Explainers
Licenses and signals in plain language
Discovery only, not legal advice. These pages are general information about common license types and about the signals shown in the catalog. They are not legal advice and not a recommendation for your situation. Read the actual license text of every project you use, and ask a qualified lawyer about anything that matters to your business.
License types and commercial use
A license is the set of rules the authors give you for using their code. For a commercial product the main questions are: may I use it, what must I give back or keep, and does it reach into my own code? These are the groups the catalog uses.
- Permissive license
- You can: Use, change and sell the code, usually including in closed-source products. You must: Usually keep the copyright and license notice.
- MIT
- Apache-2.0
- BSD-2-Clause
- BSD-3-Clause
- ISC
- Public-domain style license
- You can: Do almost anything with the code. You must: Usually nothing.
- Unlicense
- CC0-1.0
- Weak copyleft license
- You can: Use it in commercial products, often next to closed-source code. You must: Share changes you make to the licensed files.
- MPL-2.0
- LGPL-3.0
- Strong copyleft license
- You can: Use it, and run it inside your own services. You must: If you distribute it inside a product, the whole product may need the same license. Watch for: Often a poor fit for closed-source products you ship.
- GPL-3.0
- Network copyleft license
- You can: Use it. You must: Offer the source of a modified version to people who use it over a network. Watch for: This affects hosted services.
- AGPL-3.0
- Source-available license (not open source)
- You can: Read and often use the code under stated limits. You must: Follow the limits in the license. Watch for: It may bar competing or hosted commercial use. Read it.
- BUSL-1.1
- SSPL-1.0
- Custom license that restricts how the software may be used
- You can: Use it only as the license allows. You must: Follow its use restrictions. Watch for: Not a standard open-source license: read the actual terms.
- Custom terms
- Unknown or no license
- If a project has no license, or the catalog cannot tell which one it is, the catalog says “unknown” and treats it as unknown, never as permissive. Without a license you generally have no permission to use the code. Find the license file in the project first.
Copyleft is not “bad” and permissive is not “risk free”. The right choice depends on how you ship your product, so the guide only points out what to check.
Not legal advice.
What the maintenance signals mean
Maintenance tells you whether the project still gets fixes and releases. The catalog reads it from the date of the latest push or commit, so it is a hint about activity, not a promise about quality or security.
- Active
- The latest push or commit was within 6 months.
- Slowing
- The latest activity was 6 to 18 months ago. Check recent releases and open pull requests.
- Stale
- The latest activity was 18 to 36 months ago. Plan for maintaining it yourself.
- Inactive
- No activity for over 36 months, or the owner archived the project. Treat it as abandoned.
- Not enough data
- The catalog has no push or commit date for this project, so it says so instead of guessing.
- Maturity and adoption
- Maturity looks at age, adoption and foundation membership. Adoption looks at stars, likes and downloads. Wide use usually means more help and examples, but popularity is not quality.
- Established
- Growing
- Early-stage
- Security: not assessed
- The catalog shows a security result only where an OpenSSF Scorecard exists, and a Scorecard is a partial automated check. “Not assessed” means nobody checked here, which is different from “fine”.
A small, finished library can be quiet and still work well. Use the signals to decide where to look closer, not as a verdict.
Not legal advice.
How to read the evaluation guide
Open a result to see its evaluation guide. It restates the signals in plain words and is the same for everyone: it does not use AI and does not change with your question. Your skill level in Account changes only how much explanation you see.
- Health summary
- One headline and a few lines on maintenance, releases, adoption and security, each with its reason.
- For commercial use
- A short verdict on whether the license usually suits a commercial product, such as “Generally fine for commercial use”, “Usable with conditions: check before you rely on it”, “Likely a poor fit without a deal or legal review” or “Unknown: do not assume it is free to use”. It is a pointer for your own check, not an approval.
- What the license asks of you
- What you can do, what you must do in return and what to watch for, written for the specific license when the catalog knows it.
- Good for and watch out
- Short tags built from the same signals. A watch-out is a reason to look closer, not a reason to rule a project out.
- Alternatives
- Projects in the same category, tags and language. They are picked by similarity, not by quality, so compare them before you choose.
- “Not assessed”
- Wherever the guide says a signal is not assessed, it means there is no data for it. Look at the project itself before you rely on it.
The guide helps you decide what to check next. The decision, and the responsibility for it, stay with you.
Not legal advice.