Answers · code licenses

Can I use MIT, GPL or AGPL code in a closed-source SaaS?

Short answer: MIT: yes, keep its copyright and license notice. GPL: yes for code that only runs on your own servers, because the GPL's source-sharing duty is triggered by giving people copies, not by running the software for them; anything you hand to users (a mobile or desktop app, an on-premises build, JavaScript sent to the browser) is a copy. AGPL-3.0: if you modify AGPL code, or build your code into it, and users interact with it over a network, you must offer those users the source of that version, so it does not fit a closed-source SaaS unless you run it unmodified as a separate component or get a different license from the author.

Checklist

1. List every dependency and its license, including transitive ones (npm sbom, pip-licenses, cargo metadata or your build tool's equivalent).
2. Split what only runs on your servers from what you ship to users: mobile and desktop apps, on-premises or self-hosted builds, container images you give customers, and JavaScript served to browsers.
3. Permissive code (MIT, BSD, ISC, Apache-2.0): keep the copyright and license text in everything you ship; Apache-2.0 also asks you to keep its NOTICE file and mark files you changed.
4. GPL code in anything you ship conflicts with keeping that product closed. LGPL libraries can be used from closed code if users can swap in their own modified version of the library.
5. AGPL components: note whether you changed them or linked your code into them. If so, and users reach them over a network, you owe those users the source. Options: replace the component, run it unmodified as a separate service, or ask the author for a commercial license.
6. Treat source-available licenses (BUSL-1.1, Elastic-2.0, SSPL) separately: they are not open source and can restrict production use or offering the software as a hosted service.
7. Write down each decision and re-check when a dependency changes license in a new version.

Why hosting is different from shipping

• The GPL's obligations attach to conveying copies. Running GPL software on your own servers and letting people use it over the web does not convey a copy, so it does not by itself oblige you to publish source.
• The AGPL closes that gap on purpose: its section 13 requires that users interacting with a modified version over a network be offered its corresponding source.
• Front-end code is the usual trap. JavaScript, WebAssembly or CSS bundled and sent to browsers is distributed to every visitor, so GPL code in the front end is shipped, even in a SaaS.

License checks (computed)

Yes means the license grants the use, on the duties listed. Duties such as source_disclosure, share_alike and network_source_offer are the ones that conflict with keeping a product closed-source.

Ask Rightshold (free, no key)

Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “My SaaS backend uses a modified AGPL-3.0 library and the front end bundles an MIT package. What do I owe users?”

One-click setup

{
  "tool": "license_compatibility",
  "arguments": {
    "licenses": [
      "MIT",
      "GPL-3.0-only",
      "AGPL-3.0-only"
    ],
    "intended_use": {
      "commercial_use": true,
      "deployment": true
    }
  }
}

• check_license answers one license for one use, with the duties that come with it.
• Pass a GitHub, npm or PyPI page as source_url and Rightshold reads the license that page declares.

Sources

• GNU Affero General Public License v3.0
• GNU General Public License v3.0
• GNU: Why the Affero GPL
• The MIT License (OSI)
• Apache License 2.0

Related

• Can I use GPL code in proprietary software?
• GPL vs AGPL
• Can I use BUSL-1.1 software in production?
• Check all npm dependency licenses

Not legal advice. Updated 2026-10-28. JSON · Markdown · All answers

curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_...   # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
  -H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'