Skip to main content
Glide OSS is MIT-licensed. Contributions land under MIT. Third-party dependencies (npm packages, vendor SDKs) are evaluated against the matrix below.

​
Matrix

​
CI behavior

The license-compat-scan CI gate (lands as a follow-up workflow file in M5.5+) walks every new dependency added in a PR and emits one of three signals: The GitHub Actions implementation will use a small TypeScript walker over pnpm-lock.yaml + each transitive dependency’s package.json license field, normalized via the SPDX identifier list.

​
What about Privy / Bridge / Noah / Chainalysis SDKs?

Vendor SDKs are typically MIT or Apache-2.0 (the standard for client libraries). The vendor’s terms of service are a separate matter — see each connector’s DISCLAIMER.md for ToS-redistribution language. License compatibility (this doc) and ToS compatibility (per-connector DISCLAIMER) are orthogonal.

​
What if the license is missing?

Treat unlicensed packages as proprietary. The CI gate fails on missing license fields. If you need an unlicensed dep, file an issue with the dependency’s maintainer to clarify; don’t ship it through Glide CI.

​
Operator notes

If you (the self-hoster) add an AGPL-licensed connector or skill to your deployment:
  • Your deployment falls under the AGPL “interaction over a network” trigger. You owe source disclosure to anyone interacting with the running service.
  • This includes the AGPL component’s source AND the source of “the larger Program,” which is interpreted broadly under AGPL. Talk to a lawyer before going live.
  • Glide does not redistribute AGPL packages by default. The CI warn gate is your reminder.

​
Where this lives

  • This file: human-readable matrix.
  • .github/workflows/license-compat-scan.yml: the CI implementation (lands in a follow-up).
  • CONTRIBUTING.md: pre-PR checklist that points contributors here.