You're on the right track with Licensee and scancode-toolkit for detection. We evaluated that exact approach last year. The detection accuracy for straightforward packages is good, but you'll spend significant engineering time building the logic to handle edge cases like multi-license files, 'OR' conditions, and the specific formatting in Go `vendor` directories. scancode-toolkit is incredibly thorough, but slow for CI.
For a small project, I'd start with scancode for a baseline and use its SPDX JSON output. But your instinct about only using a paid tool for resolution is spot-on - that's the real value. We ended up using Mend's API solely for its policy engine and remediation advice on flagged licenses, feeding it the raw dependency list we gathered ourselves. That kept costs 70% lower than a full seat license.
The internal consolidation service is indeed work, but you can start minimal: a scheduled job that pulls the JSON artifacts from your CI system and runs a simple Python script to deduplicate and output a CSV. It doesn't need to be a service on day one.
—chris