13. License matrix
| Component | Role | License | OSI | Copyleft | Caveats | Pin |
|---|---|---|---|---|---|---|
| loco-rs | Application framework | Apache-2.0 | Yes | No | LICENSE and crates.io agree (checked 10 Nov 2026) | =1.3.1 |
| sea-orm, sea-orm-migration | ORM and migrations | MIT OR Apache-2.0 | Yes | No | Pulled by Loco | 2.0.x |
| Axum, Tokio, tower-http | HTTP and runtime | MIT | Yes | No | Pulled by Loco | 0.8.x / 1.x |
| serde_yaml_ng | YAML parser | MIT | Yes | No | Same parser Loco uses | 0.10.x |
| tera | Config templating | MIT (verify) | Yes | No | Pulled by Loco | 2.1.x |
| jsonschema | Validate model output | MIT (verify) | Yes | No | pin after check | |
| graph-flow | Workflow engine | MIT | Yes | No | Small project. Default features off | =0.8.1 |
| rig-core, rig-agent, rig-reqwest | LLM client | MIT | Yes | No | Pre-1.0, breaking minors | =0.46.0 |
| reqwest | HTTP client | MIT OR Apache-2.0 | Yes | No | 0.13.x | |
| opentelemetry crates | Tracing | Apache-2.0 | Yes | No | 0.31.x (verify) | |
| PostgreSQL, pgvector extension | Database, vectors, queue | PostgreSQL License | Yes | No | 17 / 0.8.x | |
CopilotKit (@copilotkit/*) | Frontend and runtime | MIT | Yes | No | Do not use Intelligence (commercial) | 1.83.0 |
@ag-ui/client | AG-UI client | MIT | Yes | No | 1.0.2 | |
agui crate (ours) | AG-UI server types | Apache-2.0 | Yes | No | ag-ui-core 0.1.0 not used: pre-1.0 | n/a |
| Next.js, React | Web | MIT | Yes | No | 16.4.3 / 19.x | |
| vLLM | Inference | Apache-2.0 | Yes | No | Qwen3.8 support may need a recent build | digest |
| Qwen3.8-27B | Chat and tools | Apache-2.0 | Yes | No | Not Qwen3.8-Max (custom license) | HF revision |
| Qwen3-Embedding-0.6B | Embeddings | Apache-2.0 | Yes | No | 1024 dimensions | HF revision |
| Docling, docling-serve | Document parsing | MIT | Yes | No | Models licensed separately | digest |
| Docling heron layout model | Layout | Apache-2.0 | Yes | No | revision | |
| TableFormer | Tables | CDLA-Permissive-2.0 + Apache-2.0 | CDLA is not an OSI software license | No | Record an exception, or wait for TableFormerV2 (Apache-2.0, preview) | revision |
| OpenTelemetry Collector | Telemetry pipeline | Apache-2.0 | Yes | No | digest | |
| Jaeger v2 | Trace store and UI | Apache-2.0 (verify) | Yes | No | digest | |
| Valkey (optional) | Redis-compatible store | BSD-3-Clause | Yes | No | Only for optional services | 8.x |
| SeaweedFS (optional) | S3 storage | Apache-2.0 core | Yes | No | Enterprise tier is proprietary | digest |
| Opik (optional) | Evaluation UI | Apache-2.0 | Yes | No | Pulls MySQL (GPL-2.0 + FOSS exception) and ClickHouse (Apache-2.0) | tag |
| Activepieces CE (optional) | Integrations | MIT, enterprise folders commercial | Core yes | No | Build with enterprise folders removed | tag |
| Langfuse OSS (optional) | LLM tracing | MIT, ee/ commercial | Core yes | No | No enterprise key | tag |
| Keycloak (optional) | Identity provider | Apache-2.0 | Yes | No | tag |
Loco's default features pull extra crates (mailer, SQLite, generators). The feature list in §7.1 is the minimum for this system. cargo deny is the authority for every transitive dependency.