License matrix
One component, one license, one place to verify it · 2026-09-25 · machine version
12 npm packages MIT OR Apache-2.0 Spec CC-BY-NC-ND 4.0 Layer-3 core AL-1.0MarketNow is open-core: the npm ecosystem and the verification scaffolding are permissively licensed so agents and developers can depend on them; the engine core is source-available (AL-1.0) with commercial options for hosted/resale use. Trust infrastructure cannot afford license ambiguity — documentation drift itself is a trust problem — so every layer declares its license here, with the registry or file that proves it.
The matrix
| Component | License | Scope | Where to verify |
|---|---|---|---|
| marketnow-mcp, agent-trust-card, marketnow-install-stack, @marketnow/uts, @marketnow/trust-core, @marketnow/trust-adapters (≥1.0.3), @marketnow/trust-gateway, @marketnow/cline-trust-plugin, @marketnow/uta-conformance, @marketnow/sentinel-rules, @marketnow/trust-mcp-middleware, @marketnow/trust-observability | MIT OR Apache-2.0 | All 12 npm packages as published on the registry (SPDX dual license expression). Free to use, modify and redistribute under either license at your option. | registry.npmjs.org → versions[].license, or: npm view <pkg> license |
| @marketnow/trust-adapters 1.0.0 – 1.0.2 | AL-1.0 (historical) | Versions 1.0.0–1.0.2 were published under AL-1.0 (AliceLabs Source-Available). The package was relicensed to MIT OR Apache-2.0 starting at 1.0.3 (2026-09-20). Old tarballs keep their original license — the registry history is the proof. | registry.npmjs.org/@marketnow/trust-adapters → versions 1.0.0–1.0.2 |
| UTA repository root (conformance, specs tooling, docs, CI) | MIT | The open-core scaffolding of this repository: everything that is not the proprietary Layer-3 core. | github.com/alicelabs-llc/universal-trust-adapter → /LICENSE |
| Plugin Template (uta-monorepo/packages/plugin-template) | MIT OR Apache-2.0 | Interface + boilerplate for third-party format adapters. | uta-monorepo/packages/plugin-template/package.json |
| UTS Specification (spec/UTS-v1.md + uts-v1.json) | CC-BY-NC-ND 4.0 | The Universal Trust Schema specification documents: readable and shareable verbatim, no derivatives, non-commercial. | github.com → spec/UTS-v1.md + README Open-Core table |
| Layer 3 core — TrustEngine + Sentinel + Interceptor (proprietary/) | AL-1.0 + commercial options | The source-available engine core. Review and internal use free; commercial hosting/resale of the core requires a commercial license. | proprietary/LICENSE-AL-1.0 + proprietary/COMMERCIAL-LICENSE.md |
| marketnow.site website (aep-marketplace) | MIT OR Apache-2.0 | The marketplace site that serves this page. | marketnow/aep-marketplace/LICENSE in the repository |
| Conformance test vectors + Rekor anchors + CRL/OCSP data | Published verbatim (part of repo MIT) | Test vectors, digests, anchors and revocation records are published exactly so strangers can verify — they are not separately relicensed. | marketnow.site/uta/conformance/ + /api/crl |
License evolution (declared, not hidden)
@marketnow/trust-adapters was originally published under AL-1.0 (versions 1.0.0–1.0.2, through 2026-09-09). At 1.0.3 (2026-09-20) the package moved to MIT OR Apache-2.0 to match the rest of the npm ecosystem. The npm registry keeps the per-version license history, so the transition is independently verifiable — including the 1.0.1 → 1.0.2 tarball correction documented on the package page.
@marketnow/uta-conformance has been MIT OR Apache-2.0 since publication.
Speculative/documentation layers use CC-BY-NC-ND 4.0. Nothing on this page licenses the
Layer-3 core permissively — that is a deliberate open-core decision, and its terms live in
proprietary/COMMERCIAL-LICENSE.md.
What you can do
| Use | npm packages (MIT OR Apache-2.0) | UTS spec (CC-BY-NC-ND) | Core (AL-1.0) |
|---|---|---|---|
| Install & run in production | Yes | n/a | Yes (internal use) |
| Fork / modify / redistribute | Yes — keep the notice | No derivatives | Source-available review; redistribution under AL-1.0 terms |
| Build a commercial product on top | Yes | Non-commercial use of the text | Requires COMMERCIAL-LICENSE.md |
| Re-host MarketNow / resell the audit pipeline | Requires a separate commercial license from AliceLabs LLC — legal@alicelabs.site | ||
Verify it yourself
curl -s https://registry.npmjs.org/@marketnow/trust-adapters \
| jq '.versions | to_entries | map({v:.key, license:.value.license})'
curl -s https://registry.npmjs.org/marketnow-mcp | jq '.dist-tags, .versions[.dist-tags.latest].license'
The machine-readable version of this matrix is generated from the same source and is checked by the audit gate on every push (LICENSE-MATRIX check).