Third-party software: licenses and caveats
Function Client's own code is under the licenses in LICENSE. NOTICE carries the attributions that must travel with every copy. This page lists what else is worth knowing before you run or redistribute Function Client: dependencies whose license asks something of you, and limitations. It is a guide, not legal advice.
Services the compose file runs
The compose file pulls these as separate containers, from their official images. This repository doesn't include or modify them, and each one's own license applies to it.
| Service | Image | License |
|---|---|---|
| MongoDB | mongo:7 | Server Side Public License (SSPL) |
| Neo4j Community Edition | neo4j:5-community | GPL-3.0; the APOC plugin it loads is Apache-2.0 |
| Redis | redis:7 | 7.4 and later: RSALv2 or SSPL, your choice; earlier 7.x: BSD-3-Clause |
| SeaweedFS (object storage) | chrislusf/seaweedfs | Apache-2.0 |
| Caddy (the edge) | caddy:2.10, with the web client added (apps/web/Dockerfile.web) | Apache-2.0 |
Redpanda (optional, kafka profile) | redpandadata/redpanda | Redpanda Business Source License |
Dependencies that ask something of you
Reown AppKit and WalletConnect (@reown/*, @walletconnect/*). The
web client includes them through Privy's wallet connectors.
They are under the Reown and WalletConnect Community Licenses, which require
a paid commercial license above thresholds Reown sets (in their August 2025
releases, 500 monthly active wallets, as the licenses define them, or
2.5 million monthly RPC calls), and require the wallet connectors to use
Reown's network. Anyone who distributes a client, or serves one as a
website, must show "Portions © 2025 Reown, Inc. All Rights Reserved" in its
notices or the site's about section and provide a copy of each license. The
web client built from this repository does:
apps/web/public/THIRD-PARTY-NOTICES.txt and the two licenses in
public/licenses/ are served by the web build and shown under Settings →
About → Open-source notices. Keep them if
you change the client.
Remotion (remotion, @remotion/*), for video rendering. Remotion's
license requires a paid company license in some cases, depending on the
size of the company using it. Rendering is off unless you set
REMOTION_FUNCTION_NAME and REMOTION_S3_BUCKET.
Privy (@privy-io/*). The SDK is Apache-2.0. Signing in with Privy
uses Privy's service, under an account and terms of your own
(Sign in with Privy). Under local sign-in, the default, the
service is never called.
Agora (agora-rtc-sdk-ng). The SDK is MIT. Calls use Agora's service,
under a project and terms of your own (Voice calls).
Limitations
isolated-vm, the sandbox for code the assistant runs, is a native
module. It needs Node.js 22. Where no prebuilt binary matches your platform,
npm ci compiles it, which needs Python 3, make and a C++ compiler.
puppeteer takes page screenshots, the pictures on cards and on channel
posts, in a browser it downloads when it installs, unless
PUPPETEER_SKIP_DOWNLOAD is set. The server's container image installs it
that way and ships no browser, so page screenshots are off there: the boot
log reads mirra.page_shots=off, cards show no picture, and channel posts
go out without one. A server run from a checkout uses the browser npm ci
downloads: it looks once at boot, and logs mirra.page_shots=puppeteer when
it finds one. That browser runs with Chromium's sandbox off (--no-sandbox)
and renders pages your users write. To keep screenshots off, install with
PUPPETEER_SKIP_DOWNLOAD=true and remove puppeteer's browser cache
(~/.cache/puppeteer).