AGPL for a compliance tool: the license nobody expects

I picked AGPL-3.0 for the Community Edition.

Most dev-tooling projects pick MIT or Apache-2.0 for maximum adoption and don't mind someone building a hosted product on top. I chose differently for a reason specific to what this project is.

A compliance engine's most obvious commercial threat isn't someone forking the CLI. It's someone standing up a hosted dashboard on the rule engine and evidence model, modifying it just enough to dodge standard copyleft, and selling it as their own SaaS without contributing back. Regular GPL doesn't fully close that door if the modified version only ever runs as a server and never gets distributed as software.

AGPL's network clause does. Run a modified version as a network service and you owe the source.

That's the whole reason the license matters more here than it would for a CLI formatter. The project is open-core.

This repository, core engine, CLI, SDK, services, the EU AI Act checker, is AGPL-3.0. The Enterprise Edition (the hosted dashboard and commercial support) is under a separate commercial license. That split only stays honest if the AGPL side can't quietly become someone else's unpaid proprietary hosted product.

It's a real trade. AGPL scares off companies with strict OSS-license policies who would otherwise use the CLI internally with zero interest in hosting anything. I made the trade anyway. "Adopted by companies that won't touch AGPL" is a smaller loss than "the rule engine becomes some reseller's unpaid R&D."

If you're weighing the same decision for your own project, this one is a running example instead of a hypothetical. Read the actual LICENSE and how the open-core boundary is drawn: github.com/Opencomplai/opencomplai.