Licensing

Two statements cover it.

Everything you build against is Apache-2.0 or MIT. What you write is yours, with no license obligation back to us.

The control plane and the dashboard are Elastic License 2.0. You may read, run, modify, and self-host them. You may not offer them to third parties as a managed service, and you may not remove the license-key check.

The map

Repository	License	What it is
sdk	Apache-2.0	Go SDK — agent, tool, and plugin contracts, the harness API
adk	Apache-2.0	The gibson CLI — scaffold, build, validate, enrol, submit missions
setec	Apache-2.0	Kubernetes operator for Firecracker microVMs via Kata. Useful standalone
gibson-executor	Apache-2.0	One microVM image, one binary, parsers for common security and ops tools
sdk-ts	MIT	TypeScript SDK
zerocool-plugins	MIT	opencode plugins for running a coding agent under Gibson's controls
docs-site	Apache-2.0	This documentation
gibson	Elastic License 2.0	The control plane
dashboard	Elastic License 2.0	The web interface

Why this page states the two restrictions

A procurement reviewer stops on Elastic License 2.0. So it is better to say what it forbids than to leave someone to find out:

1. You may not provide the software to third parties as a managed service.
2. You may not circumvent the license-key functionality, or remove or obscure protected notices.

Neither restricts internal use. You may run the control plane for your own organization, on your own infrastructure, modified as you like.

Components you write

A component you build with the SDK is your code. It links against Apache-2.0 libraries, and the license carries no obligation to publish it or to license it back to us. You may keep it private, sell it, or open it under whatever terms you choose.

What to check

1. The LICENSE file in each repository matches the table above.
2. Nothing you build against is Business Source License or source-available with a delayed conversion.
3. The Elastic restrictions apply to the control plane and dashboard only.