Licensing
Catalogue poppies ship their complete source in a public repository — that's non-negotiable, and users must keep the rights that make the store trustworthy: read it, audit it, build it, run it, patch their own install, use it commercially. Which license grants those rights is your call — open source or source-available with a noncompete. MIT is what we encourage — and what review looks on most favourably.
| Licenses | Why | |
|---|---|---|
| Encouraged | MIT · Apache-2.0 · BSD-2/3 | Maximum auditability and reuse, zero legal friction for users and for the platform. MIT-licensed poppies are what we feature first and take in greatest consideration. |
| Accepted | MPL-2.0 · LGPL-3.0 · GPL-3.0 · AGPL-3.0 | Copyleft is fine: it keeps the code open, doesn't block platform distribution or the 5% platform fee, and doesn't stop anyone else writing their own competing poppy. |
| Accepted (source-available) | PolyForm Shield 1.0.0 · PolyForm Perimeter 1.0.0 · FSL-1.1 | Noncompete source-available keeps every user right the store depends on — read, audit, build, run, patch your own install, commercial use — and withholds only one thing: building a competing product out of your code. That never stops anyone writing a similar poppy from scratch (ideas aren't licensed; code is), and reusing your code in a rival listing is already banned by the originality rule. It's also the license family the platform's own poppies use — same rules for the house as for you. |
| Rejected | Non-commercial (CC-NC and kin) · no-derivatives · production-restricted (default BUSL) · “all rights reserved” | These take away rights users need: a non-commercial or production-restricted license means our checkout can't lawfully sell your poppy and businesses can't lawfully run it; no-derivatives means a user can't patch and rebuild their own install; closed source can't be audited at all. |
Pick your license in the submission form. If you genuinely need something not on the list, choose “Other” and say why — it goes to manual review, with no promise of acceptance. The test applied is always the same two questions: does it take any right away from the user — read, audit, build, run, patch their own install, use commercially? and does it stop the platform from distributing and charging for your poppy as agreed? If either answer is yes, it can't be listed. What it may freely restrict is your competitors' use of your code.
The fear with open source is being copied. In this catalogue, that fear is our problem, not yours: copy-paste clones of your poppy are rejected at review. Anyone competing with you has to bring genuinely new functionality — your open code cannot be re-skinned into a rival listing. See approval.
An open repository is a hard listing requirement. It's what makes packages verifiable (byte-reproducible zips, pinned hashes) and review meaningful.
Your users are cloud admins installing software into their own AWS account. The ones worth having will point an AI agent at your repo and ask: “does this code do anything beyond what it declares?” When the answer is a verifiable no, that user converts — and stays. Closed source can't compete with that trust, whatever its feature list.
For the record, so nobody overclaims on your behalf: the AgentsPoppy host and SDK are source-available under the PolyForm Perimeter License 1.0.0 (read, run, audit, self-host — not for building competing platforms), and the credential-broker mechanism is patent pending. First-party poppies are PolyForm Shield 1.0.0 — the same source-available tier open to you above; the house plays by the store's rules. The hello-poppy example is MIT — copy it freely. Your poppy is yours: your brand, your repo, your license from the list above.
Outside the catalogue, none of this applies — sideloaded poppies are between you and your users, under any license you like. The tiers above are the price of the store shelf, not of the platform.