Mushi Mushi goes AGPLv3: the honest open source story

Jun 17, 2026 · Kenji Sakuramoto

We started Mushi Mushi with a BSL 1.1 server license, the “source-available” model HashiCorp moved Terraform to in 2023. The idea was reasonable: let anyone self-host, block unmodified SaaS competitors, and convert to Apache in 2029.

The problem: our README said “open source.” Our migration guides said “MIT-licensed.” The badges said BSL 1.1. Three things, all contradicting each other.

Worse, every time a developer read the license and realized BSL isn’t OSI-approved, the credibility hit was worse than just being honest from the start.

What we actually want

Grafana is AGPLv3. Supabase is Apache 2.0. Langfuse is MIT, with its enterprise folders under a separate license. All three built large developer communities. The common thread: they were clear. Each says what is open and under which license, and you can check it in the LICENSE file. (Corrected 2026-10-29: this paragraph first said Supabase is AGPLv3. Its main repository is Apache 2.0.)

We want what they have: trust from developers who can read the license and know exactly what they’re getting.

The decision

The server (@mushi-mushi/server, @mushi-mushi/agents, @mushi-mushi/verify) is AGPLv3.

True OSI-approved open source.
Self-hosting is and always will be free.
The AGPLv3 network use provision (Section 13) means if you run a modified server as a SaaS, you publish your changes. This isn’t punitive — it’s the copyleft that keeps the ecosystem honest.
The SDK packages (@mushi-mushi/react, @mushi-mushi/vue, etc.) remain MIT — embed them in anything, open or closed.
Companies that need a non-copyleft path for hosted SaaS can obtain a commercial license (dual licensing).

Self-hosters: nothing changes operationally. You were already allowed to do everything you’re doing. The new license just makes that legally unambiguous and removes the 2029 date anxiety.

What this changes

For individual developers and teams self-hosting: nothing. Fork it, modify it, run it for your own org.

For companies that want to offer Mushi Mushi as a hosted service to third parties: AGPLv3 applies. Either publish your server modifications or talk to us about a commercial license.

For Mushi Mushi Cloud, the hosted product: still running the same code. Now provably the same code.

Update, Oct 22, 2026. Two changes since this post, both in Open source & licensing. The console (apps/admin) is now AGPLv3 too, so a rebranded console can’t ship closed. And we now say it more exactly: Mushi Mushi Cloud runs the same code, and carries its own tuning data (prompt wording, evaluation sets and scoring weights tuned on live traffic) as configuration. The repo keeps working default prompts, so self-hosting stays free and complete. One part of the server is not AGPLv3: the enterprise folder packages/server/ee (SSO, audit export, retention policies) is source-available, and production use of it needs a license.

The honest “open source” claim

We can now say “the server is open source” and mean it. The SDKs were always MIT. The distinction is: SDK = embed anywhere; server = copyleft when you SaaS a modified version.

That’s the model we committed to — documented in Open source & licensing.

Questions? Open an issue or start a thread in GitHub Discussions .