AGPL-3.0-only · Network copyleft
The one that catches SaaS companies. Section 13 extends copyleft across the network: if users interact with a modified version remotely, they must be offered the corresponding source of the whole work. The GPL "hosted service is not distribution" reasoning does not apply here.
The same license produces different obligations depending on whether the software is distributed, hosted, or kept internal. This is the distinction most dependency scanners collapse.
| How you ship it | Result | Why |
|---|---|---|
| Hosted SaaS | Obligation triggered | AGPL-3.0-only section 13 requires that users interacting with a modified version over a network be offered the corresponding source of the whole work. Your distribution model is hosted SaaS, which triggers that obligation. This is the clause that makes AGPL behave differently from GPL for hosted services. |
| Distributed binary / app | Obligation triggered | AGPL-3.0-only carries the GPL-3.0 copyleft terms it is built on: distributing a work that incorporates it requires licensing the whole work under the same terms with corresponding source made available. Your distribution model is distributed binary or application, which is distribution and triggers that obligation. Section 13 additionally extends this over a network, so hosting the same code would not avoid it. |
| Delivered to customer | Obligation triggered | AGPL-3.0-only carries the GPL-3.0 copyleft terms it is built on: distributing a work that incorporates it requires licensing the whole work under the same terms with corresponding source made available. Your distribution model is software delivered to a customer environment, which is distribution and triggers that obligation. Section 13 additionally extends this over a network, so hosting the same code would not avoid it. |
| Internal use only | No obligation | AGPL-3.0-only section 13 applies when users interact with the software remotely over a network, and its inherited GPL terms apply on distribution. Your distribution model is internal use only, so neither obligation arises. |
| Published library | Obligation triggered | AGPL-3.0-only carries the GPL-3.0 copyleft terms it is built on: distributing a work that incorporates it requires licensing the whole work under the same terms with corresponding source made available. Your distribution model is a published library, which is distribution and triggers that obligation. Section 13 additionally extends this over a network, so hosting the same code would not avoid it. |
Source disclosureSame license
As a build-time dependency it is a different question.
AGPL-3.0-only appears as a dev dependency, so it is not part of the artifact you ship. Distribution-triggered obligations do not arise. Tools that emit code into your output, such as code generators, are a separate case worth checking individually.
Want to know whether anything in your project is under AGPL-3.0-only?
Check your whole manifest →LicenseGuard reports information derived from published license texts and dependency manifests. It is not legal advice and using it does not create an attorney-client relationship. Results reflect license metadata as declared; they do not identify every obligation or violation. Consult qualified counsel for decisions that matter.