Six repositories
| Repository | What it is | Notes | License |
|---|---|---|---|
vericto-engine | The rule engine: it parses each statement and evaluates it against the rules. Rust. | PostgreSQL with pg_query (libpg_query, Postgres's own parser); MySQL, SQL Server and Oracle with sqlparser-rs. | AGPL-3.0-only |
vericto-proxy | The TCP proxy that sits between your application and the database. Rust. | PostgreSQL and MySQL protocols. The Docker image ships LICENSE, NOTICE and THIRD_PARTY_LICENSES. | AGPL-3.0-only |
vericto-cli | The CLI for pre-commit and CI. Rust; also on npm as @vericto/vericto-cli. | It sends the SQL to the Vericto API, which evaluates it with your workspace rules. Since 1.9.0 it embeds the engine for offline mode, with the standard rules; that is why it has the same license as the engine. | AGPL-3.0-only |
check-sql | The GitHub Marketplace Action: uses: vericto/check-sql@v1 checks the SQL in every pull request. | It installs a pinned CLI version and verifies its SHA-256 before running it; findings appear as Code Scanning annotations (SARIF). | Apache-2.0 |
vericto-python | The Python SDK (vericto on PyPI): wrappers for snowflake-connector-python, sqlite3, SQLAlchemy and any DB-API driver. | Integrations for LangChain, LlamaIndex, dbt and Airflow. | Apache-2.0 |
vericto-node | The Node.js SDK (@vericto/sdk on npm): wrappers for snowflake-sdk and better-sqlite3. | A LangChain.js integration and a Runtime API client for any other driver. | Apache-2.0 |
Each repository's license is its LICENSE file: vericto-engine, vericto-proxy and vericto-cli (AGPL-3.0-only, summarized in each one's LICENSING.md); vericto-python, vericto-node and check-sql (Apache-2.0). The Homebrew tap (vericto/homebrew-tap) stays under BSD-2-Clause. The dashboard and the API at app.vericto.com are not public.
What the AGPL-3.0 allows
The AGPL-3.0-only (GNU Affero General Public License, version 3 only) is an OSI-approved open-source license. It covers vericto-engine and vericto-proxy from 5.0.0 and vericto-cli from 2.0.0. In short, and without replacing its text or each repository's LICENSING.md:
- You can use them for free for any purpose, including in production and commercially: inside your company, in your CI or in pipelines you run for your customers. Running an unmodified copy carries no obligations, even when you operate it over a network.
- You can read, build, copy and modify the code. Obligations apply in two cases: when you distribute it, and when you modify it and offer it over a network.
- If you distribute it (the binary or the source, modified or not, on its own or inside your product), you must do so under the AGPL, with the license and notices, and make the corresponding source available to the recipients. If your product and the component form a single work, the whole is under the AGPL.
- If you modify it and other people use your version over a network, you must offer them the source code of that modified version at no charge (section 13 of the license).
Whether a closed-source integration forms a single work with the engine, the proxy or the CLI is a fact-specific copyright question: if your integration depends on the answer, get your own legal advice or a commercial license.
Commercial license
Vericto S.A.S. offers a commercial license for anyone who needs rights the AGPL does not give: for example, to embed the engine, the proxy or the CLI in a closed-source product you distribute, to distribute a modified version without applying the AGPL to the whole, to run a modified version without offering its source, or to meet an organizational policy that does not allow AGPL software. Scope and conditions are agreed with Vericto case by case, in a signed agreement. Write to legal@vericto.com with your company name, the product, the versions and how you plan to distribute or deploy it.
Integrating with Vericto through its API or its MCP server needs no commercial license: that use is governed by the Terms of Service.
Apache-2.0 for the SDKs, the GitHub Action and the benchmark
vericto-python from 0.4.0, @vericto/sdk from 0.3.0 and check-sql from 1.1.0 are open source under the Apache License 2.0: you can use, modify and redistribute them for any purpose, including inside commercial products, with that license's patent grant. vericto-bench, the benchmark harness, is under Apache-2.0 too.
Earlier versions
Each version stays under the license it was published with: the move to the AGPL takes away nothing you already received.
- FSL-1.1-ALv2: vericto-engine 4.3.0 to 4.7.1, vericto-proxy 4.14.0 to 4.23.0 and vericto-cli 1.10.0 to 1.13.3. Each of those versions also becomes available under the Apache License 2.0 on the second anniversary of the date Vericto made it available; each repository's LICENSE_HISTORY.md gives the dates.
- Elastic License 2.0 (ELv2): vericto-engine up to 4.2.0, vericto-proxy up to 4.13.0, vericto-cli up to 1.9.1, vericto-python up to 0.3.2, @vericto/sdk up to 0.2.2 and check-sql up to 1.0.3.
Copyright 2026 Vericto S.A.S. The governing text is the LICENSE file in each repository. None of these licenses grants rights to the Vericto trademark, name or logo: each repository's TRADEMARKS.md explains this.
Contributing and reporting
- Every repository accepts community pull requests: each one has its CONTRIBUTING.md and a code of conduct.
- Contributions to the engine, the proxy and the CLI are signed under the Vericto Contributor License Agreement (CLA): contributors keep their copyright, and Vericto can distribute the contribution under the AGPL and under its commercial licenses.
- Vulnerabilities are reported privately, as each repository's SECURITY.md describes, or to security@vericto.com.
- Every CLI release publishes SHA-256 checksums and, since v1.5.1, Sigstore build attestations.