Skip to content
SitePilotDocs

Licensing and distribution

Status date: 2026-09-01. This policy was approved by the Owner before the first public contracts release and updated to reflect the shipped MCP adapter. It records the distribution boundary for each SitePilot artifact; it is not legal advice or a substitute for counsel.

Artifact Licence Distribution policy
plugins/sitepilot-mcp GNU Affero General Public License v3.0 or later (AGPL-3.0-or-later) Distributed directly as a signed ZIP. The ZIP includes the plugin’s preferred-form PHP source and the full licence text. The separate WordPress.org packaging channel is not supported.
packages/contracts Apache License 2.0 (Apache-2.0) Published as the public @instantbuild-sitepilot/contracts npm package. Its package metadata and tarball include the licence.
packages/mcp-server Apache License 2.0 (Apache-2.0) Published as the public sitepilot-mcp npm package through the provenance-bound public mirror. Its package metadata and tarball include the licence.
sitepilot-cloud Proprietary; no public licence grant Kept in the private sitepilot-cloud repository and deployed as a service, not distributed as source or a package.

Enforcement

Section titled “Enforcement”
  • Product CI fails if a bundled PHP runtime dependency lacks licence metadata or is available only under GPLv2-only terms.
  • Cloud CI verifies that the installed @instantbuild-sitepilot/contracts package declares Apache-2.0.
  • The removed --channel=wordpress-org package variant and Plugin Check job must not be reintroduced without a new Owner-approved licensing decision.
  • Third-party notices remain in NOTICE.md and inside the relevant bundled assets.

The plugin’s runtime dependencies recorded at this decision point declare GPL-2.0-or-later; no GPLv2-only runtime dependency is present.

Public normalization derived from product commit 00c30de825b68dc14535f6455e82c927ad256b47, file LICENSING.md. See source-manifest.json for the source digest and declared normalization classes.