Open source & licensing
Mushi Mushi is open by default. The cloud product at kensaur.us/mushi-mushi/ runs the
same code as this repository — there is no closed-source “enterprise” fork. What you
self-host is what we run; the hosted service adds only its own tuning data
(what that means).
TL;DR — Mushi Mushi is open-core (the Supabase / Grafana model). The SDKs you
embed in your app are MIT (use them anywhere, open or closed). The server and
console you self-host are AGPLv3 (true OSI open source — self-host and modify freely; SaaS
modifiers publish changes or get a commercial license ).
A small enterprise-edition boundary (packages/server/ee/) is source-available
but commercial for production use. The wedge — capture, diagnosis, fix, self-host,
BYOK — is always in the AGPL core, never behind EE.
Open-core, one repo
| Surface | License | What you can do |
|---|---|---|
SDK packages — core, web, react, vue, svelte, angular, react-native, capacitor, flutter, ios, android, node, cli, mcp, mcp-ci, plugins, adapters, marketing-ui, and the code and design tokens in brand | MIT | Use, fork, sell, embed in proprietary products. No copyleft. |
Server packages — @mushi-mushi/server, @mushi-mushi/agents, @mushi-mushi/verify | AGPLv3 | Use, modify, self-host, fork for your own org. Modified SaaS → publish changes (§13) or commercial license . The cloud runs this exact core. |
Console — apps/admin (and the tester portal, apps/testers) | AGPLv3 | Same terms as the server. AGPLv3 since Oct 22, 2026; copies from before that date stay MIT. |
| Logo, bug mark, app icons, mascot | All rights reserved | Use the unmodified logo to refer or link to Mushi Mushi. Not as your own app’s identity. |
Enterprise edition: SAML/OIDC SSO, audit export, retention-policy editing, region pinning, SOC 2 evidence and compliance exports. The boundary and license live in packages/server/ee/; the code itself still sits next to the core until it is moved | Commercial | Read, audit, modify, and run for development/evaluation. Production use needs an Enterprise subscription or MUSHI_EE_LICENSE_KEY. |
| Third-party attributions | NOTICE | One-stop list of upstream projects and their licenses. |
Why MIT for the SDK?
The widget runs inside your application. A copyleft SDK would force your app’s
license, which is unacceptable — so every package you ship to your users is MIT.
Drop @mushi-mushi/react into a closed-source product with zero obligations.
Why AGPLv3 for the server?
We want honest open source — the same model as Supabase. The server is
AGPLv3: genuinely OSI-approved, self-hostable forever, copyleft only when you
offer a modified version as a network service (Section 13). The project is
funded by managed cloud hosting and a small commercial enterprise edition
(packages/server/ee/), not by confusing license labels.
Need to run modified Mushi Mushi as multi-tenant SaaS without publishing server changes? See COMMERCIAL-LICENSE.md .
Why AGPLv3 for the console?
The console is the product you look at every day. Under MIT, anyone could put a new name on it and ship it closed next to the open server. Under AGPLv3 you can still self-host it, change it and fork it; if you offer a modified console to other people as a service, you publish your changes. Nothing in the MIT SDKs imports console code, so embedding the SDK is unaffected.
What the hosted service keeps
Mushi Mushi Cloud runs the code in this repository. Going forward it also keeps its own tuning data, as configuration in its database rather than code in the repo:
- prompt wording tuned on live traffic (the Prompt Lab stores the same kind of override for your project),
- the evaluation sets that tuning is measured against,
- judge scoring weights, and later adjustments to spend-down thresholds.
The repository keeps working default prompts, the default scoring weights, the spend-down defaults and the test fixtures, so a self-hosted stack has every feature and runs end to end. Your stack can word a diagnosis a little differently from the hosted one, because its prompts are the defaults or your own. We used to say the cloud runs “provably the same code”; the exact version is: the same code; the hosted service carries its own tuning data.
Contributing
Outside pull requests come in under a Contributor License Agreement , signed once by replying to the CLA bot on your pull request. You keep the copyright. The CLA lets the maintainer keep the licensing above coherent and offer the commercial license, and it promises your contribution stays available under MIT or an OSI-approved license. See CONTRIBUTING.md .
No lock-in
- Bring your own LLM key (self-host). When self-hosting, the diagnosis engine uses your Anthropic/OpenAI key (BYOK) at list rate — we never mark up tokens. Most teams run the full loop for under $20/month in LLM costs.
- Bring your own storage. S3, Cloudflare R2, GCS, MinIO, or Supabase Storage, per project.
- Your data lives where you choose. Self-host the whole stack, or use Mushi Mushi Cloud — same code either way. Export and leave at any time.
What’s paid and what’s free
| Surface | Free forever? | Cloud charges |
|---|---|---|
| SDK packages (MIT) | Yes — embed in any app | — |
| Self-hosted server (AGPLv3) | Yes — run on your own infra, unlimited diagnoses | Your own LLM API costs (BYOK) |
| Mushi Mushi Cloud — Free tier | Yes — 1 app, 100 diagnoses / mo, hard stop at limit | — |
| Mushi Mushi Cloud — Builder / Studio / Enterprise | Flat base by apps watched + usage overage | $29 (3 apps) or $79 (10 apps) / mo base + $0.03 (Builder) or $0.02 (Studio) per extra diagnosis; Enterprise from $499 / mo |
One sentence: the MIT + AGPL core self-hosts free; the cloud sells managed hosting, LLM key pooling, longer retention (Free keeps 14 days), team seats, and enterprise features (SSO, compliance exports).
Diagnoses are the unit of cloud value. A diagnosis = one completed Stage-2 classification (Sonnet produces a plain-English root cause + fix hint). Noise-filtered reports and duplicates collapsed into an existing group do not count.
Run it yourself
- Self-host in minutes (Docker Compose) — the full stack in one command.
- Self-hosting overview — managed-Supabase and step-by-step paths.
- Public roadmap — everything we’re building, in the open.
Trademarks
The code is open source; the name and logo are not. “Mushi Mushi”, the mushi-chan mascot, the bug logo and the wordmark are trademarks. They are not registered yet. The logo files, app icons and mascot art are all rights reserved. You may use the unmodified logo to refer or link to Mushi Mushi (an article, a “works with Mushi Mushi” note, an integrations page). Fork the code freely, but ship your fork under your own name and logo — don’t imply it’s the official Mushi Mushi. Details: TRADEMARK.md .