7 of 87 agent repos declare no licence — and that is not the same as free

Of the 87 repositories on this shelf, 7 declare no licence at all — 8 per cent. That single fact is the most expensive surprise in software reuse, because "no licence" does not mean "free": it means the default, and the default is all rights reserved.

The distribution

What the common licences actually permit

• MIT / Apache-2.0 / BSD — use it commercially, keep the notice. Apache-2.0 adds an explicit patent grant, which is why corporate legal teams prefer it.
• GPL family — you can use it, but distributing a derivative obliges you to release that derivative under the same terms. Fine for internal tools, a serious decision for a product.
• AGPL — the network clause catches SaaS: running it as a service can count as distribution.
• None declared — no permission granted. Reading and learning is fine; copying into anything you ship is not, and a public GitHub repository is not an implied licence.

How to check a repository properly

1. Open the repository root and look for LICENSE, LICENSE.md or COPYING. Not in the README — the file.
2. Check the GitHub sidebar shows a licence. GitHub infers it from the file; if the sidebar is empty, there is no licence.
3. If it says "custom", read it: a custom licence can be stricter than any standard one.
4. Record the licence next to the repository in your own shelf, so the question is answered before you are under deadline.

Why this matters more for agent tooling

Skill packs and prompt collections are copied wholesale into other repositories, often without their licence file, because they are "just markdown". That is exactly the case where nobody checks, and exactly the case where the default bites: you end up shipping a client the prose of an unlicensed pack, with your name on the commit.

The practice that avoids all of it

Treat the licence as part of the install decision, not an afterthought. A repository with no licence is a repository you learn from and re-implement, not one you vendor. Everything else on this shelf carries a licence in the table you can download as CSV, so the answer is one column away.

Three licences cover almost everything here

Look at the table and the shape is obvious: MIT, Apache-2.0 and BSD-3-Clause account for the overwhelming majority. That is good news for anyone building on this shelf, because those three are interchangeable in practice: keep the copyright notice, ship what you like, no obligation to publish your own source. The interesting cases are at the edges — the copyleft handful, where a derivative has to stay open, and the unlicensed block, where nothing is granted at all.

If you inherit an unlicensed repository

Three legitimate routes, in order of preference. Ask the author for a licence — a short issue, politely worded, resolves a surprising number of these, and the answer is worth keeping in the thread as evidence. Second, re-implement the idea instead of copying the code: ideas and interfaces are not what the copyright covers, the expression is. Third, fork nothing and link to it: running it as a separate service you do not redistribute is a different question from vendoring its source into your product, and worth asking a lawyer about rather than guessing.

One practice that pays for itself

Keep the licence in the same record as the repository, next to the stars and the last-push date. When the question arrives — and it arrives on the worst possible day, mid-delivery, with a client asking for provenance — the answer is a column in a CSV rather than an afternoon of archaeology.

Corrections

Licence values read from repository metadata on 2026-11-05. Licences change; the checklist above does not.