — in seconds, not minutes.
Provenant is a fast, source-faithful license and copyright scanner. One Rust binary, no runtime, an embedded license index, and output you can drop straight into an existing compliance pipeline.
$ provenant scan . --license --package --copyright --json-pp -
astral-sh/uv repository.Why Provenant
Built for scanning at scale, without cutting corners on correctness.
Everything below is measured on documented, reproducible workloads — not adjectives.
Fast
~20× medianNative Rust, no interpreter, no warm-up — 19.7× faster on average across 254 recorded workloads, and it scales up: ~9× on small trees, 37× on 10k+-file repos, over 70× on the largest measured.
Source-faithful
verbatimCopyright and license text is reported the way it actually appears — © stays ©, statements aren't silently trimmed — so what you read is what's really in the file.
Monorepo-aware
ownershipWorkspace, reactor, and multiproject layouts are understood as such: nested sources and shared lockfiles are attributed to the package that owns them.
Low-noise
precisionSuppresses the false-positive classes that make review tedious — code and prose bleed — and treats bare-word license mentions as clues, not conclusions.
Compatible
drop-inEmits ScanCode-compatible JSON so it fits existing workflows, while its own goal is simply the best practical scan result — plus SPDX and CycloneDX SBOMs.
Trustworthy to ship
attestedEvery release binary and container image carries SLSA build-provenance attestation — a signed, verifiable record of how and where it was built — so you can cryptographically verify what you run.
Speed and quality
Same repositories. Faster — and more faithful.
Speed is the easy part to show. The harder question is whether a faster scanner is still right. We put Provenant and the reference scanner on the same well-known repositories and compared the actual findings, line by line — then annotated every difference that matters.
Writing