Skip to content
SitePilotDocs

Licensing and distribution

Status date: 2026-09-01. This policy was approved by the Owner before the first public contracts release and updated to reflect the shipped MCP adapter. It records the distribution boundary for each SitePilot artifact; it is not legal advice or a substitute for counsel.

Artifact Licence Distribution policy
plugins/sitepilot-mcp GNU General Public License v2.0 or later (GPL-2.0-or-later) Distributed as a signed ZIP from downloads.sitepilot.tools, with the source published at github.com/jim788e/sitepilot-mcp-plugin. The ZIP includes the plugin’s preferred-form PHP source and the full licence text.
packages/contracts Apache License 2.0 (Apache-2.0) Published as the public @instantbuild-sitepilot/contracts npm package. Its package metadata and tarball include the licence.
packages/mcp-server Apache License 2.0 (Apache-2.0) Published as the public sitepilot-mcp npm package through the provenance-bound public mirror. Its package metadata and tarball include the licence.
sitepilot-cloud Proprietary; no public licence grant Kept in the private sitepilot-cloud repository and deployed as a service, not distributed as source or a package.

Enforcement

Section titled “Enforcement”
  • Product CI fails if a bundled PHP runtime dependency lacks licence metadata or is available only under GPLv2-only terms.
  • Cloud CI verifies that the installed @instantbuild-sitepilot/contracts package declares Apache-2.0.
  • On 2026-10-02 the Owner relicensed the plugin to GPL-2.0-or-later in order to apply for a WordPress.org listing. The WordPress.org team declined the listing on 2026-10-05 and maintained that decision on 2026-10-20, citing the overall nature of a plugin that exposes administrative operations to external clients rather than a specific defect. The plugin therefore stays distributed directly. The licence remains GPL-2.0-or-later, which is the same licence WordPress itself uses.
  • The --channel=wordpress-org package variant (npm run package:plugin:wordpress-org) and the Plugin Check CI job remain in the repository but are not used for distribution.
  • Third-party notices remain in NOTICE.md and inside the relevant bundled assets.

The plugin’s runtime dependencies recorded at this decision point declare GPL-2.0-or-later; no GPLv2-only runtime dependency is present.

Public normalization derived from product commit 0e0df225b885b9242df0c928c35081fd3ceac10b, file LICENSING.md. See source-manifest.json for the source digest and declared normalization classes.