Open-Source Notices
Provadyne is built on the open-source components below. We document not only their licenses but how each is used, because the usage pattern determines what obligations apply. Every component Provadyne links against or distributes is permissively licensed (MIT / BSD / Apache-2.0); copyleft tools are only ever invoked at arm's length and never bundled.
A public summary is also published at https://provadyne.com/licenses, and the
canonical machine-readable copy is NOTICE.md at the repository root.
Last reviewed: 2026-06-19.
External analysis tools (invoked, not bundled)
Installed independently by the user and run as separate OS processes; Provadyne does not bundle, link against, or redistribute them, and exchanges data only over stdin/stdout/argv and temp files. An arm's-length invocation does not create a derivative work, and since we do not distribute these binaries their distribution obligations are not triggered.
| Tool | License | Used for |
|---|---|---|
cppcheck (+ misra.py) |
GPL-3.0-or-later | C — MISRA C / CERT C / CWE |
| clang-tidy (LLVM) | Apache-2.0 WITH LLVM-exception | C++ — CERT C++ / C++ Core Guidelines |
| clippy | MIT OR Apache-2.0 | Rust — clippy lints |
Daemon (Go)
Go standard library only — no third-party Go modules vendored or linked
(daemon/go.mod declares no require). Go toolchain: BSD-3-Clause.
Engine (Python)
| Package | License | Role |
|---|---|---|
| fastapi | MIT | HTTP framework |
| uvicorn | BSD-3-Clause | ASGI server |
| tree-sitter / -c / -cpp | MIT | parsers |
| httpx | BSD-3-Clause | HTTP client |
| reportlab | BSD (3-clause style) | PDF report (Pro) |
| openai (optional, BYOK) | Apache-2.0 | AI suggestions |
| anthropic (optional, BYOK) | MIT | AI suggestions |
Browser extension
Ships no third-party runtime code. Build-time only: esbuild (MIT), not included in the shipped extension.
Summary
- Every linked or distributed dependency is permissively licensed (MIT / BSD / Apache-2.0).
- No copyleft library is in Provadyne's import or link graph.
- GPL analyzers (cppcheck) are invoked at arm's length and never redistributed, so the GPL does not extend to Provadyne.
The recommendation levels and tool-qualification notes for the analyzers are in the TCL Assessment.