NOTICE
Rama main · réplica de lectura del repositorio original.
HarnessRouter
Copyright (c) 2026 HarnessRouter
This product is licensed under the Apache License, Version 2.0 (see LICENSE).
Apache-2.0 requires that this NOTICE file be included in redistributions; the third-party
entries below are here for the same reason, and state the licenses of OTHER projects — they
are unaffected by ours.
THIRD-PARTY DEPENDENCIES
------------------------
The published container image bundles the following third-party software, under the licenses
named beside each, and their notices are preserved here as those licenses require. Everything
listed is under a permissive license unless its entry says otherwise. Code under any other
license is used only as the whole, unchanged package named here; none is copied into this project.
`scripts/check-licenses.py` holds this in the project's tests and on every release's image. The
full text of each console package's license is in the image at /app/THIRD-PARTY-console.txt, and
each Python package's beside it in site-packages.
Python
FastAPI MIT
Uvicorn BSD-3-Clause
httpx BSD-3-Clause
Pydantic MIT
python-multipart Apache-2.0
aiohttp Apache-2.0
redis-py MIT
PyJWT MIT
PyYAML MIT
Pillow MIT-CMU
pypdfium2 BSD-3-Clause, Apache-2.0, with PDFium's permissive dependencies
certifi MPL-2.0: Mozilla's root certificates, unchanged (github.com/certifi/python-certifi)
Pyphen Offered under GPL-2.0+, LGPL-2.1+ or MPL-1.1; used under MPL-1.1, unchanged, for
WeasyPrint (github.com/Kozea/Pyphen)
JavaScript
Next.js MIT
React / ReactDOM MIT
ReifyUI MIT
highlight.js BSD-3-Clause
Mermaid MIT
Apache ECharts Apache-2.0
Tiptap, ProseMirror MIT
Yjs, y-prosemirror, y-protocols, lib0
MIT
Cytoscape.js, cytoscape-edgehandles
MIT
d3-force ISC
Lucide ISC
marked, Turndown, node-diff3, zeed-dom
MIT
domino BSD-2-Clause
Operating system
The image is built on Debian. Its system packages, some under copyleft licenses such as the
GPL and LGPL, are unchanged and carry their own terms in /usr/share/doc.
MEMORY VENDORS — NOT REDISTRIBUTED
----------------------------------
deploy/memories runs these as separate services, from their own published images or source, when
you choose to. None of their code is in this repository or in the image. HarnessRouter reaches
them over the network.
Mem0 Apache-2.0
Graphiti (graphiti-core) Apache-2.0
Hindsight MIT
ReMe Apache-2.0
pgvector, PostgreSQL PostgreSQL License
LadybugDB (ladybug) MIT, "Copyright (c) 2022-2025 Kùzu Inc., Copyright (c) 2025-2026 Ladybug
Memory Inc." Graphiti's store in that compose file. Its full text
extension (MIT) is fetched when that image is built.
AGENT RUNTIMES — NOT REDISTRIBUTED
----------------------------------
The agent CLIs are deliberately NOT included in this image. They are installed on first
run, by you, under their own licenses:
@anthropic-ai/claude-code Anthropic's own terms ("SEE LICENSE IN README.md")
@openai/codex Apache-2.0
hermes-agent MIT (License-Expression declared by the publisher since 0.19.0)
cheetahclaws Apache-2.0 — "CheetahClaws, Copyright 2026 SAIL Lab at UC Berkeley"
(SAIL-Research-Lab/cheetahclaws; its NOTICE ships in the wheel). The
console's CheetahClaws mark, ui/public/logos/cheetahclaws.png, is the
head of that project's logo (docs/media/logos/logo-5.png in its
repository), cropped to a square, under the same license.
Kilo CLI (kilo) MIT, "Copyright (c) 2026 Kilo Code, Copyright (c) 2025 opencode"
(Kilo-Org/kilocode; the release archive from its GitHub releases)
MiniMax Code (minimax) MIT, "Copyright (c) 2026 MiniMax Code" (MiniMax-AI/minimax-code; the
release tarball from its GitHub releases)
Grok Build (grok) Apache-2.0 source, "Copyright 2023-2026 SpaceXAI" (xai-org/grok-build).
The binary is the one SpaceXAI's own installer (x.ai/cli) downloads from
its release bucket; SpaceXAI publishes no separate terms or checksums
for it.
Agent Zero (agentzero) MIT, "Copyright (c) 2025 Agent Zero, s.r.o" (agent0ai/agent-zero; the
tagged source archive, with its Python dependencies from PyPI under
their own licenses)
Docker Agent (docker-agent) Apache-2.0 (docker/docker-agent; the static binary from its GitHub
releases, v1.152.0, pinned by version and by a digest computed here —
upstream publishes no checksums beside the assets). No mark of its own is
redistributed: the console falls back to its generic glyph.
Mistral Vibe (vibe) Apache-2.0 (mistralai/mistral-vibe; 3.0.2 from PyPI, with its whole
dependency tree pinned by version and hash in docker/locks). The
console's Vibe mark,
ui/public/logos/vibe.svg, is that project's own editor glyph
(distribution/zed/icons/mistral_vibe.svg), unchanged, under the same
license.
fast-agent (fast-agent) Apache-2.0 (evalstate/fast-agent, PyPI fast-agent-mcp; 0.10.47 from
PyPI, with its whole dependency tree pinned by version and hash in
docker/locks, and its own NOTICE file as that license requires). No mark of its own is redistributed: its
repository ships none, so the console falls back to its generic
glyph.
Deep Agents Code (dcode) MIT (langchain-ai/deepagents, PyPI deepagents-code; 0.2.1 from PyPI,
together with deepagents-acp (MIT) and agent-client-protocol, which
its ACP server mode needs, and the deepagents SDK underneath them,
the whole tree pinned by version and hash in docker/locks). No mark
of its own is redistributed: the console falls back to its generic
glyph.
CPython 3.14 (for dcode) PSF-2.0 (python.org; its LICENSE.txt ships in the installed tree),
as python-build-standalone builds it (MPL-2.0 build scripts,
astral-sh/python-build-standalone), release 20261021, CPython
3.14.9, pinned by the sha256 that release publishes. Installed
beside dcode's venv only, because deepagents-code 0.2 requires
Python 3.14; the rest of the image keeps its own interpreter.
Roder (roder) MIT (RoderAI/roder; the 0.4.8 release archive from its GitHub
releases, tag roder/v0.4.8, pinned by version and by the digests
committed in docker/entrypoint.sh). Opt-in: installed only when
HR_BACKENDS names it. No mark of its own is redistributed: the
console falls back to its generic glyph.
Claude Code is distributed under Anthropic's terms and may not be redistributed inside a
public image; hermes-agent's publisher declared no license before 0.19.0. Installing the
agent CLIs at first start keeps that decision — and each tool's terms — with the operator.
Review each tool's license before enabling its backend. Set HR_BACKENDS to control which
are installed.