github.com/mattermost/mattermost-server safe for commercial use?Go module package · License: Apache-2.0 AND AGPL-3.0
github.com/mattermost/mattermost-server is licensed under Apache-2.0 AND AGPL-3.0. That triggers obligations in 4 of the 5 common shipping models, so whether it is safe for you depends on how you ship.
| How you ship it | Result | Why |
|---|---|---|
| Hosted SaaS | Obligation triggered | Multiple licenses apply at once. Apache-2.0 section 4 requires retaining copyright notices, a copy of the license, and any NOTICE file. Section 3 grants a patent license from contributors. There is no source-disclosure obligation. / AGPL-3.0 section 13 requires that users interacting with a modified version over a network be offered the corresponding source of the whole work. Your distribution model is hosted SaaS, which triggers that obligation. This is the clause that makes AGPL behave differently from GPL for hosted services. |
| Distributed binary / app | Obligation triggered | Multiple licenses apply at once. Apache-2.0 section 4 requires retaining copyright notices, a copy of the license, and any NOTICE file. Section 3 grants a patent license from contributors. There is no source-disclosure obligation. / AGPL-3.0 carries the GPL-3.0 copyleft terms it is built on: distributing a work that incorporates it requires licensing the whole work under the same terms with corresponding source made available. Your distribution model is distributed binary or application, which is distribution and triggers that obligation. Section 13 additionally extends this over a network, so hosting the same code would not avoid it. |
| Delivered to customer | Obligation triggered | Multiple licenses apply at once. Apache-2.0 section 4 requires retaining copyright notices, a copy of the license, and any NOTICE file. Section 3 grants a patent license from contributors. There is no source-disclosure obligation. / AGPL-3.0 carries the GPL-3.0 copyleft terms it is built on: distributing a work that incorporates it requires licensing the whole work under the same terms with corresponding source made available. Your distribution model is software delivered to a customer environment, which is distribution and triggers that obligation. Section 13 additionally extends this over a network, so hosting the same code would not avoid it. |
| Internal use only | No obligation | Multiple licenses apply at once. Apache-2.0 section 4 requires retaining copyright notices, a copy of the license, and any NOTICE file. Section 3 grants a patent license from contributors. There is no source-disclosure obligation. / AGPL-3.0 section 13 applies when users interact with the software remotely over a network, and its inherited GPL terms apply on distribution. Your distribution model is internal use only, so neither obligation arises. |
| Published library | Obligation triggered | Multiple licenses apply at once. Apache-2.0 section 4 requires retaining copyright notices, a copy of the license, and any NOTICE file. Section 3 grants a patent license from contributors. There is no source-disclosure obligation. / AGPL-3.0 carries the GPL-3.0 copyleft terms it is built on: distributing a work that incorporates it requires licensing the whole work under the same terms with corresponding source made available. Your distribution model is a published library, which is distribution and triggers that obligation. Section 13 additionally extends this over a network, so hosting the same code would not avoid it. |
AttributionNOTICE filePatent grantSource disclosureSame license
If you only use it at build time, the answer changes.
Multiple licenses apply at once. Apache-2.0 appears as a dev dependency, so it is not part of the artifact you ship. Distribution-triggered obligations do not arise. Tools that emit code into your output, such as code generators, are a separate case worth checking individually. / AGPL-3.0 appears as a dev dependency, so it is not part of the artifact you ship. Distribution-triggered obligations do not arise. Tools that emit code into your output, such as code generators, are a separate case worth checking individually.
github.com/mattermost/mattermost-server is licensed under Apache-2.0 AND AGPL-3.0. That triggers obligations in 4 of the 5 common shipping models, so whether it is safe for you depends on how you ship.
Multiple licenses apply at once. Apache-2.0 section 4 requires retaining copyright notices, a copy of the license, and any NOTICE file. Section 3 grants a patent license from contributors. There is no source-disclosure obligation. / AGPL-3.0 section 13 requires that users interacting with a modified version over a network be offered the corresponding source of the whole work. Your distribution model is hosted SaaS, which triggers that obligation. This is the clause that makes AGPL behave differently from GPL for hosted services.
Multiple licenses apply at once. Apache-2.0 section 4 requires retaining copyright notices, a copy of the license, and any NOTICE file. Section 3 grants a patent license from contributors. There is no source-disclosure obligation. / AGPL-3.0 carries the GPL-3.0 copyleft terms it is built on: distributing a work that incorporates it requires licensing the whole work under the same terms with corresponding source made available. Your distribution model is distributed binary or application, which is distribution and triggers that obligation. Section 13 additionally extends this over a network, so hosting the same code would not avoid it.
Multiple licenses apply at once. Apache-2.0 section 4 requires retaining copyright notices, a copy of the license, and any NOTICE file. Section 3 grants a patent license from contributors. There is no source-disclosure obligation. / AGPL-3.0 carries the GPL-3.0 copyleft terms it is built on: distributing a work that incorporates it requires licensing the whole work under the same terms with corresponding source made available. Your distribution model is software delivered to a customer environment, which is distribution and triggers that obligation. Section 13 additionally extends this over a network, so hosting the same code would not avoid it.
Multiple licenses apply at once. Apache-2.0 section 4 requires retaining copyright notices, a copy of the license, and any NOTICE file. Section 3 grants a patent license from contributors. There is no source-disclosure obligation. / AGPL-3.0 section 13 applies when users interact with the software remotely over a network, and its inherited GPL terms apply on distribution. Your distribution model is internal use only, so neither obligation arises.
Multiple licenses apply at once. Apache-2.0 section 4 requires retaining copyright notices, a copy of the license, and any NOTICE file. Section 3 grants a patent license from contributors. There is no source-disclosure obligation. / AGPL-3.0 carries the GPL-3.0 copyleft terms it is built on: distributing a work that incorporates it requires licensing the whole work under the same terms with corresponding source made available. Your distribution model is a published library, which is distribution and triggers that obligation. Section 13 additionally extends this over a network, so hosting the same code would not avoid it.
Multiple licenses apply at once. Apache-2.0 appears as a dev dependency, so it is not part of the artifact you ship. Distribution-triggered obligations do not arise. Tools that emit code into your output, such as code generators, are a separate case worth checking individually. / AGPL-3.0 appears as a dev dependency, so it is not part of the artifact you ship. Distribution-triggered obligations do not arise. Tools that emit code into your output, such as code generators, are a separate case worth checking individually.
This page covers one package. Your go.sum has many more.
Check your whole manifest →The license was read from the repository's own LICENSE file, falling back to deps.dev and then ClearlyDefined — Go has no central license metadata, so a project's LICENSE at its default branch is the most direct answer to what it is licensed under today, then evaluated against each shipping model. Dependencies in this ecosystem are linked statically, which is assumed here. Only the declared license is considered; code copied into a project's own source files is not detected by this method.
License data last reviewed .
LicenseGuard reports information derived from published license texts and dependency manifests. It is not legal advice and using it does not create an attorney-client relationship. Results reflect license metadata as declared; they do not identify every obligation or violation. Consult qualified counsel for decisions that matter.
Listed in the official MCP registry, on Glama and on Smithery. Source on GitHub (Apache-2.0).