Apache-2.0 (the floor)

Everything below is licensed under Apache License 2.0:

• The MCPG gateway runtime (apps/gateway)
• All 38 shipping plugins (libs/plugins/)
• The control plane server, CLI, and UI (apps/control-plane/) and core (libs/control-plane/)
• The plugin SDK and protocol crates (libs/plugin-*)
• The Helm chart and Kubernetes operator (helm/, k8s/)
• The conformance suite, policy packs, and analysis MCP servers
• All documentation and RFCs

Public commitment: nothing already Apache-2.0 ever moves to a more restrictive license. This is a one-way ratchet. If you're depending on an Apache-2.0 component today, it stays Apache-2.0 forever.

BSL-1.1 (with auto-conversion)

A small set of enterprise modules ship under Business Source License 1.1 with a 3-year automatic conversion clause: each release becomes Apache-2.0 exactly three years after its publication date. The current BSL-1.1 modules:

• SCIM user provisioning plugin
• SAML SSO adapter
• Approval-workflow engine (beyond the OSS Slack-approval gate)
• Compliance-pack generator (customer audit-evidence PDFs)
• Legacy-infra readiness report generator
• Tamper-evident audit chain with HSM signing

Why BSL-1.1: these are the modules competitors would copy and resell as a managed service. The 3-year auto-conversion means the community always gets full access on a predictable cadence; we just keep a head start during the active commercial window.

Proprietary (a small slice)

The following is closed-source:

• The Stripe billing integration
• Marketplace payout logic
• Fraud-signal tuning
• AWS account-specific Terraform
• The internal admin console
• The AI assistant prompt library used in our hosted onboarding

These don't affect your ability to run MCPG. They're internal tooling and the SaaS plumbing, kept proprietary because publishing them would be more confusing than useful.

Trademark

“MCPG” and the MCPG logo are trademarks of MCPG, Inc. You can use them to identify MCPG; you can't use them to imply endorsement. See TRADEMARK.md in the repo.

Questions: contact us. Legal review: hello@mcpg.dev with subject “Legal”.