THIRD_PARTY_NOTICES.md

Rama main · réplica de lectura del repositorio original.

# Third-party notices

AgenticOS is licensed under the Apache License 2.0 (`LICENSE`, `NOTICE`). The
images it publishes also carry the components below, each under its own licence.

This file is generated by `scripts/license_inventory.py` from `backend/uv.lock`
and `frontend/bun.lock`; do not edit it by hand. `make licenses` regenerates it
and `make licenses-check` fails when it is stale. What these licences oblige and
how each obligation is met is reviewed in `docs/licenses.md`.

Each component's own licence file, with its copyright notice, ships beside it:
the backend image keeps every wheel's `*.dist-info/` and the frontend image
collects every package's licence file under `/app/licenses/`. A package that
publishes none gets a NOTICE there naming its licence and author, with the
licence text from `frontend/licenses/texts/`; the holder recorded for one that
names no author is in the evidence column below.

## Open findings

- Sandbox runtime `workbench` (built by sandboxd from backend/app/core/catalog/sandbox_runtimes.json) python:3.12-slim plus the listed apt, npm and PyPI packages, resolved at build time - deployment-review

## Licences

| Licence | Backend | Frontend |
|---|---:|---:|
| MIT | 99 | 253 |
| Apache-2.0 | 70 | 24 |
| BSD-3-Clause | 22 | 4 |
| ISC | 3 | 21 |
| BSD-2-Clause | 7 | 0 |
| MPL-2.0 | 5 | 0 |
| Apache-2.0 AND MIT | 1 | 2 |
| LGPL-3.0-or-later | 1 | 2 |
| PSF-2.0 | 3 | 0 |
| 0BSD | 1 | 1 |
| AGPL-3.0-only | 1 | 0 |
| Apache-2.0 AND CNRI-Python | 1 | 0 |
| Apache-2.0 OR BSD-2-Clause | 1 | 0 |
| Apache-2.0 OR BSD-3-Clause | 1 | 0 |
| BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0 | 1 | 0 |
| CC-BY-4.0 | 0 | 1 |
| CC0-1.0 | 0 | 1 |
| LGPL-2.1-or-later | 1 | 0 |
| LGPL-3.0-only | 1 | 0 |
| MIT AND ISC | 0 | 1 |
| MIT AND PSF-2.0 | 1 | 0 |
| MIT-0 | 1 | 0 |
| MIT-CMU | 1 | 0 |
| Unlicense | 1 | 0 |

## Backend image (Python)

223 distributions.

| Component | Version | Licence | Source | Evidence |
|---|---|---|---|---|
| aiofile | 3.12.3 | Apache-2.0 | https://github.com/mosquito/aiofile | License-Expression |
| aiofiles | 25.1.0 | Apache-2.0 | https://github.com/Tinche/aiofiles | License field |
| aiogram | 3.31.0 | MIT | https://github.com/aiogram/aiogram/ | License-Expression |
| aiohappyeyeballs | 2.7.1 | PSF-2.0 | https://github.com/aio-libs/aiohappyeyeballs | License field |
| aiohttp | 3.14.5 | Apache-2.0 AND MIT | https://github.com/aio-libs/aiohttp | License-Expression |
| aiohttp-retry | 2.9.1 | MIT | https://github.com/inyutin/aiohttp_retry | License field |
| aiosignal | 1.4.0 | Apache-2.0 | https://github.com/aio-libs/aiosignal | License field |
| aiosmtplib | 5.1.3 | MIT | https://github.com/cole/aiosmtplib | License field |
| alembic | 1.20.1 | MIT | https://github.com/sqlalchemy/alembic/ | License-Expression |
| annotated-doc | 0.0.5 | MIT | https://github.com/fastapi/annotated-doc | License-Expression |
| annotated-types | 0.8.0 | MIT | https://github.com/annotated-types/annotated-types | License-Expression |
| anthropic | 2.3.0 | Apache-2.0 | https://github.com/anthropics/anthropic-sdk-python | License field |
| anyio | 4.16.0 | MIT | https://github.com/agronholm/anyio | License-Expression |
| asgiref | 3.13.0 | BSD-3-Clause | https://asgi.readthedocs.io/ | License field |
| asyncpg | 0.32.0 | Apache-2.0 | https://github.com/MagicStack/asyncpg | License-Expression |
| attrs | 26.1.0 | MIT | https://github.com/python-attrs/attrs | License-Expression |
| authlib | 1.9.5 | BSD-3-Clause | https://github.com/authlib/authlib | License field |
| bcrypt | 5.0.0 | Apache-2.0 | https://github.com/pyca/bcrypt/ | License field |
| beartype | 0.23.1 | MIT | https://github.com/beartype/beartype | License-Expression |
| beautifulsoup4 | 4.15.0 | MIT | https://www.crummy.com/software/BeautifulSoup/bs4/ | License field |
| bidict | 0.24.1 | MPL-2.0 | https://github.com/jab/bidict | License-Expression; review accepted |
| boto3 | 1.43.126 | Apache-2.0 | https://github.com/boto/boto3 | License field |
| botocore | 1.43.126 | Apache-2.0 | https://github.com/boto/botocore | License field |
| bracex | 3.2 | MIT | https://github.com/facelessuser/bracex | License-Expression |
| cachetools | 7.2.6 | MIT | https://github.com/tkem/cachetools/ | License-Expression |
| caio | 0.12.10 | Apache-2.0 | https://github.com/mosquito/caio/ | License-Expression |
| certifi | 2026.10.23 | MPL-2.0 | https://github.com/certifi/python-certifi | License field; review accepted |
| cffi | 2.1.1 | MIT-0 | https://github.com/python-cffi/cffi | License-Expression |
| chardet | 7.7.0 | 0BSD | https://github.com/chardet/chardet | License-Expression |
| charset-normalizer | 3.5.2 | MIT | https://charset-normalizer.readthedocs.io/ | License field |
| click | 8.5.1 | BSD-3-Clause | https://github.com/pallets/click/ | License-Expression |
| cohere | 7.3.0 | MIT | https://github.com/cohere-ai/cohere-python | License field |
| connectrpc | 0.12.1 | Apache-2.0 | https://github.com/connectrpc/connect-py | License-Expression |
| croniter | 6.2.4 | MIT | https://github.com/pallets-eco/croniter | License-Expression |
| cryptography | 50.0.2 | Apache-2.0 OR BSD-3-Clause | https://github.com/pyca/cryptography/ | License-Expression |
| cyclopts | 5.3.1 | Apache-2.0 | https://github.com/BrianPugh/cyclopts | License-Expression |
| daytona | 0.226.1 | Apache-2.0 | https://pypi.org/project/daytona/0.226.1/ | License field |
| daytona-analytics-api-client | 0.226.1 | Apache-2.0 | https://github.com/daytona/clients | licence file text |
| daytona-analytics-api-client-async | 0.226.1 | Apache-2.0 | https://github.com/daytona/clients | licence file text |
| daytona-api-client | 0.226.1 | Apache-2.0 | https://github.com/daytona/clients | License field |
| daytona-api-client-async | 0.226.1 | Apache-2.0 | https://github.com/daytona/clients | License field |
| daytona-toolbox-api-client | 0.226.1 | Apache-2.0 | https://github.com/daytona/clients | License field |
| daytona-toolbox-api-client-async | 0.226.1 | Apache-2.0 | https://github.com/daytona/clients | License field |
| ddgs | 9.16.1 | MIT | https://github.com/deedy5/ddgs | License-Expression |
| defusedxml | 0.7.1 | PSF-2.0 | https://github.com/tiran/defusedxml | classifier |
| deprecated | 1.3.1 | MIT | https://github.com/laurent-laporte-pro/deprecated | License field |
| distro | 1.9.0 | Apache-2.0 | https://github.com/python-distro/distro | License field |
| dnspython | 2.9.0 | ISC | https://github.com/rthalley/dnspython.git | License-Expression; no licence file, attributed to Bob Halley |
| docstring-parser | 0.18.0 | MIT | https://github.com/rr-/docstring_parser | License field |
| e2b | 2.59.0 | MIT | https://github.com/e2b-dev/e2b/tree/main/packages/python-sdk | License-Expression; no licence file, attributed to e2b |
| e2b-dockerfile-utils | 0.1.1 | Apache-2.0 | https://github.com/e2b-dev/e2b/tree/main/packages/dockerfile-utils-python | License-Expression |
| email-validator | 2.3.0 | Unlicense | https://github.com/JoshData/python-email-validator | License field |
| et-xmlfile | 2.0.0 | MIT | https://foss.heptapod.net/openpyxl/et_xmlfile | License field |
| eval-type-backport | 0.4.0 | MIT | https://github.com/alexmojaki/eval_type_backport | License field |
| exceptiongroup | 1.3.1 | MIT | https://github.com/agronholm/exceptiongroup | classifier |
| executing | 2.3.0 | MIT | https://github.com/alexmojaki/executing | License field |
| fastapi | 0.162.0 | MIT | https://github.com/fastapi/fastapi | License-Expression |
| fastavro | 1.13.1 | MIT | https://github.com/fastavro/fastavro | License field |
| fastmcp | 4.1.6 | Apache-2.0 | https://github.com/PrefectHQ/fastmcp | License-Expression |
| fastmcp-slim | 4.1.6 | Apache-2.0 | https://github.com/PrefectHQ/fastmcp | License-Expression; no licence file, attributed to Jeremiah Lowin, Nate Nowack |
| filelock | 4.2.4 | MIT | https://github.com/tox-dev/py-filelock | License-Expression |
| frozenlist | 1.8.0 | Apache-2.0 | https://github.com/aio-libs/frozenlist | License field |
| fsspec | 2026.9.0 | BSD-3-Clause | https://github.com/fsspec/filesystem_spec | License-Expression |
| genai-prices | 0.2.1 | MIT | https://github.com/pydantic/genai-prices | License-Expression |
| google-auth | 2.62.1 | Apache-2.0 | https://github.com/googleapis/google-cloud-python/tree/main/packages/google-auth | License field |
| google-genai | 2.33.0 | Apache-2.0 | https://github.com/googleapis/python-genai | License-Expression |
| googleapis-common-protos | 1.76.0 | Apache-2.0 | https://github.com/googleapis/google-cloud-python/tree/main/packages/googleapis-common-protos | License-Expression |
| greenlet | 3.5.6 | MIT AND PSF-2.0 | https://github.com/python-greenlet/greenlet | License-Expression |
| griffelib | 2.4.1 | ISC | https://github.com/mkdocstrings/griffe | License-Expression |
| groq | 1.7.0 | Apache-2.0 | https://github.com/groq/groq-python | License field |
| grpcio | 1.85.0 | Apache-2.0 | https://github.com/grpc/grpc | License-Expression |
| h11 | 0.16.0 | MIT | https://github.com/python-hyper/h11 | License field |
| h2 | 4.4.1 | MIT | https://github.com/python-hyper/h2/ | License-Expression |
| hf-xet | 1.4.3 | Apache-2.0 | https://github.com/huggingface/xet-core.git | License-Expression |
| hpack | 4.2.0 | MIT | https://github.com/python-hyper/hpack/ | License-Expression |
| http-ece | 1.2.1 | MIT | https://github.com/martinthomson/encrypted-content-encoding | License field; no licence file, attributed to Martin Thomson |
| httpcore | 1.0.9 | BSD-3-Clause | https://github.com/encode/httpcore | License-Expression |
| httpcore2 | 2.16.0 | BSD-3-Clause | https://github.com/pydantic/httpx2/blob/main/src/httpcore2 | License-Expression |
| httptools | 0.9.0 | MIT | https://github.com/MagicStack/httptools | License-Expression |
| httpx | 0.28.1 | BSD-3-Clause | https://github.com/encode/httpx | License field |
| httpx-ws | 0.9.0 | MIT | https://github.com/frankie567/httpx-ws | classifier |
| httpx2 | 2.16.0 | BSD-3-Clause | https://github.com/pydantic/httpx2 | License-Expression |
| huggingface-hub | 1.18.0 | Apache-2.0 | https://github.com/huggingface/huggingface_hub | License field |
| hyperframe | 6.1.0 | MIT | https://github.com/python-hyper/hyperframe/ | classifier |
| idna | 3.20 | BSD-3-Clause | https://github.com/kjd/idna | License-Expression |
| itsdangerous | 2.2.0 | BSD-3-Clause | https://github.com/pallets/itsdangerous/ | licence file text |
| jiter | 0.18.0 | MIT | https://github.com/pydantic/jiter/ | License-Expression |
| jmespath | 1.1.0 | MIT | https://github.com/jmespath/jmespath.py | License field |
| joserfc | 1.7.7 | BSD-3-Clause | https://github.com/authlib/joserfc | License field |
| json-repair | 0.64.2 | MIT | https://github.com/mangiucugna/json_repair/ | License-Expression |
| jsonpath-python | 1.1.6 | MIT | https://github.com/sean2077/jsonpath-python | License field |
| jsonref | 1.1.0 | MIT | https://github.com/gazpachoking/jsonref | License field |
| jsonschema | 4.26.0 | MIT | https://github.com/python-jsonschema/jsonschema | License-Expression |
| jsonschema-path | 0.5.0 | Apache-2.0 | https://github.com/p1c2u/jsonschema-path | License field |
| jsonschema-specifications | 2025.9.1 | MIT | https://github.com/python-jsonschema/jsonschema-specifications | License-Expression |
| ldap3 | 2.9.1 | LGPL-3.0-only | https://github.com/cannatag/ldap3 | classifier; review accepted |
| liteparse | 2.18.0 | Apache-2.0 | https://github.com/run-llama/liteparse | License-Expression; no licence file, attributed to Logan Markewich |
| llama-cloud | 2.19.0 | MIT | https://github.com/run-llama/llama-parse-py | License field |
| logfire | 5.4.0 | MIT | https://github.com/pydantic/logfire | License-Expression |
| logfire-api | 5.4.0 | MIT | https://pypi.org/project/logfire-api/5.4.0/ | License-Expression; no licence file, attributed to Pydantic Team, Samuel Colvin, Hasan Ramezani, Adrian Garcia Badaracco, David Montague, Marcelo Trylesinski, David Hewitt, Alex Hall |
| logfire-sdk | 5.4.0 | MIT | https://github.com/pydantic/logfire | License-Expression |
| lxml | 6.1.3 | BSD-3-Clause | https://github.com/lxml/lxml | License field |
| magic-filter | 1.0.12 | MIT | https://github.com/aiogram/magic-filter | License-Expression |
| mako | 1.4.3 | MIT | https://www.makotemplates.org/ | License-Expression |
| markdown-it-py | 4.2.0 | MIT | https://github.com/executablebooks/markdown-it-py | classifier |
| markdownify | 1.2.3 | MIT | http://github.com/matthewwithanm/python-markdownify | classifier |
| markupsafe | 3.0.4 | BSD-3-Clause | https://github.com/pallets/markupsafe/ | License-Expression |
| mcp | 2.3.0 | MIT | https://github.com/modelcontextprotocol/python-sdk | License field |
| mcp-types | 2.3.0 | MIT | https://github.com/modelcontextprotocol/python-sdk | License field |
| mdurl | 0.1.2 | MIT | https://github.com/executablebooks/mdurl | classifier |
| mistralai | 3.5.0 | Apache-2.0 | https://github.com/mistralai/client-python.git | licence file text |
| multidict | 7.2.1 | Apache-2.0 | https://github.com/aio-libs/multidict | License-Expression |
| numpy | 2.5.4 | BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0 | https://github.com/numpy/numpy | License-Expression |
| obstore | 0.11.1 | MIT | https://developmentseed.org/obstore | classifier; no licence file, attributed to Development Seed |
| odfpy | 1.4.1 | LGPL-2.1-or-later | https://github.com/eea/odfpy | override: odfpy-1.4.1 ships no licence file and its License field is empty; its trove classifiers name Apache, GPL and LGPL, but every library source under odf/ (e.g. odf/namespaces.py, odf/office.py) carries the same header - 'This library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License ... version 2.1 ... or (at your option) any later version', Copyright (C) 2006-2013 Søren Roug, European Environment Agency. The imported library is therefore taken under LGPL-2.1-or-later.; review accepted; no licence file, attributed to Soren Roug |
| olefile | 0.47 | BSD-2-Clause | https://www.decalage.info/python/olefileio | licence file text |
| openai | 3.39.0 | Apache-2.0 | https://github.com/openai/openai-python | License-Expression |
| openapi-pydantic | 0.6.0 | MIT | https://github.com/mike-oakley/openapi-pydantic | License field |
| openpyxl | 3.1.5 | MIT | https://foss.heptapod.net/openpyxl/openpyxl | License field |
| opentelemetry-api | 1.45.1 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-python | License-Expression |
| opentelemetry-exporter-http-transport | 0.66b1 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-python | License-Expression |
| opentelemetry-exporter-otlp-common | 0.66b1 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-python | License-Expression |
| opentelemetry-exporter-otlp-proto-common | 1.45.1 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-python | License-Expression |
| opentelemetry-exporter-otlp-proto-http | 1.45.1 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-python | License-Expression |
| opentelemetry-instrumentation | 0.66b1 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-python-contrib | License-Expression |
| opentelemetry-instrumentation-aiohttp-client | 0.66b1 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-python-contrib | License-Expression |
| opentelemetry-instrumentation-asgi | 0.66b1 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-python-contrib | License-Expression |
| opentelemetry-instrumentation-asyncpg | 0.66b1 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-python-contrib | License-Expression |
| opentelemetry-instrumentation-fastapi | 0.66b1 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-python-contrib | License-Expression |
| opentelemetry-instrumentation-httpx | 0.66b1 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-python-contrib | License-Expression |
| opentelemetry-instrumentation-redis | 0.66b1 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-python-contrib | License-Expression |
| opentelemetry-proto | 1.45.1 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-python | License-Expression |
| opentelemetry-sdk | 1.45.1 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-python | License-Expression |
| opentelemetry-semantic-conventions | 0.66b1 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-python | License-Expression |
| opentelemetry-util-http | 0.66b1 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-python-contrib | License-Expression; no licence file, attributed to OpenTelemetry Authors |
| packaging | 26.3 | Apache-2.0 OR BSD-2-Clause | https://github.com/pypa/packaging | License-Expression |
| pathable | 0.6.0 | Apache-2.0 | https://github.com/p1c2u/pathable | License field |
| phonenumberslite | 9.0.43 | Apache-2.0 | https://github.com/daviddrysdale/python-phonenumbers | License-Expression |
| pillow | 13.0.0 | MIT-CMU | https://github.com/python-pillow/Pillow | License-Expression |
| platformdirs | 4.13.5 | MIT | https://github.com/tox-dev/platformdirs | License-Expression |
| primp | 2.0.1 | MIT | https://github.com/deedy5/primp | License field; no licence file, attributed to deedy5 |
| propcache | 0.5.4 | Apache-2.0 | https://github.com/aio-libs/propcache | License field |
| protobuf | 6.33.6 | BSD-3-Clause | https://developers.google.com/protocol-buffers/ | License field |
| protobuf-py | 0.6.0 | Apache-2.0 | https://github.com/bufbuild/protobuf-py | License-Expression |
| protobuf-py-ext | 0.6.0 | Apache-2.0 | https://github.com/bufbuild/protobuf-py | override: protobuf-py-ext 0.6.0 (pulled in by e2b, for E2B sandboxes) is the native half of protobuf-py and ships no licence metadata of its own; its Project-URLs name github.com/bufbuild/protobuf-py, whose LICENSE is Apache-2.0, and protobuf-py 0.6.0 from the same source declares License-Expression: Apache-2.0 and ships that LICENSE.; no licence file, attributed to Buf Technologies, Inc. |
| psutil | 7.2.2 | BSD-3-Clause | https://github.com/giampaolo/psutil | License field |
| psycopg2-binary | 2.9.13 | LGPL-3.0-or-later | https://psycopg.org/ | licence file text; review accepted |
| py-key-value-aio | 0.4.6 | Apache-2.0 | https://pypi.org/project/py-key-value-aio/0.4.6/ | License-Expression |
| py-vapid | 1.9.6 | MPL-2.0 | https://github.com/mozilla-services/vapid | License field; review accepted |
| pyasn1 | 0.6.5 | BSD-2-Clause | https://github.com/pyasn1/pyasn1 | License field |
| pyasn1-modules | 0.4.2 | BSD-2-Clause | https://github.com/pyasn1/pyasn1-modules | licence file text |
| pycparser | 3.12 | BSD-3-Clause | https://github.com/eliben/pycparser | License-Expression |
| pydantic | 2.14.3 | MIT | https://github.com/pydantic/pydantic | License-Expression |
| pydantic-ai-backend | 0.2.39 | MIT | https://github.com/vstorm-co/pydantic-ai-backend | License-Expression |
| pydantic-ai-harness | 0.66.0 | MIT | https://github.com/pydantic/pydantic-ai | License-Expression |
| pydantic-ai-otari | 0.1.0 | Apache-2.0 | https://github.com/mozilla-ai/otari | License-Expression |
| pydantic-ai-skills | 2.1.1 | MIT | https://github.com/dougtrajano/pydantic-ai-skills | License-Expression |
| pydantic-ai-slim | 2.66.0 | MIT | https://github.com/pydantic/pydantic-ai/tree/main/pydantic_ai_slim | License-Expression |
| pydantic-core | 2.50.4 | MIT | https://github.com/pydantic/pydantic/tree/main/pydantic-core | License-Expression |
| pydantic-graph | 2.66.0 | MIT | https://github.com/pydantic/pydantic-ai | License-Expression |
| pydantic-monty | 1.5.0 | MIT | https://github.com/pydantic/monty | License-Expression; no licence file, attributed to Pydantic Services Inc. |
| pydantic-monty-client | 1.5.0 | MIT | https://github.com/pydantic/monty | License field; no licence file, attributed to Pydantic Services Inc. |
| pydantic-monty-runtime | 1.5.0 | MIT | https://github.com/pydantic/monty | License field; no licence file, attributed to Pydantic Services Inc. |
| pydantic-settings | 2.16.2 | MIT | https://github.com/pydantic/pydantic-settings | License-Expression |
| pygments | 2.21.0 | BSD-2-Clause | https://github.com/pygments/pygments | License-Expression |
| pyjwt | 2.15.1 | MIT | https://github.com/jpadilla/pyjwt | License-Expression |
| pymupdf | 1.28.2 | AGPL-3.0-only | https://github.com/pymupdf/pymupdf | licence file text; review accepted |
| pyperclip | 1.11.0 | BSD-3-Clause | https://github.com/asweigart/pyperclip | licence file text |
| pyqwest | 0.12.0 | MIT | https://github.com/curioswitch/pyqwest.git | classifier |
| python-dateutil | 2.9.0.post0 | Apache-2.0 | https://github.com/dateutil/dateutil | licence file text |
| python-docx | 1.2.0 | MIT | https://github.com/python-openxml/python-docx | License field |
| python-dotenv | 1.2.4 | BSD-3-Clause | https://github.com/theskumar/python-dotenv | License field |
| python-engineio | 4.14.0 | MIT | https://code.miguelgrinberg.com/miguelgrinberg/python-engineio | License field |
| python-multipart | 0.0.33 | Apache-2.0 | https://github.com/Kludex/python-multipart | License-Expression |
| python-pptx | 1.0.2 | MIT | https://github.com/scanny/python-pptx | License field |
| python-socketio | 5.17.0 | MIT | https://code.miguelgrinberg.com/miguelgrinberg/python-socketio | License field |
| pywebpush | 2.5.0 | MPL-2.0 | https://github.com/web-push-libs/pywebpush | License-Expression; review accepted |
| pyyaml | 6.0.3 | MIT | https://github.com/yaml/pyyaml | License field |
| rank-bm25 | 0.2.2 | Apache-2.0 | https://github.com/dorianbrown/rank_bm25 | License field |
| redis | 8.1.0 | MIT | https://github.com/redis/redis-py | License-Expression |
| referencing | 0.37.0 | MIT | https://github.com/python-jsonschema/referencing | License-Expression |
| regex | 2026.9.29 | Apache-2.0 AND CNRI-Python | https://github.com/mrabarnett/mrab-regex | License-Expression |
| requests | 2.34.2 | Apache-2.0 | https://github.com/psf/requests | License field |
| rich | 15.0.0 | MIT | https://github.com/Textualize/rich | License field |
| rich-rst | 2.2.0 | MIT | https://github.com/wasi-master/rich-rst | License-Expression |
| rpds-py | 2026.9.1 | MIT | https://github.com/crate-py/rpds | License-Expression |
| s3transfer | 0.19.3 | Apache-2.0 | https://github.com/boto/s3transfer | License field |
| shellingham | 1.5.4 | ISC | https://github.com/sarugaku/shellingham | License field |
| simple-websocket | 1.1.0 | MIT | https://github.com/miguelgrinberg/simple-websocket | classifier |
| six | 1.17.0 | MIT | https://github.com/benjaminp/six | License field |
| slack-sdk | 3.46.0 | MIT | https://github.com/slackapi/python-slack-sdk | License field |
| sniffio | 1.3.1 | Apache-2.0 | https://github.com/python-trio/sniffio | licence file text |
| soupsieve | 3.0.4 | MIT | https://github.com/facelessuser/soupsieve | License-Expression |
| sqlalchemy | 2.1.8 | MIT | https://github.com/sqlalchemy/sqlalchemy | License-Expression |
| sse-starlette | 3.6.0 | BSD-3-Clause | https://github.com/sysid/sse-starlette | License-Expression |
| starlette | 1.10.0 | BSD-3-Clause | https://github.com/Kludex/starlette | License-Expression |
| subagents-pydantic-ai | 0.2.25 | MIT | https://github.com/vstorm-co/subagents-pydantic-ai | License field |
| tabulate | 0.10.0 | MIT | https://github.com/astanin/python-tabulate | License-Expression |
| tavily-python | 0.8.5 | MIT | https://github.com/tavily-ai/tavily-python | classifier |
| tenacity | 9.1.4 | Apache-2.0 | https://github.com/jd/tenacity | License field |
| tiktoken | 0.14.0 | MIT | https://github.com/openai/tiktoken | License field |
| tokenizers | 0.23.3 | Apache-2.0 | https://github.com/huggingface/tokenizers | classifier; no licence file, attributed to Nicolas Patry, Anthony Moi |
| toml | 0.10.2 | MIT | https://github.com/uiri/toml | License field |
| tqdm | 4.70.1 | MPL-2.0 | https://github.com/tqdm/tqdm | licence file text; review accepted |
| truststore | 0.10.5 | MIT | https://github.com/sethmlarson/truststore | License-Expression |
| typer | 0.25.1 | MIT | https://github.com/fastapi/typer | License-Expression |
| types-requests | 2.33.0.20261006 | Apache-2.0 | https://github.com/python/typeshed | License-Expression |
| typing-extensions | 4.16.0 | PSF-2.0 | https://github.com/python/typing_extensions | License-Expression |
| typing-inspection | 0.4.4 | MIT | https://github.com/pydantic/typing-inspection | License-Expression |
| uncalled-for | 0.4.1 | MIT | https://github.com/chrisguidry/uncalled-for | License-Expression |
| urllib3 | 2.8.0 | MIT | https://urllib3.readthedocs.io | License-Expression |
| uvicorn | 0.54.0 | BSD-3-Clause | https://github.com/Kludex/uvicorn | License-Expression |
| uvloop | 0.23.0 | MIT | https://github.com/MagicStack/uvloop | License field |
| watchfiles | 1.3.0 | MIT | https://github.com/samuelcolvin/watchfiles | License field |
| wcmatch | 11.2 | MIT | https://github.com/facelessuser/wcmatch | License-Expression |
| websocket-client | 1.9.2 | Apache-2.0 | https://github.com/websocket-client/websocket-client/ | License field |
| websockets | 17.4 | BSD-3-Clause | https://github.com/python-websockets/websockets | License-Expression |
| wrapt | 2.5.1 | BSD-2-Clause | https://github.com/GrahamDumpleton/wrapt | License-Expression |
| wsproto | 1.3.2 | MIT | https://github.com/python-hyper/wsproto/ | License-Expression |
| xai-sdk | 1.21.0 | Apache-2.0 | https://github.com/xai-org/xai-sdk-python | License-Expression |
| xlrd | 2.0.2 | BSD-2-Clause | http://www.python-excel.org/ | licence file text |
| xlsxwriter | 3.3.0 | BSD-2-Clause | https://github.com/jmcnamara/XlsxWriter | License-Expression |
| yarl | 1.25.1 | Apache-2.0 | https://github.com/aio-libs/yarl | License field |

## Frontend image (npm)

310 distributions.

| Component | Version | Licence | Source | Evidence |
|---|---|---|---|---|
| @blobatar/react | 2.7.0 | MIT | https://github.com/Alain00/blobatar | package.json license |
| @eloqnt/config | 0.1.0 | MIT | https://cli.eloqnt.dev/docs/configuration | package.json license |
| @eloqnt/format-json | 0.1.0 | MIT | https://cli.eloqnt.dev/docs/configuration | package.json license |
| @eloqnt/format-po | 0.1.0 | MIT | https://cli.eloqnt.dev/docs/formats/po | package.json license |
| @floating-ui/core | 1.8.0 | MIT | https://github.com/floating-ui/floating-ui | package.json license |
| @floating-ui/dom | 1.8.0 | MIT | https://github.com/floating-ui/floating-ui | package.json license |
| @floating-ui/react-dom | 2.1.9 | MIT | https://github.com/floating-ui/floating-ui | package.json license |
| @floating-ui/utils | 0.2.12 | MIT | https://github.com/floating-ui/floating-ui | package.json license |
| @formatjs/fast-memoize | 3.1.7 | MIT | https://github.com/formatjs/formatjs | package.json license |
| @formatjs/icu-messageformat-parser | 3.5.16 | MIT | https://github.com/formatjs/formatjs | package.json license |
| @formatjs/icu-skeleton-parser | 2.1.11 | MIT | https://github.com/formatjs/formatjs | package.json license |
| @formatjs/intl-localematcher | 0.8.13 | MIT | https://github.com/formatjs/formatjs | package.json license |
| @img/colour | 1.1.0 | MIT | https://github.com/lovell/colour | package.json license |
| @img/sharp-libvips-linux-arm64 | 1.3.4 | LGPL-3.0-or-later | https://github.com/lovell/sharp-libvips | package.json license; review accepted |
| @img/sharp-libvips-linux-x64 | 1.3.4 | LGPL-3.0-or-later | https://github.com/lovell/sharp-libvips | package.json license; review accepted |
| @img/sharp-linux-arm64 | 0.35.5 | Apache-2.0 | https://github.com/lovell/sharp | package.json license |
| @img/sharp-linux-x64 | 0.35.5 | Apache-2.0 | https://github.com/lovell/sharp | package.json license |
| @next/env | 16.4.2 | MIT | https://github.com/vercel/next.js | package.json license; no licence file, attributed to Next.js Team <support@vercel.com> |
| @next/swc-linux-arm64-gnu | 16.4.2 | MIT | https://github.com/vercel/next.js | package.json license |
| @next/swc-linux-x64-gnu | 16.4.2 | MIT | https://github.com/vercel/next.js | package.json license |
| @opentelemetry/api | 1.9.1 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js | package.json license |
| @opentelemetry/api-logs | 0.221.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js | package.json license |
| @opentelemetry/core | 2.10.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js | package.json license |
| @opentelemetry/instrumentation | 0.221.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js | package.json license |
| @opentelemetry/resources | 2.10.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js | package.json license |
| @opentelemetry/sdk-logs | 0.221.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js | package.json license |
| @opentelemetry/sdk-metrics | 2.10.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js | package.json license |
| @opentelemetry/sdk-trace | 2.10.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js | package.json license |
| @opentelemetry/sdk-trace-base | 2.10.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js | package.json license |
| @opentelemetry/semantic-conventions | 1.43.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js | package.json license |
| @parcel/watcher | 2.6.0 | MIT | https://github.com/parcel-bundler/watcher | package.json license |
| @parcel/watcher-linux-arm64-glibc | 2.6.0 | MIT | https://github.com/parcel-bundler/watcher | package.json license |
| @parcel/watcher-linux-x64-glibc | 2.6.0 | MIT | https://github.com/parcel-bundler/watcher | package.json license |
| @playwright/test | 1.63.0 | Apache-2.0 | https://github.com/microsoft/playwright | package.json license |
| @radix-ui/number | 1.1.3 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/primitive | 1.1.7 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-alert-dialog | 1.1.23 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-arrow | 1.1.15 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-avatar | 1.2.6 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-checkbox | 1.3.11 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-collection | 1.1.15 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-compose-refs | 1.1.5 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-context | 1.2.2 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-context-menu | 2.3.7 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-dialog | 1.1.23 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-direction | 1.1.4 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-dismissable-layer | 1.1.19 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-dropdown-menu | 2.1.24 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-focus-guards | 1.1.6 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-focus-scope | 1.1.16 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-id | 1.1.4 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-menu | 2.1.24 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-popover | 1.1.23 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-popper | 1.3.7 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-portal | 1.1.17 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-presence | 1.1.10 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-primitive | 2.1.10 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-progress | 1.1.16 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-roving-focus | 1.1.19 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-select | 2.3.7 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-separator | 1.1.15 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-slot | 1.3.3 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-switch | 1.3.7 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-tabs | 1.1.21 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-tooltip | 1.2.16 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-use-callback-ref | 1.1.4 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-use-controllable-state | 1.2.6 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-use-effect-event | 0.0.5 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-use-is-hydrated | 0.1.3 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-use-layout-effect | 1.1.4 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-use-previous | 1.1.4 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-use-rect | 1.1.4 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-use-size | 1.1.4 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/react-visually-hidden | 1.2.11 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @radix-ui/rect | 1.1.3 | MIT | https://github.com/radix-ui/primitives | package.json license |
| @reduxjs/toolkit | 2.12.0 | MIT | https://github.com/reduxjs/redux-toolkit | package.json license |
| @schummar/icu-type-parser | 1.21.5 | MIT | https://github.com/schummar/schummar-translate | package.json license; no licence file, attributed to Marco Schumacher, Marco Schumacher |
| @standard-schema/spec | 1.1.0 | MIT | https://github.com/standard-schema/standard-schema | package.json license |
| @standard-schema/utils | 0.3.0 | MIT | https://github.com/standard-schema/standard-schema | package.json license |
| @swc/core | 1.16.2 | Apache-2.0 | https://github.com/swc-project/swc | package.json license |
| @swc/core-linux-arm64-gnu | 1.16.2 | Apache-2.0 AND MIT | https://github.com/swc-project/swc | package.json license |
| @swc/core-linux-x64-gnu | 1.16.2 | Apache-2.0 AND MIT | https://github.com/swc-project/swc | package.json license |
| @swc/counter | 0.1.3 | Apache-2.0 | https://github.com/swc-project/pkgs | package.json license; no licence file, attributed to 강동윤 <kdy1997.dev@gmail.com> |
| @swc/helpers | 0.5.23 | Apache-2.0 | https://github.com/swc-project/swc | package.json license |
| @swc/types | 0.1.28 | Apache-2.0 | https://github.com/swc-project/swc | package.json license |
| @tanstack/query-core | 5.102.8 | MIT | https://github.com/TanStack/query | package.json license |
| @tanstack/react-query | 5.102.8 | MIT | https://github.com/TanStack/query | package.json license |
| @types/d3-array | 3.2.2 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/d3-color | 3.1.3 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/d3-drag | 3.0.7 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/d3-ease | 3.0.2 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/d3-interpolate | 3.0.4 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/d3-path | 3.1.1 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/d3-scale | 4.0.9 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/d3-selection | 3.0.12 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/d3-shape | 3.1.8 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/d3-time | 3.0.4 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/d3-timer | 3.0.2 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/d3-transition | 3.0.9 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/d3-zoom | 3.0.8 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/debug | 4.1.13 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/estree | 1.0.9 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/estree-jsx | 1.0.5 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/hast | 3.0.5 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/mdast | 4.0.4 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/ms | 2.1.0 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/react | 19.3.0 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/react-dom | 19.3.0 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/unist | 2.0.11 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/unist | 3.0.3 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @types/use-sync-external-store | 0.0.6 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | package.json license |
| @ungap/structured-clone | 1.3.3 | ISC | https://github.com/ungap/structured-clone | package.json license |
| @vercel/otel | 2.1.3 | MIT | https://github.com/vercel/otel | package.json license |
| @xyflow/react | 12.11.6 | MIT | https://github.com/xyflow/xyflow | package.json license |
| @xyflow/system | 0.0.82 | MIT | https://github.com/xyflow/xyflow | package.json license |
| aria-hidden | 1.2.6 | MIT | https://github.com/theKashey/aria-hidden | package.json license |
| bail | 2.0.2 | MIT | https://github.com/wooorm/bail | package.json license |
| baseline-browser-mapping | 2.11.10 | Apache-2.0 | https://github.com/web-platform-dx/baseline-browser-mapping | package.json license |
| blobatar | 2.7.0 | MIT | https://github.com/Alain00/blobatar | package.json license |
| border-beam | 1.3.0 | MIT | https://github.com/Jakubantalik/border-beam | package.json license |
| caniuse-lite | 1.0.30001806 | CC-BY-4.0 | https://github.com/browserslist/caniuse-lite | package.json license; review accepted |
| ccount | 2.0.1 | MIT | https://github.com/wooorm/ccount | package.json license |
| character-entities | 2.0.2 | MIT | https://github.com/wooorm/character-entities | package.json license |
| character-entities-html4 | 2.1.0 | MIT | https://github.com/wooorm/character-entities-html4 | package.json license |
| character-entities-legacy | 3.0.0 | MIT | https://github.com/wooorm/character-entities-legacy | package.json license |
| character-reference-invalid | 2.0.1 | MIT | https://github.com/wooorm/character-reference-invalid | package.json license |
| cjs-module-lexer | 2.2.0 | MIT | https://github.com/nodejs/cjs-module-lexer | package.json license |
| class-variance-authority | 0.7.1 | Apache-2.0 | https://github.com/joe-bell/cva | package.json license |
| classcat | 5.0.5 | MIT | https://github.com/jorgebucaran/classcat | package.json license |
| client-only | 0.0.1 | MIT | https://reactjs.org/ | package.json license; no licence file, attributed to Meta Platforms, Inc. and affiliates |
| clsx | 2.1.1 | MIT | https://github.com/lukeed/clsx | package.json license |
| cmdk | 1.1.1 | MIT | https://github.com/pacocoursey/cmdk | package.json license |
| comma-separated-tokens | 2.0.3 | MIT | https://github.com/wooorm/comma-separated-tokens | package.json license |
| css-tree | 3.2.1 | MIT | https://github.com/csstree/csstree | package.json license |
| csstype | 3.2.3 | MIT | https://github.com/frenic/csstype | package.json license |
| d3-array | 3.2.4 | ISC | https://github.com/d3/d3-array | package.json license |
| d3-color | 3.1.0 | ISC | https://github.com/d3/d3-color | package.json license |
| d3-dispatch | 3.0.1 | ISC | https://github.com/d3/d3-dispatch | package.json license |
| d3-drag | 3.0.0 | ISC | https://github.com/d3/d3-drag | package.json license |
| d3-ease | 3.0.1 | BSD-3-Clause | https://github.com/d3/d3-ease | package.json license |
| d3-format | 3.1.2 | ISC | https://github.com/d3/d3-format | package.json license |
| d3-interpolate | 3.0.1 | ISC | https://github.com/d3/d3-interpolate | package.json license |
| d3-path | 3.1.0 | ISC | https://github.com/d3/d3-path | package.json license |
| d3-scale | 4.0.2 | ISC | https://github.com/d3/d3-scale | package.json license |
| d3-selection | 3.0.0 | ISC | https://github.com/d3/d3-selection | package.json license |
| d3-shape | 3.2.0 | ISC | https://github.com/d3/d3-shape | package.json license |
| d3-time | 3.1.0 | ISC | https://github.com/d3/d3-time | package.json license |
| d3-time-format | 4.1.0 | ISC | https://github.com/d3/d3-time-format | package.json license |
| d3-timer | 3.0.1 | ISC | https://github.com/d3/d3-timer | package.json license |
| d3-transition | 3.0.1 | ISC | https://github.com/d3/d3-transition | package.json license |
| d3-zoom | 3.0.0 | ISC | https://github.com/d3/d3-zoom | package.json license |
| debug | 4.4.3 | MIT | https://github.com/debug-js/debug | package.json license |
| decimal.js-light | 2.5.1 | MIT | https://github.com/MikeMcl/decimal.js-light | package.json license |
| decode-named-character-reference | 1.3.0 | MIT | https://github.com/wooorm/decode-named-character-reference | package.json license |
| dequal | 2.0.3 | MIT | https://github.com/lukeed/dequal | package.json license |
| detect-libc | 2.1.2 | Apache-2.0 | https://github.com/lovell/detect-libc | package.json license |
| detect-node-es | 1.1.0 | MIT | https://github.com/thekashey/detect-node | package.json license |
| devlop | 1.1.0 | MIT | https://github.com/wooorm/devlop | package.json license |
| driver.js | 1.8.0 | MIT | https://github.com/nilbuild/driver.js | package.json license |
| es-module-lexer | 2.3.1 | MIT | https://github.com/guybedford/es-module-lexer | package.json license |
| es-toolkit | 1.50.0 | MIT | https://github.com/toss/es-toolkit | package.json license |
| escape-string-regexp | 5.0.0 | MIT | https://github.com/sindresorhus/escape-string-regexp | package.json license |
| estree-util-is-identifier-name | 3.0.0 | MIT | https://github.com/syntax-tree/estree-util-is-identifier-name | package.json license |
| eventemitter3 | 5.0.4 | MIT | https://github.com/primus/eventemitter3 | package.json license |
| extend | 3.0.2 | MIT | https://github.com/justmoon/node-extend | package.json license |
| framer-motion | 13.4.0 | MIT | https://github.com/motiondivision/motion/ | package.json license |
| get-nonce | 1.0.1 | MIT | https://github.com/theKashey/get-nonce | package.json license |
| hast-util-is-element | 3.0.0 | MIT | https://github.com/syntax-tree/hast-util-is-element | package.json license |
| hast-util-to-jsx-runtime | 2.3.6 | MIT | https://github.com/syntax-tree/hast-util-to-jsx-runtime | package.json license |
| hast-util-to-text | 4.0.2 | MIT | https://github.com/syntax-tree/hast-util-to-text | package.json license |
| hast-util-whitespace | 3.0.0 | MIT | https://github.com/syntax-tree/hast-util-whitespace | package.json license |
| highlight.js | 11.11.1 | BSD-3-Clause | https://github.com/highlightjs/highlight.js | package.json license |
| html-url-attributes | 3.0.1 | MIT | https://github.com/rehypejs/rehype-minify/tree/main/packages/html-url-attributes | package.json license |
| icu-minify | 4.14.5 | MIT | https://github.com/amannn/next-intl | package.json license |
| img-fx | 0.5.1 | MIT | https://github.com/Jakubantalik/img-fx | package.json license |
| immer | 11.1.15 | MIT | https://github.com/immerjs/immer | package.json license |
| import-in-the-middle | 3.3.3 | Apache-2.0 | https://github.com/nodejs/import-in-the-middle | package.json license |
| inline-style-parser | 0.2.7 | MIT | https://github.com/remarkablemark/inline-style-parser | package.json license |
| internmap | 2.0.3 | ISC | https://github.com/mbostock/internmap | package.json license |
| intl-messageformat | 11.2.13 | BSD-3-Clause | https://github.com/formatjs/formatjs | package.json license |
| is-alphabetical | 2.0.1 | MIT | https://github.com/wooorm/is-alphabetical | package.json license |
| is-alphanumerical | 2.0.1 | MIT | https://github.com/wooorm/is-alphanumerical | package.json license |
| is-decimal | 2.0.1 | MIT | https://github.com/wooorm/is-decimal | package.json license |
| is-extglob | 2.1.1 | MIT | https://github.com/jonschlinkert/is-extglob | package.json license |
| is-glob | 4.0.3 | MIT | https://github.com/micromatch/is-glob | package.json license |
| is-hexadecimal | 2.0.1 | MIT | https://github.com/wooorm/is-hexadecimal | package.json license |
| is-plain-obj | 4.1.0 | MIT | https://github.com/sindresorhus/is-plain-obj | package.json license |
| longest-streak | 3.1.0 | MIT | https://github.com/wooorm/longest-streak | package.json license |
| lowlight | 3.3.0 | MIT | https://github.com/wooorm/lowlight | package.json license |
| lucide-react | 1.46.0 | ISC | https://github.com/lucide-icons/lucide | package.json license |
| markdown-table | 3.0.4 | MIT | https://github.com/wooorm/markdown-table | package.json license |
| mdast-util-find-and-replace | 3.0.2 | MIT | https://github.com/syntax-tree/mdast-util-find-and-replace | package.json license |
| mdast-util-from-markdown | 2.0.3 | MIT | https://github.com/syntax-tree/mdast-util-from-markdown | package.json license |
| mdast-util-gfm | 3.1.0 | MIT | https://github.com/syntax-tree/mdast-util-gfm | package.json license |
| mdast-util-gfm-autolink-literal | 2.0.1 | MIT | https://github.com/syntax-tree/mdast-util-gfm-autolink-literal | package.json license |
| mdast-util-gfm-footnote | 2.1.0 | MIT | https://github.com/syntax-tree/mdast-util-gfm-footnote | package.json license |
| mdast-util-gfm-strikethrough | 2.0.0 | MIT | https://github.com/syntax-tree/mdast-util-gfm-strikethrough | package.json license |
| mdast-util-gfm-table | 2.0.0 | MIT | https://github.com/syntax-tree/mdast-util-gfm-table | package.json license |
| mdast-util-gfm-task-list-item | 2.0.0 | MIT | https://github.com/syntax-tree/mdast-util-gfm-task-list-item | package.json license |
| mdast-util-mdx-expression | 2.0.1 | MIT | https://github.com/syntax-tree/mdast-util-mdx-expression | package.json license |
| mdast-util-mdx-jsx | 3.2.0 | MIT | https://github.com/syntax-tree/mdast-util-mdx-jsx | package.json license |
| mdast-util-mdxjs-esm | 2.0.1 | MIT | https://github.com/syntax-tree/mdast-util-mdxjs-esm | package.json license |
| mdast-util-phrasing | 4.1.0 | MIT | https://github.com/syntax-tree/mdast-util-phrasing | package.json license |
| mdast-util-to-hast | 13.2.1 | MIT | https://github.com/syntax-tree/mdast-util-to-hast | package.json license |
| mdast-util-to-markdown | 2.1.2 | MIT | https://github.com/syntax-tree/mdast-util-to-markdown | package.json license |
| mdast-util-to-string | 4.0.0 | MIT | https://github.com/syntax-tree/mdast-util-to-string | package.json license |
| mdn-data | 2.27.1 | CC0-1.0 | https://github.com/mdn/data | package.json license |
| micromark | 4.0.2 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark | package.json license |
| micromark-core-commonmark | 2.0.3 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark-core-commonmark | package.json license |
| micromark-extension-gfm | 3.0.0 | MIT | https://github.com/micromark/micromark-extension-gfm | package.json license |
| micromark-extension-gfm-autolink-literal | 2.1.0 | MIT | https://github.com/micromark/micromark-extension-gfm-autolink-literal | package.json license |
| micromark-extension-gfm-footnote | 2.1.0 | MIT | https://github.com/micromark/micromark-extension-gfm-footnote | package.json license |
| micromark-extension-gfm-strikethrough | 2.1.0 | MIT | https://github.com/micromark/micromark-extension-gfm-strikethrough | package.json license |
| micromark-extension-gfm-table | 2.1.1 | MIT | https://github.com/micromark/micromark-extension-gfm-table | package.json license |
| micromark-extension-gfm-tagfilter | 2.0.0 | MIT | https://github.com/micromark/micromark-extension-gfm-tagfilter | package.json license |
| micromark-extension-gfm-task-list-item | 2.1.0 | MIT | https://github.com/micromark/micromark-extension-gfm-task-list-item | package.json license |
| micromark-factory-destination | 2.0.1 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark-factory-destination | package.json license |
| micromark-factory-label | 2.0.1 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark-factory-label | package.json license |
| micromark-factory-space | 2.0.1 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark-factory-space | package.json license |
| micromark-factory-title | 2.0.1 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark-factory-title | package.json license |
| micromark-factory-whitespace | 2.0.1 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark-factory-whitespace | package.json license |
| micromark-util-character | 2.1.1 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark-util-character | package.json license |
| micromark-util-chunked | 2.0.1 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark-util-chunked | package.json license |
| micromark-util-classify-character | 2.0.1 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark-util-classify-character | package.json license |
| micromark-util-combine-extensions | 2.0.1 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark-util-combine-extensions | package.json license |
| micromark-util-decode-numeric-character-reference | 2.0.2 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark-util-decode-numeric-character-reference | package.json license |
| micromark-util-decode-string | 2.0.1 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark-util-decode-string | package.json license |
| micromark-util-encode | 2.0.1 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark-util-encode | package.json license |
| micromark-util-html-tag-name | 2.0.1 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark-util-html-tag-name | package.json license |
| micromark-util-normalize-identifier | 2.0.1 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark-util-normalize-identifier | package.json license |
| micromark-util-resolve-all | 2.0.1 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark-util-resolve-all | package.json license |
| micromark-util-sanitize-uri | 2.0.1 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark-util-sanitize-uri | package.json license |
| micromark-util-subtokenize | 2.1.0 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark-util-subtokenize | package.json license |
| micromark-util-symbol | 2.0.1 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark-util-symbol | package.json license |
| micromark-util-types | 2.0.2 | MIT | https://github.com/micromark/micromark/tree/main/packages/micromark-util-types | package.json license |
| module-details-from-path | 1.0.4 | MIT | https://github.com/watson/module-details-from-path | package.json license |
| motion | 13.4.0 | MIT | https://github.com/motiondivision/motion | package.json license |
| motion-dom | 13.3.0 | MIT | https://github.com/motiondivision/motion | package.json license |
| motion-utils | 13.3.0 | MIT | https://github.com/motiondivision/motion | package.json license |
| ms | 2.1.3 | MIT | https://github.com/vercel/ms | package.json license |
| nanoid | 3.3.19 | MIT | https://github.com/ai/nanoid | package.json license |
| negotiator | 1.0.0 | MIT | https://github.com/jshttp/negotiator | package.json license |
| next | 16.4.2 | MIT | https://github.com/vercel/next.js | package.json license |
| next-intl | 4.14.5 | MIT | https://github.com/amannn/next-intl | package.json license |
| next-intl-swc-plugin-extractor | 4.14.5 | MIT | https://github.com/amannn/next-intl | package.json license |
| node-addon-api | 7.1.1 | MIT | https://github.com/nodejs/node-addon-api | package.json license |
| parse-entities | 4.0.2 | MIT | https://github.com/wooorm/parse-entities | package.json license |
| picocolors | 1.1.1 | ISC | https://github.com/alexeyraspopov/picocolors | package.json license |
| picomatch | 4.0.5 | MIT | https://github.com/micromatch/picomatch | package.json license |
| playwright | 1.63.0 | Apache-2.0 | https://github.com/microsoft/playwright | package.json license |
| playwright-core | 1.63.0 | Apache-2.0 | https://github.com/microsoft/playwright | package.json license |
| po-parser | 2.2.0 | MIT | https://github.com/amannn/po-parser | package.json license |
| postcss | 8.5.23 | MIT | https://github.com/postcss/postcss | package.json license |
| property-information | 7.2.0 | MIT | https://github.com/wooorm/property-information | package.json license |
| react | 19.3.0 | MIT | https://github.com/react/react | package.json license |
| react-dom | 19.3.0 | MIT | https://github.com/react/react | package.json license |
| react-is | 19.2.8 | MIT | https://github.com/react/react | package.json license |
| react-markdown | 10.1.0 | MIT | https://github.com/remarkjs/react-markdown | package.json license |
| react-redux | 9.3.0 | MIT | github:reduxjs/react-redux | package.json license |
| react-remove-scroll | 2.7.2 | MIT | https://github.com/theKashey/react-remove-scroll | package.json license |
| react-remove-scroll-bar | 2.3.8 | MIT | https://github.com/theKashey/react-remove-scroll-bar | package.json license; no licence file, attributed to Anton Korzunov <thekashey@gmail.com> |
| react-style-singleton | 2.2.3 | MIT | https://github.com/theKashey/react-style-singleton | package.json license |
| recharts | 3.10.1 | MIT | https://github.com/recharts/recharts | package.json license |
| redux | 5.0.1 | MIT | github:reduxjs/redux | package.json license |
| redux-thunk | 3.1.0 | MIT | github:reduxjs/redux-thunk | package.json license |
| rehype-highlight | 7.0.2 | MIT | https://github.com/rehypejs/rehype-highlight | package.json license |
| remark-gfm | 4.0.1 | MIT | https://github.com/remarkjs/remark-gfm | package.json license |
| remark-parse | 11.0.0 | MIT | https://github.com/remarkjs/remark/tree/main/packages/remark-parse | package.json license |
| remark-rehype | 11.1.2 | MIT | https://github.com/remarkjs/remark-rehype | package.json license |
| remark-stringify | 11.0.0 | MIT | https://github.com/remarkjs/remark/tree/main/packages/remark-stringify | package.json license |
| require-in-the-middle | 8.0.1 | MIT | https://github.com/nodejs/require-in-the-middle | package.json license |
| reselect | 5.2.0 | MIT | https://github.com/reduxjs/reselect | package.json license |
| scheduler | 0.28.0 | MIT | https://github.com/react/react | package.json license |
| semver | 7.8.5 | ISC | https://github.com/npm/node-semver | package.json license |
| sharp | 0.35.5 | Apache-2.0 | https://github.com/lovell/sharp | package.json license |
| sonner | 2.0.8 | MIT | https://github.com/emilkowalski/sonner | package.json license |
| source-map-js | 1.2.2 | BSD-3-Clause | https://github.com/7rulnik/source-map-js | package.json license |
| space-separated-tokens | 2.0.2 | MIT | https://github.com/wooorm/space-separated-tokens | package.json license |
| stringify-entities | 4.0.4 | MIT | https://github.com/wooorm/stringify-entities | package.json license |
| style-to-js | 1.1.21 | MIT | https://github.com/remarkablemark/style-to-js | package.json license |
| style-to-object | 1.0.14 | MIT | https://github.com/remarkablemark/style-to-object | package.json license |
| styled-jsx | 5.1.6 | MIT | https://github.com/vercel/styled-jsx | package.json license |
| tailwind-merge | 3.7.0 | MIT | https://github.com/dcastil/tailwind-merge | package.json license |
| thinking-orbs | 0.3.1 | MIT | https://github.com/Jakubantalik/thinking-orbs | package.json license |
| three | 0.186.0 | MIT | https://github.com/mrdoob/three.js | package.json license |
| tiny-invariant | 1.3.3 | MIT | https://github.com/alexreardon/tiny-invariant | package.json license |
| trim-lines | 3.0.1 | MIT | https://github.com/wooorm/trim-lines | package.json license |
| trough | 2.2.0 | MIT | https://github.com/wooorm/trough | package.json license |
| tslib | 2.8.1 | 0BSD | https://github.com/Microsoft/tslib | package.json license |
| unified | 11.0.5 | MIT | https://github.com/unifiedjs/unified | package.json license |
| unist-util-find-after | 5.0.0 | MIT | https://github.com/syntax-tree/unist-util-find-after | package.json license |
| unist-util-is | 6.0.1 | MIT | https://github.com/syntax-tree/unist-util-is | package.json license |
| unist-util-position | 5.0.0 | MIT | https://github.com/syntax-tree/unist-util-position | package.json license |
| unist-util-stringify-position | 4.0.0 | MIT | https://github.com/syntax-tree/unist-util-stringify-position | package.json license |
| unist-util-visit | 5.1.0 | MIT | https://github.com/syntax-tree/unist-util-visit | package.json license |
| unist-util-visit-parents | 6.0.2 | MIT | https://github.com/syntax-tree/unist-util-visit-parents | package.json license |
| uqr | 0.1.3 | MIT | https://github.com/unjs/uqr | package.json license |
| use-callback-ref | 1.3.3 | MIT | https://github.com/theKashey/use-callback-ref/ | package.json license |
| use-intl | 4.14.5 | MIT | https://github.com/amannn/next-intl | package.json license |
| use-sidecar | 1.1.3 | MIT | https://github.com/theKashey/use-sidecar | package.json license |
| use-sync-external-store | 1.6.0 | MIT | https://github.com/facebook/react | package.json license |
| vfile | 6.0.3 | MIT | https://github.com/vfile/vfile | package.json license |
| vfile-message | 4.0.3 | MIT | https://github.com/vfile/vfile-message | package.json license |
| victory-vendor | 37.3.6 | MIT AND ISC | https://github.com/FormidableLabs/victory | package.json license; no licence file, attributed to Formidable |
| voice-glow | 0.2.0 | MIT | https://github.com/Jakubantalik/Libraries.dev | package.json license |
| yaml | 2.9.1 | ISC | github:eemeli/yaml | package.json license |
| zod | 4.6.7 | MIT | https://github.com/colinhacks/zod | package.json license |
| zustand | 4.5.7 | MIT | https://github.com/pmndrs/zustand | package.json license |
| zustand | 5.0.15 | MIT | https://github.com/pmndrs/zustand | package.json license |
| zwitch | 2.0.4 | MIT | https://github.com/wooorm/zwitch | package.json license |

## Other components

Recorded by hand in `licenses/components.toml`: the images the containers are
built from and the ones a deployment runs beside them, system packages, fonts
and data files.

| Component | Version | Kind | Licence | Source | Status | Obligations | How they are met |
|---|---|---|---|---|---|---|---|
| python (Docker Official Image) | 3.15-slim (Debian) | runtime image, backend | Python: PSF-2.0. Debian base: each package under its own licence (GPL-2.0, GPL-3.0, LGPL-2.1, MIT, BSD and others). | https://hub.docker.com/_/python | accepted | Ship licence texts and, for GPL and LGPL packages in the base, make their corresponding source available to recipients of the image. | Debian keeps every package's licence under /usr/share/doc/<package>/copyright in the image and publishes the matching source packages (apt-get source; https://snapshot.debian.org). The image is distributed unmodified apart from the packages listed below; the per-release SBOM (#1415) records the exact package set. |
| libreoffice-core, libreoffice-writer, libreoffice-calc, libreoffice-impress (Debian packages) | as pinned by the base image's Debian release | system package, backend image | MPL-2.0 (LibreOffice), with parts under LGPL-3.0-or-later and Apache-2.0 | https://www.libreoffice.org/about-us/licenses/ | accepted | MPL and LGPL: licence texts ship with the binaries and their source is available; used unmodified, invoked as a separate process by LiteParse for office-format conversion. | Debian's /usr/share/doc/libreoffice-*/copyright is in the image; source through Debian's source packages; no modification. |
| tesseract-ocr, tesseract-ocr-eng, tesseract-ocr-pol (Debian packages) | as pinned by the base image's Debian release | system package, backend image | Apache-2.0 (engine and language data) | https://github.com/tesseract-ocr/tesseract | accepted | Attribution and the licence text. | Debian's /usr/share/doc/tesseract-ocr*/copyright is in the image; named here. |
| oven/bun (Docker image) | 1 (Debian) | runtime image, frontend | Bun: MIT (with bundled components under their own licences, listed in Bun's LICENSE.md). Debian base: as for the python image. | https://hub.docker.com/r/oven/bun | accepted | Ship licence texts; for GPL and LGPL packages in the base, make their corresponding source available to recipients of the image. | As for the python image: /usr/share/doc/*/copyright in the image, Debian's source packages, the per-release SBOM (#1415). |
| ghcr.io/astral-sh/uv (build stage only) | latest | build tool, not in the published image | Apache-2.0 OR MIT | https://github.com/astral-sh/uv | accepted | None for the published image: the binary is copied into the builder stage and installs the wheels; it is not in the final layer. | Not distributed. |
| debian (Docker Official Image) | bookworm-slim | runtime image, browser | Each package under its own licence (GPL-2.0, GPL-3.0, LGPL-2.1, MIT, BSD and others). | https://hub.docker.com/_/debian | accepted | Ship licence texts and, for GPL and LGPL packages, make their corresponding source available to recipients of the image. | Debian keeps every package's licence under /usr/share/doc/<package>/copyright in the image and publishes the matching source packages (apt-get source; https://snapshot.debian.org). Distributed unmodified apart from the packages listed below; the per-release SBOM records the exact package set. |
| chromium (Debian package) | as pinned by Debian bookworm | system package, browser image | BSD-3-Clause (Chromium), with bundled components under their own licences (LGPL-2.1, MPL-2.0, Apache-2.0, MIT and others), listed in chrome://credits | https://www.chromium.org/ | accepted | Licence texts and attribution; for LGPL components, their source available to recipients. | Debian's /usr/share/doc/chromium/copyright is in the image and chrome://credits lists every bundled component; source through Debian's source package; used unmodified. |
| xvfb, socat, dumb-init, tzdata (Debian packages) | as pinned by Debian bookworm | system package, browser image | Xvfb: MIT/X11. socat: GPL-2.0. dumb-init: MIT. tzdata: public domain. | https://packages.debian.org/bookworm/ | accepted | Licence texts; socat (GPL-2.0) is run unmodified as a separate process, so its corresponding source available to recipients. | Debian's /usr/share/doc/<package>/copyright for each is in the image; source through Debian's source packages; none modified. |
| fonts-liberation, fonts-noto, fonts-noto-cjk, fonts-noto-color-emoji (Debian packages) | as pinned by Debian bookworm | system package, browser image | Liberation: OFL-1.1. Noto: OFL-1.1 (Noto Color Emoji: OFL-1.1, its images Apache-2.0). | https://fonts.google.com/noto | accepted | OFL-1.1: the licence text travels with the fonts; the fonts are not sold on their own. | Debian's /usr/share/doc/fonts-*/copyright is in the image; installed as system fonts the browser renders pages with, never sold or redistributed apart from the image. |
| Inter, Bricolage Grotesque, Geist Mono (web fonts) | Google Fonts v20, v9, v6 (frontend/src/app/fonts/README.md) | font, frontend image | OFL-1.1 | https://fonts.google.com | accepted | Distribute with the licence text and each family's copyright notice; do not sell the fonts on their own; do not use the reserved font names for a modified version. | frontend/src/app/fonts/OFL.txt carries the licence and all three copyright notices; frontend/scripts/collect-licenses.ts copies it into the frontend image at /app/licenses/OFL.txt; the fonts are served unmodified under their own names. |
| Brand marks in frontend/src/lib/brand-glyphs.generated.ts | as generated by frontend/scripts/gen-brand-icons.ts | icons, frontend image | Simple Icons: CC0-1.0. @lobehub/icons: MIT. SVG Logos (Gil Barbara): CC0-1.0. theSVG: MIT. The marks themselves are their owners' trademarks. | https://simpleicons.org, https://icons.lobehub.com, https://github.com/gilbarbara/logos, https://github.com/glincker/thesvg | accepted | MIT notices for @lobehub/icons and theSVG; trademark use limited to identifying the product each mark stands for. | NOTICE at the repository root and frontend/NOTICE name the four sources, their licences and the trademark position; the frontend one is copied into the image at /app/licenses/NOTICE. The console draws a mark only next to the product it identifies. |
| Rare UI components vendored into frontend/src/components/ui/ | swamimalode07/rare-ui as of 2026-09-22 (animated-counter, notification-bell, task-list) | source, frontend image | MIT | https://github.com/swamimalode07/rare-ui | accepted | Keep the copyright notice and the permission notice with the copies or substantial portions of the software. | NOTICE at the repository root and frontend/NOTICE name the project, its copyright holder and the MIT text; frontend/scripts/collect-licenses.ts copies the latter into the frontend image at /app/licenses/NOTICE. Each file that came from it says so in its own header, with what was changed and why. The distribution method is why this is here rather than in the npm inventory: the project's own instructions are `shadcn add`, which copies a file into the tree rather than adding a dependency a lockfile would record. |
| backend/app/core/catalog/mcp_registry.json | a snapshot refreshed by `agenticos cmd mcp-registry-sync` | data, backend image | Server names, descriptions and URLs published to the Official MCP Registry by their publishers; the registry software is MIT. | https://registry.modelcontextprotocol.io | accepted | Attribution to the registry; the snapshot is redistributed as catalogue metadata and each entry links to its publisher. | app/services/mcp_registry.py names the source; the console shows each server's publisher description verbatim with its URL. |
| Chart.js, vendored into backend/app/core/catalog/artifact_lib/ | 4.5.1 (dist/chart.umd.min.js from the npm tarball) | source, backend image, served to published artifacts | MIT | https://github.com/chartjs/Chart.js | accepted | Keep the copyright notice and the permission notice with the copies or substantial portions of the software. | The file is copied byte for byte and keeps its own header naming Chart.js and the MIT licence; backend/app/core/catalog/artifact_lib/README.md carries the full MIT text with the copyright line, and NOTICE names it. Copied rather than installed because a published page has no network: the deployment serves the file to its pages itself (#1971). |
| d3, vendored into backend/app/core/catalog/artifact_lib/ | 7.9.0 (dist/d3.min.js from the npm tarball) | source, backend image, served to published artifacts | ISC | https://github.com/d3/d3 | accepted | Keep the copyright notice and the permission notice with the copies. | The file is copied byte for byte and keeps its own header naming d3 and its copyright; backend/app/core/catalog/artifact_lib/README.md carries the full ISC text, and NOTICE names it. Copied for the same reason as Chart.js (#1971). |
| Lucide, vendored into backend/app/core/catalog/artifact_lib/ | 1.46.0 (dist/umd/lucide.min.js from the npm tarball) | source, backend image, served to published artifacts | ISC AND MIT | https://github.com/lucide-icons/lucide | accepted | Keep the copyright notices and the permission notices with the copies: ISC for Lucide, MIT for the icons it derives from Feather. | The file is copied byte for byte and keeps its own header naming Lucide and the ISC licence; backend/app/core/catalog/artifact_lib/README.md carries the ISC text and the Feather MIT text with both copyright lines, and NOTICE names it. The same version the console draws its icons from (lucide-react), so a page's icons match the product's. Copied for the same reason as Chart.js. |
| three.js, vendored into backend/app/core/catalog/artifact_lib/ | 0.186.0 (build/three.module.js, build/three.core.js and examples/jsm/controls/OrbitControls.js from the npm tarball) | source, backend image, served to published artifacts and visuals | MIT | https://github.com/mrdoob/three.js | accepted | Keep the copyright notice and the permission notice with the copies or substantial portions of the software. | The files are copied byte for byte and keep their own headers naming three.js and the MIT licence; backend/app/core/catalog/artifact_lib/README.md carries the full MIT text with the copyright line, and NOTICE names it. The same version the console depends on. Copied for the same reason as Chart.js (#2171). |
| Mermaid, vendored into backend/app/core/catalog/artifact_lib/ | 12.1.0 (dist/mermaid.min.js from the npm tarball) | source, backend image, served to published artifacts and visuals | MIT; the bundle includes its dependencies, among them DOMPurify (MPL-2.0 OR Apache-2.0, used under Apache-2.0), elkjs (EPL-2.0), d3 and d3-sankey (ISC, BSD-3-Clause), chevrotain (Apache-2.0) and MIT-licensed others (cytoscape, dagre-d3-es, dayjs, katex, khroma, marked, roughjs, stylis, uuid) | https://github.com/mermaid-js/mermaid | accepted | MIT and ISC: keep the notices. Apache-2.0: keep the licence and its notices. EPL-2.0 (elkjs, distributed unmodified in object form): ship the licence and say where its source is available. | The bundle is copied byte for byte and keeps the headers it carries (DOMPurify's among them); backend/app/core/catalog/artifact_lib/README.md carries Mermaid's MIT text, names every bundled dependency with its licence, links the EPL-2.0 text and the elkjs 0.9.3 source, and NOTICE names it. Copied for the same reason as Chart.js (#2171). |
| idiomorph, vendored into backend/app/core/catalog/artifact_lib/ | 0.8.0 (dist/idiomorph.min.js from the npm tarball) | source, backend image, served to the visual frame | 0BSD | https://github.com/bigskysoftware/idiomorph | accepted | None: the Zero-Clause BSD licence asks for no notice. | Copied byte for byte; backend/app/core/catalog/artifact_lib/README.md names it with its licence text anyway. It morphs a visual's markup in place while the drawing streams (#2171). |
| Leaflet, vendored into backend/app/core/catalog/artifact_lib/ | 1.9.4 (dist/leaflet.js and dist/leaflet.css from the npm tarball) | source, backend image, served to published artifacts and visuals | BSD-2-Clause | https://github.com/Leaflet/Leaflet | accepted | Keep the copyright notice, the conditions and the disclaimer with the copies, in source and in the documentation of a binary distribution. | Copied byte for byte; backend/app/core/catalog/artifact_lib/README.md carries the BSD-2-Clause text with both copyright lines, and NOTICE names it. The map kit draws an itinerary on the deployment's tile server with it (#2302). Copied for the same reason as Chart.js. |
| topojson-client, vendored into backend/app/core/catalog/artifact_lib/ | 3.1.0 (dist/topojson-client.min.js from the npm tarball) | source, backend image, served to published artifacts and visuals | ISC | https://github.com/topojson/topojson-client | accepted | Keep the copyright notice and the permission notice with all copies. | Copied byte for byte; backend/app/core/catalog/artifact_lib/README.md carries the ISC text with its copyright line, and NOTICE names it. The world map kit reads the country outlines with it. Copied for the same reason as Chart.js. |
| world-atlas, vendored into backend/app/core/catalog/artifact_lib/ as world-atlas-2.0.2-110m.js | 2.0.2 (countries-110m.json from the npm tarball, behind one assignment) | data, backend image, served to published artifacts and visuals | ISC (the outlines are Natural Earth, public domain) | https://github.com/topojson/world-atlas | accepted | Keep the copyright notice and the permission notice with all copies. Natural Earth asks for no credit. | The JSON is unchanged inside `window.AO_WORLD_110M=...;`; backend/app/core/catalog/artifact_lib/README.md carries the ISC text with its copyright line and says where the outlines come from, and NOTICE names it. The world map kit draws countries from it with no tile server. |
| Open Intelligent UI, adapted into agenticos-map-1.js and the visual-design skill | 8391a94c1c3939c679e40ddd7bfc08a9ef690e70 | source, backend image, served to published artifacts and visuals | MIT | https://github.com/CopilotKit/OpenIntelligentUI | accepted | Keep the copyright notice and the permission notice with the copies or substantial portions of the software. | The pin-drop timing of createTripAnimator is adapted in backend/app/core/catalog/artifact_lib/agenticos-map-1.js and agenticos-map-2.js, whose headers carry the MIT notice with the copyright line; the visual-design skill's guidance on choosing the form of an answer, follow-ups and itineraries borrows from its playbook and skills. backend/app/core/catalog/artifact_lib/README.md and NOTICE name it (#2302). |
| pgvector/pgvector | pg16 | service image, deployment | PostgreSQL: PostgreSQL License. pgvector: PostgreSQL License. | https://github.com/pgvector/pgvector | accepted | Permissive; keep the copyright notice with copies. Not redistributed by this project. | Pulled by the operator from Docker Hub; named here with its source. |
| valkey/valkey | 8-alpine | service image, deployment | BSD-3-Clause | https://github.com/valkey-io/valkey | accepted | Keep the copyright notice with copies. Not redistributed by this project. | Pulled by the operator from Docker Hub; named here with its source. Replaced redis:7-alpine in #1603: Redis is RSALv2 or SSPL-1.0 from 7.4.0, neither OSI-approved, and the default compose path should not start a non-open component without saying so. Valkey is the Linux Foundation fork of Redis 7.2 under BSD-3-Clause. |
| traefik | v3.7 | service image, deployment (optional reverse proxy) | MIT | https://github.com/traefik/traefik | accepted | Keep the copyright notice. Not redistributed by this project. | Pulled by the operator; named here with its source. |
| pgsty/minio (Docker image) | RELEASE.2026-08-04T00-00-00Z | service image, deployment (optional object store) | AGPL-3.0-or-later | https://github.com/pgsty/minio | accepted | Network copyleft: a modified MinIO offered over a network owes its users the modified source (s.13). | Pulled by the operator from Docker Hub and run unmodified beside the deployment, behind the `objectstore` compose profile; nothing here is built from or linked against it. It is a separate service this project speaks S3 to, not a component of either published image, and a deployment on AWS S3 or another compatible store runs none of it. Named here because the compose file offers it (#1423). |
| ghcr.io/vstorm-co/sandboxd | 0.2.39 | service image, deployment (optional agent sandbox) | MIT (pydantic-ai-backend, Vstorm) | https://github.com/vstorm-co/pydantic-ai-backend | accepted | Keep the copyright notice. | Published by Vstorm under MIT; the image is built from that repository. |
| Sandbox runtime `workbench` (built by sandboxd from backend/app/core/catalog/sandbox_runtimes.json) | python:3.12-slim plus the listed apt, npm and PyPI packages, resolved at build time | runtime image built at the deployment | Mixed: Node.js (MIT), LibreOffice (MPL-2.0), poppler-utils (GPL-2.0 or GPL-3.0), uv (Apache-2.0 OR MIT), and PyPI packages under their own licences. Not pinned, so not enumerated here. | backend/app/core/catalog/sandbox_runtimes.json | deployment-review | Built and run inside the deployment, never redistributed by this project; GPL tools are used as separate processes. A deployment that redistributes the built image owes the GPL and LGPL source offers for it. | deployment-time review |