Apache-2.0 (the core)

Licensed under the Apache License 2.0 and free to run in production forever:

• The MCPG gateway runtime (apps/gateway)
• The plugin SDK, protocol, and host crates (libs/plugin-*)
• Every free plugin — roughly 70 of the ~95 shipping today: all backends and connectors, core identity (API-key, Basic, JWT, OIDC, mTLS, PASETO), transforms, caching, reliability, observability, watchers, and the schema/business-hours/IP tool-gates
• All CLIs (mcpg, mcpg-plugin, mcpg-config, cloud CLIs)
• The control-plane core and client libraries (libs/control-plane)
• The gateway Helm chart, the conformance suite, all documentation and RFCs

Public commitment: nothing published under Apache-2.0 ever moves to a more restrictive license. One-way ratchet — if you depend on an Apache-2.0 component, it stays Apache-2.0 forever.

BUSL-1.1 (the enterprise ring)

Two component groups ship under the Business Source License 1.1. The source is public, all non-production use (development, testing, evaluation, security research) is free, and each release automatically becomes Apache-2.0 three years after it ships.

• Enterprise plugins — production use requires a plan whose signed license token entitles them: SAML and Kerberos SSO, DLP and field-level crypto, WORM audit, guardrails, the dynamic-credential brokers (Vault, AWS STS, GCP, Azure, OAuth token exchange), the policy engines (Cedar, OPA, Casbin), cluster HA coordination (Consul, etcd, Redis, NATS), the Vault secret store, and the agentic-payment plugins (UCP, ACP, MPP, x402). The license token you already install is also the legal production grant — one boundary, technical and legal.
• Fleet platform — the Kubernetes operator and the control plane (server, console, their Helm charts). Production use for your own organization is free at any scale, on every tier including Community; the license only forbids offering them to third parties as a competing managed service.

The rule that keeps this honest: the license follows the entitlement gate. A plugin is BUSL-1.1 exactly when paid plans gate it; free plugins are never source-restricted. (One exception in the open direction: the Slack human-in-the-loop approval gate carries a paid feature flag but stays Apache-2.0, as originally committed.)

What isn't published

The mcpg.cloud SaaS plumbing — billing and license issuing, fleet provisioning, edge ingress, and internal runbooks — is proprietary. None of it is needed to self-host MCPG.

Trademark

“mcpg”, “mcpg.cloud”, and the MCPG logos are trademarks of MCPG, Inc. You can use them to identify MCPG; you can't use them to imply endorsement. See TRADEMARK.md in the repo.

Questions: contact us or licensing@mcpg.dev.