HarnessRouter Copyright (c) 2026 HarnessRouter This product is licensed under the Apache License, Version 2.0 (see LICENSE). Apache-2.0 requires that this NOTICE file be included in redistributions; the third-party entries below are here for the same reason, and state the licenses of OTHER projects — they are unaffected by ours. THIRD-PARTY DEPENDENCIES ------------------------ The published container image bundles the following third-party software, under the licenses named beside each, and their notices are preserved here as those licenses require. Everything listed is under a permissive license unless its entry says otherwise. Code under any other license is used only as the whole, unchanged package named here; none is copied into this project. `scripts/check-licenses.py` holds this in the project's tests and on every release's image. The full text of each console package's license is in the image at /app/THIRD-PARTY-console.txt, and each Python package's beside it in site-packages. Python FastAPI MIT Uvicorn BSD-3-Clause httpx BSD-3-Clause Pydantic MIT python-multipart Apache-2.0 aiohttp Apache-2.0 redis-py MIT PyJWT MIT PyYAML MIT Pillow MIT-CMU pypdfium2 BSD-3-Clause, Apache-2.0, with PDFium's permissive dependencies certifi MPL-2.0: Mozilla's root certificates, unchanged (github.com/certifi/python-certifi) Pyphen Offered under GPL-2.0+, LGPL-2.1+ or MPL-1.1; used under MPL-1.1, unchanged, for WeasyPrint (github.com/Kozea/Pyphen) JavaScript Next.js MIT React / ReactDOM MIT ReifyUI MIT highlight.js BSD-3-Clause Mermaid MIT Apache ECharts Apache-2.0 Tiptap, ProseMirror MIT Yjs, y-prosemirror, y-protocols, lib0 MIT Cytoscape.js, cytoscape-edgehandles MIT d3-force ISC Lucide ISC marked, Turndown, node-diff3, zeed-dom MIT domino BSD-2-Clause Operating system The image is built on Debian. Its system packages, some under copyleft licenses such as the GPL and LGPL, are unchanged and carry their own terms in /usr/share/doc. MEMORY VENDORS — NOT REDISTRIBUTED ---------------------------------- deploy/memories runs these as separate services, from their own published images or source, when you choose to. None of their code is in this repository or in the image. HarnessRouter reaches them over the network. Mem0 Apache-2.0 Graphiti (graphiti-core) Apache-2.0 Hindsight MIT ReMe Apache-2.0 pgvector, PostgreSQL PostgreSQL License LadybugDB (ladybug) MIT, "Copyright (c) 2022-2025 Kùzu Inc., Copyright (c) 2025-2026 Ladybug Memory Inc." Graphiti's store in that compose file. Its full text extension (MIT) is fetched when that image is built. AGENT RUNTIMES — NOT REDISTRIBUTED ---------------------------------- The agent CLIs are deliberately NOT included in this image. They are installed on first run, by you, under their own licenses: @anthropic-ai/claude-code Anthropic's own terms ("SEE LICENSE IN README.md") @openai/codex Apache-2.0 hermes-agent MIT (License-Expression declared by the publisher since 0.19.0) cheetahclaws Apache-2.0 — "CheetahClaws, Copyright 2026 SAIL Lab at UC Berkeley" (SAIL-Research-Lab/cheetahclaws; its NOTICE ships in the wheel). The console's CheetahClaws mark, ui/public/logos/cheetahclaws.png, is the head of that project's logo (docs/media/logos/logo-5.png in its repository), cropped to a square, under the same license. Kilo CLI (kilo) MIT, "Copyright (c) 2026 Kilo Code, Copyright (c) 2025 opencode" (Kilo-Org/kilocode; the release archive from its GitHub releases) MiniMax Code (minimax) MIT, "Copyright (c) 2026 MiniMax Code" (MiniMax-AI/minimax-code; the release tarball from its GitHub releases) Grok Build (grok) Apache-2.0 source, "Copyright 2023-2026 SpaceXAI" (xai-org/grok-build). The binary is the one SpaceXAI's own installer (x.ai/cli) downloads from its release bucket; SpaceXAI publishes no separate terms or checksums for it. Agent Zero (agentzero) MIT, "Copyright (c) 2025 Agent Zero, s.r.o" (agent0ai/agent-zero; the tagged source archive, with its Python dependencies from PyPI under their own licenses) Docker Agent (docker-agent) Apache-2.0 (docker/docker-agent; the static binary from its GitHub releases, v1.152.0, pinned by version and by a digest computed here — upstream publishes no checksums beside the assets). No mark of its own is redistributed: the console falls back to its generic glyph. Mistral Vibe (vibe) Apache-2.0 (mistralai/mistral-vibe; 3.0.2 from PyPI, with its whole dependency tree pinned by version and hash in docker/locks). The console's Vibe mark, ui/public/logos/vibe.svg, is that project's own editor glyph (distribution/zed/icons/mistral_vibe.svg), unchanged, under the same license. fast-agent (fast-agent) Apache-2.0 (evalstate/fast-agent, PyPI fast-agent-mcp; 0.10.47 from PyPI, with its whole dependency tree pinned by version and hash in docker/locks, and its own NOTICE file as that license requires). No mark of its own is redistributed: its repository ships none, so the console falls back to its generic glyph. Deep Agents Code (dcode) MIT (langchain-ai/deepagents, PyPI deepagents-code; 0.2.1 from PyPI, together with deepagents-acp (MIT) and agent-client-protocol, which its ACP server mode needs, and the deepagents SDK underneath them, the whole tree pinned by version and hash in docker/locks). No mark of its own is redistributed: the console falls back to its generic glyph. CPython 3.14 (for dcode) PSF-2.0 (python.org; its LICENSE.txt ships in the installed tree), as python-build-standalone builds it (MPL-2.0 build scripts, astral-sh/python-build-standalone), release 20261021, CPython 3.14.9, pinned by the sha256 that release publishes. Installed beside dcode's venv only, because deepagents-code 0.2 requires Python 3.14; the rest of the image keeps its own interpreter. Roder (roder) MIT (RoderAI/roder; the 0.4.8 release archive from its GitHub releases, tag roder/v0.4.8, pinned by version and by the digests committed in docker/entrypoint.sh). Opt-in: installed only when HR_BACKENDS names it. No mark of its own is redistributed: the console falls back to its generic glyph. Claude Code is distributed under Anthropic's terms and may not be redistributed inside a public image; hermes-agent's publisher declared no license before 0.19.0. Installing the agent CLIs at first start keeps that decision — and each tool's terms — with the operator. Review each tool's license before enabling its backend. Set HR_BACKENDS to control which are installed.