MikeyPetrillo · MikeyPetrillo · Jul 18, 2026 · Jul 18, 2026
diff --git a/.github/trigger-test b/.github/trigger-test
@@ -14,3 +14,4 @@
 2026-07-17T17:45:00Z price tiebreak: known beats unknown
 2026-07-18T01:40:00Z wish bridge: qualified-demand gate against single-source bursts
 2026-07-18T02:30:00Z operator private demand board
+2026-07-18T03:15:00Z relicense server to AGPL-3.0
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,15 @@
 
 ## Unreleased
 
+- **Relicensed the server to AGPL-3.0** (the `client/`, `mcp/`, and `tollbooth/` npm packages
+  stay MIT). The root `LICENSE` is now the GNU Affero GPL v3, and a new `NOTICE` documents the
+  split: the self-hostable server is copyleft (run a modified version as a network service and you
+  must offer its source to users), while the buyer SDK, MCP connector, and pay-per-crawl middleware
+  remain permissively licensed so they can be embedded without obligation. The public promise that
+  `agent402-tollbooth` stays MIT is unchanged. Served copy, the README badge, docs, and the
+  machine-readable `/.well-known/x402` `license` field updated to match; `agent402-tollbooth`
+  marketing continues to read MIT. Secret-scanning (gitleaks) now runs on every push and PR.
+
 - **Conversion funnel: diagnose the 402→settle drop-off** (`paywall_402` + new `pow_challenge`).
   The funnel could show *that* agents bounce at the paywall but not *why*. Two privacy-preserving
   dimensions fix that (still counts-only — no IP/UA/wallet): (1) `paywall_402` gains `attempt`,

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -6,9 +6,11 @@ useful to every agent that connects. Bug fixes and docs are just as welcome.
 
 Issues and tool ideas: [open an issue](https://github.com/MikeyPetrillo/Agent402/issues).
 For anything that doesn't fit a public issue, email **mike@agent402.tools**.
-MIT licensed — by contributing you agree your contribution is too (standard
-"inbound = outbound": you keep the copyright on your code, shared under MIT like
-the rest of the project).
+Licensing (inbound = outbound): by contributing you agree your contribution is
+licensed under the same license as the component you're changing — AGPL-3.0 for
+the server (the repository root, where most tool contributions land) and MIT for
+the `client/`, `mcp/`, and `tollbooth/` packages. You keep the copyright on your
+code.
 
 ## List your x402 seller
 

diff --git a/LICENSE b/LICENSE
diff --git a/NOTICE b/NOTICE
@@ -0,0 +1,21 @@
+Agent402
+Copyright (C) 2026 Havok Holdings LLC
+
+This repository is licensed under more than one license. Check the LICENSE
+file nearest to the code you are using; the applicable license is the closest
+one in the directory tree.
+
+  * The server and everything at the repository root are licensed under the
+    GNU Affero General Public License, version 3 or later (AGPL-3.0-or-later).
+    See ./LICENSE. If you run a modified version of the server as a network
+    service, the AGPL requires you to offer that modified source to its users.
+
+  * The following packages are separately licensed under the MIT License, so
+    they can be embedded in other software without copyleft obligations. Each
+    ships its own LICENSE file:
+      - client/    (agent402-client, the buyer SDK)
+      - mcp/        (agent402-mcp, the MCP connector)
+      - tollbooth/  (agent402-tollbooth, the pay-per-crawl middleware)
+
+Third-party components retain their own licenses; see src/data/LICENSE.md and
+the notices in individual source files.
diff --git a/README.md b/README.md
@@ -18,7 +18,7 @@
 [![npm](https://img.shields.io/npm/v/agent402-client?label=agent402-client)](https://www.npmjs.com/package/agent402-client)
 [![npm](https://img.shields.io/npm/v/agent402-tollbooth?label=agent402-tollbooth)](https://www.npmjs.com/package/agent402-tollbooth)
 [![CI](https://github.com/MikeyPetrillo/Agent402/actions/workflows/deploy.yml/badge.svg)](https://github.com/MikeyPetrillo/Agent402/actions/workflows/deploy.yml)
-[![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
+[![License: AGPL-3.0](https://img.shields.io/badge/license-AGPL--3.0-green.svg)](LICENSE)
 
 **Framework adapters** (drop-in tools for the major agent stacks — auto-payment underneath):
 [![npm](https://img.shields.io/npm/v/agent402-openai-tools?label=openai-tools)](https://www.npmjs.com/package/agent402-openai-tools)
@@ -331,7 +331,7 @@ sha256 proof-of-work (sub-second; the MCP servers do it automatically). Details:
   [`agent402.base.eth`](https://basescan.org/address/0xaBF4FAbd7c416fB67202E5f9002389Fc75e2a9D0#tokentxns)
   (a Base name resolving to the public receiving wallet) — verifiable by anyone
   on Basescan; live counts at [`/api/stats`](https://agent402.tools/api/stats).
-- **MIT licensed, fork-friendly** — clone it, strip what you don't need, add
+- **AGPL-3.0 licensed, self-host-friendly** — clone it, strip what you don't need, add
   what you do.
 
 ## Agent402 in the x402 ecosystem
@@ -395,7 +395,7 @@ Worker, a reverse proxy, or a WordPress plugin (beta). Drop-in templates in
 - AI-gateway traffic (`/v1` chat, embeddings, images, speech) is additionally subject to the
   upstream model providers' usage policies. Wallets used for prohibited content are blocked
   before settlement (`WALLET_BLOCKLIST`).
-- The **code** is MIT-licensed and provided as-is, without warranty (see [LICENSE](LICENSE)).
+- The **server code** is AGPL-3.0-licensed (the client SDK, MCP connector, and tollbooth packages are MIT) and provided as-is, without warranty (see [LICENSE](LICENSE)).
   If you self-host, you are the operator: your deployment, your terms, your compliance —
   Havok Holdings LLC operates only the hosted instance and is not responsible for third-party
   deployments.
@@ -409,5 +409,5 @@ Worker, a reverse proxy, or a WordPress plugin (beta). Drop-in templates in
 ## Contributing
 
 PRs that add useful tools, fix bugs, or improve docs are very welcome — see
-[CONTRIBUTING.md](CONTRIBUTING.md). MIT licensed. Maintained by
+[CONTRIBUTING.md](CONTRIBUTING.md). AGPL-3.0 licensed (packages MIT). Maintained by
 [Havok Holdings LLC](https://github.com/MikeyPetrillo/Agent402).
diff --git a/docs/anthropic-directory-submission.md b/docs/anthropic-directory-submission.md
@@ -23,7 +23,7 @@ privacy policy, public docs, and a no-auth streamable-HTTP endpoint.
 | Privacy policy | https://agent402.tools/privacy |
 | Support contact | https://github.com/MikeyPetrillo/Agent402/issues |
 | Maintainer | Havok Holdings LLC — https://github.com/MikeyPetrillo/Agent402 |
-| Source code | https://github.com/MikeyPetrillo/Agent402 (MIT, fully open source) |
+| Source code | https://github.com/MikeyPetrillo/Agent402 (AGPL-3.0 server, MIT packages; fully open source) |
 
 ## Tagline (short)
 

diff --git a/docs/base-mcp-plugin.md b/docs/base-mcp-plugin.md
@@ -305,5 +305,5 @@ Then call `complete_x402_request` with the returned `requestId` to get the resul
 - **Price range.** Most single tools cost $0.001--$0.02, but premium AI/media tools run up to $0.50, and multi-tool skill packs up to $1.50. **Don't hardcode a `maxPayment` cap** — read the exact price from `/api/pricing` (or the `402` quote) before paying, so you never under-cap and fail a legitimate call.
 - **Free discovery.** The endpoints `/api/find`, `/api/pricing`, `/api/route`, `/api/leaderboard`, `/.well-known/x402`, and `/api/reliability` are all free and require no payment.
 - **MCP connector.** For direct MCP access (outside Base MCP), paste `https://agent402.tools/mcp` into any MCP client. Pure-CPU tools run free there (rate-limited); paid tools require the `agent402-mcp` npm package with a funded wallet.
-- **Open source.** The full server is MIT-licensed at https://github.com/MikeyPetrillo/Agent402 -- read every line, self-host, or fork.
+- **Open source.** The full server is AGPL-3.0-licensed at https://github.com/MikeyPetrillo/Agent402 -- read every line, self-host, or fork.
 - **Settlement.** All payments settle on-chain to `agent402.base.eth` on Base mainnet, verifiable on Basescan.
diff --git a/docs/ecosystem-listings.md b/docs/ecosystem-listings.md
@@ -163,14 +163,14 @@ that takes a GitHub repo URL; no PR, no fork.
      The catalog is 500+ strong — 400+ tools + 100 curated multi-tool skill packs
      (published as MCP prompts); every one is tested against its own example on
      every deploy. One config block, no per-tool signups, no API keys.
-     Self-hostable (open source MIT) or use the hosted remote at
+     Self-hostable (open source AGPL-3.0) or use the hosted remote at
      https://agent402.tools/mcp.
      ```
 
    - **Category / tags (pick what's offered):** `aggregator`, `payments`,
      `web-search`, `browser-automation`, `finance`, `developer-tools`
    - **Author:** `Havok Holdings LLC / MikeyPetrillo`
-   - **License:** MIT
+   - **License:** AGPL-3.0 (server); MIT (client SDK, MCP, tollbooth)
    - **Logo URL:** `https://raw.githubusercontent.com/MikeyPetrillo/Agent402/main/docs/logo-400.png`
 
 3. Submit. mcpservers.org auto-reviews; turnaround is usually a few days.

diff --git a/package.json b/package.json
@@ -49,7 +49,7 @@
     "stellar"
   ],
   "author": "Havok Holdings LLC <mike@agent402.tools> (https://agent402.tools)",
-  "license": "MIT",
+  "license": "AGPL-3.0-or-later",
   "type": "module",
   "dependencies": {
     "@coinbase/x402": "^2.1.0",

diff --git a/scripts/test-discovery.js b/scripts/test-discovery.js
@@ -28,7 +28,7 @@ const m = serviceManifest({
 
 ok(m.spec === "agent402-service-manifest/1", "manifest spec tag");
 ok(m.name === "Agent402.Tools", "manifest name");
-ok(m.openSource === true && m.selfHostable === true && m.license === "MIT", "wedge flags");
+ok(m.openSource === true && m.selfHostable === true && m.license === "AGPL-3.0-or-later", "wedge flags");
 ok(Array.isArray(m.differentiators) && m.differentiators.length >= 3, "differentiators present");
 ok(m.twoSided?.tollbooth?.npm === "agent402-tollbooth", "tollbooth advertised");
 

diff --git a/src/blog.js b/src/blog.js
@@ -31,7 +31,7 @@ export const BLOG_POSTS = [
 
 <h2>Open source, self-hostable</h2>
 
-<p>Agent402 is MIT-licensed. You can run your own instance, add your own tools, set your own prices. The hosted version at <code>agent402.tools</code> is just one deployment of the same codebase that's on GitHub.</p>
+<p>Agent402 is AGPL-3.0-licensed (the buyer SDK, MCP connector, and tollbooth stay MIT). You can run your own instance, add your own tools, set your own prices. The hosted version at <code>agent402.tools</code> is just one deployment of the same codebase that's on GitHub.</p>
 
 <p>We think the future of agent infrastructure is open protocols, not walled gardens. x402 is the payment layer, MCP is the discovery layer, and Agent402 is the tool layer that ties them together.</p>`,
   },

diff --git a/src/community.js b/src/community.js
@@ -39,7 +39,7 @@ export function communityPage(baseUrl) {
   const statCards = [
     { value: "500+", label: "tools" },
     { value: "8", label: "framework adapters" },
-    { value: "Open source", label: "MIT licensed" },
+    { value: "Open source", label: "AGPL-3.0 licensed" },
     { value: "x402", label: "protocol" },
   ];
 

diff --git a/src/discovery.js b/src/discovery.js
@@ -72,7 +72,7 @@ export function serviceManifest({ baseUrl, network, networks, wallet, walletName
     repository: REPO,
     openSource: true,
     selfHostable: true,
-    license: "MIT",
+    license: "AGPL-3.0-or-later",
     maintainer: MAINTAINER,
     // Programmatic buyers get their terms notice here, in llms.txt, and on
     // /v1/models — use of the service constitutes acceptance (see /terms).
@@ -95,7 +95,7 @@ export function serviceManifest({ baseUrl, network, networks, wallet, walletName
     // self-hostable, the whole catalog in one integration, and it owns the
     // other side of the protocol too (pay-per-crawl).
     differentiators: [
-      "Open-source and self-hostable — read every line, run it yourself (MIT).",
+      "Open-source and self-hostable — read every line, run it yourself (AGPL-3.0).",
       `One integration covers all 500+ tools — no per-service SDKs or signups.`,
       "Two-sided: also ships agent402-tollbooth, an open pay-per-crawl gate for the demand side of x402.",
       "Deterministic tool catalog — no LLM in that serving path; same input, same output, full OpenAPI schemas. (The optional /v1 gateway is a separate, opt-in LLM proxy.)",

diff --git a/src/ledger-chrome.js b/src/ledger-chrome.js
@@ -352,7 +352,7 @@ function sellPanelHtml() {
                 <span style="display:block;padding:10px 16px 8px;font-size:11px;letter-spacing:.1em;color:var(--faint);border-bottom:1px solid var(--hairline);">FOR API SELLERS - GET PAID PER CALL</span>
                 <a href="/sell" class="mlnav-row" style="display:flex;justify-content:space-between;gap:12px;padding:9px 16px;text-decoration:none;color:var(--ink);"><span style="font-weight:700;">list your API</span><span style="color:var(--faint);">free · health-ranked</span></a>
                 <a href="/tollbooth" class="mlnav-row" style="display:flex;justify-content:space-between;gap:12px;padding:9px 16px;text-decoration:none;color:var(--ink);"><span style="font-weight:700;">tollbooth</span><span style="color:var(--faint);">pay-per-crawl</span></a>
-                <a href="/contribute" class="mlnav-row" style="display:flex;justify-content:space-between;gap:12px;padding:9px 16px;text-decoration:none;color:var(--ink);"><span style="font-weight:700;">contribute a tool</span><span style="color:var(--faint);">MIT · ~15 lines</span></a>
+                <a href="/contribute" class="mlnav-row" style="display:flex;justify-content:space-between;gap:12px;padding:9px 16px;text-decoration:none;color:var(--ink);"><span style="font-weight:700;">contribute a tool</span><span style="color:var(--faint);">AGPL · ~15 lines</span></a>
                 <a href="/sell" style="display:flex;justify-content:space-between;gap:12px;padding:11px 16px;text-decoration:none;background:var(--surface);color:var(--on-dark);"><span style="font-weight:700;">start selling →</span><span style="color:var(--dk-muted);">/sell</span></a>
               </span>
             </span>`;

diff --git a/src/pages.js b/src/pages.js
@@ -434,7 +434,7 @@ const FAQ_ITEMS = [
   { q: "Is my data stored?", a: 'Tool inputs are processed in memory and not persisted — except the memory tools, whose purpose is storage (wallet-keyed, owner-deletable, with optional TTL). Full policy: <a href="/privacy">/privacy</a>.' },
   { q: "How do I know the service is honest?", a: "It is fully open source; CI re-tests every endpoint against its own documented example before each deploy; and revenue settles on-chain to agent402.base.eth (the named public receiving wallet), auditable by anyone on Basescan." },
   { q: "What happens if a tool fails after I pay?", a: "x402 settles before the handler runs, so the operating principle is that anything which can't be served reliably is removed from the catalog rather than left to charge-and-fail. Failure rates are watched by CI and a 15-minute production heartbeat." },
-  { q: "Is Agent402 self-hostable and open source?", a: 'Yes — it is open source under the MIT license. Clone the repo and run it yourself for free, with or without payments enabled. It also ships agent402-tollbooth, an open-source pay-per-crawl gate for charging AI crawlers on your own site.' },
+  { q: "Is Agent402 self-hostable and open source?", a: 'Yes — the server is open source under the AGPL-3.0 license (the client SDK, MCP connector, and tollbooth are MIT). Clone the repo and run it yourself for free, with or without payments enabled. It also ships agent402-tollbooth, an open-source pay-per-crawl gate for charging AI crawlers on your own site.' },
   { q: "Can I find tools on other x402 sellers from here?", a: 'Yes. Agent402 is also an x402 Index + Smart Order Router: <code>POST /api/route</code> ranks tools across every x402 seller we have crawled — the local catalog plus sellers auto-discovered from public registries like the Coinbase CDP Bazaar, refreshed hourly. It filters out unhealthy sellers and tiebreaks on health then price. Browse the live marketplace at <a href="/marketplace">/marketplace</a> or fetch the JSON snapshot at <a href="/api/index">/api/index</a>. Both surfaces are free.' },
   { q: "How do I list my own API?", a: 'For free, three ways: your origin is auto-discovered from public x402 registries (Coinbase CDP Bazaar, GoPlausible) once it&rsquo;s live and settling; paste it on <a href="/sell">/sell</a> for an immediate probe; or call <code>POST /api/index/register</code> directly. A listed seller is routable by the Smart Order Router and ranked on <a href="/leaderboard">/leaderboard</a> by real on-chain USDC volume — 0% take, settlement lands straight in your wallet.' },
   { q: "How do I see which x402 sellers are most used?", a: '<code>GET <a href="/api/leaderboard">/api/leaderboard</a></code> returns the live on-chain ranking of every x402 seller by Base USDC settled volume — callsSettled, totalUsd, and uniqueBuyers per seller. The pipeline walks every page of the Coinbase CDP Bazaar discovery endpoint, queries <code>eth_getLogs</code> on Base USDC for each seller&rsquo;s payTo, filters per-call settlements within a $0.50 ceiling (larger inbound is funding/swaps, not buys), and aggregates. The snapshot refreshes hourly server-side. Free, like <code>/api/find</code> and <code>/api/route</code>. Use <code>?include=external</code> to exclude Agent402 itself and rank only the rest of the ecosystem.' },

diff --git a/src/seo.js b/src/seo.js
@@ -257,7 +257,7 @@ ${chainItems}
 ${toolSections}
 
 ## Optional
-- [GitHub repository](https://github.com/MikeyPetrillo/Agent402): full source, MIT, self-hostable
+- [GitHub repository](https://github.com/MikeyPetrillo/Agent402): full source, AGPL-3.0, self-hostable
 - [agent402-tollbooth](${baseUrl}/tollbooth): open-source, self-hostable x402 pay-per-crawl gate for your own site
 - [Skill packs JSON](${baseUrl}/api/skill-packs.json): machine-readable pack index
 - [Tool docs](${baseUrl}/tools): human-readable documentation per tool