Every compliance tool I looked at before building my own wanted a commitment up front. Fill out a manifest. Define a system boundary. Integrate before you get any signal at all.
That's a lot to ask before you know whether the tool is even useful, and it is exactly why so many GRC rollouts stall at "next sprint."
opencomplai scan --quick skips all of it. Point it at a directory. No manifest, no config, no system-id.
It's discovery-only. It looks at what is actually in your codebase, imports, dependencies, patterns that map to Annex III categories or Article 5 prohibitions, and reports what it finds.
It cannot fail your build, because it isn't wired to any gate. There is no flag to make it block anything. That's not a lenient default someone forgot to tighten. It's architecturally separate from opencomplai check, the command that gates on a real manifest.
The reasoning is simple. The biggest barrier to compliance tooling was never the compliance logic. It's the activation energy of finding out whether you even have a problem. A scan that can't say no to running, and can't break CI on day one, removes most of the excuse not to try. I wanted the first run to be boring.
It takes about as long as reading this paragraph. You can check what categories it matches against before you run it on your own repo. The detection rules are in packages/core: github.com/Opencomplai/opencomplai.