Install the tools

All four released tools are on PyPI. Python 3.11 or newer. No tool needs an AiExponent account. LitmusAI and RiskForge need no API key; License Compliance Checker needs one only if you turn on its optional LLM analysis. The RAG Benchmarking LLM-judge metrics need GEMINI_API_KEY or OPENAI_API_KEY; its retrieval metrics need no key. LitmusAI, RiskForge and the RAG Benchmarking retrieval metrics run with no network access. License Compliance Checker looks up licence data online during a scan (package registries, GitHub, ClearlyDefined, Hugging Face Hub); run `lcc scan --offline` to stay local. The RAG Benchmarking LLM-judge metrics call the judge model you configure.

Install everything

bashpip install license-compliance-checker riskforge==2.0.0 rag-benchmarking litmus-screener

Or install individually

bashpip install license-compliance-checker # Article 53 · License Compliance Checker
pip install riskforge==2.0.0           # Article 9 · RiskForge
pip install rag-benchmarking           # Article 15 · RAG Benchmarking
pip install litmus-screener            # Article 5 · LitmusAI

Verify

bashlitmus --version
riskforge --version
lcc --version

CI-friendly: every command returns conventional exit codes (0 pass, non-zero on findings) and writes machine-readable output (SARIF, JSON or SBOM).

Content verified 2026-10-25