I Read the LICENSE File in 35 'Open Source' AI Agents. Four Are Not Open Source, and n8n Is Not One of Them.

TL;DR: I fetched and read the LICENSE file in 35 of the repos that dominate "best open-source AI agent" roundups. 31 are governed by an OSI-approved license (MIT, Apache 2.0, GPL-3.0, AGPL-3.0). Four are not: n8n, AutoGPT's platform, Dify, and LobeChat. Three of those four describe themselves as "open source" in their own README. The fourth is n8n, the project most often accused of faking it, which calls itself fair-code and "source available" and links both of its licenses in the README. Six of the 35 carve named file paths out to a separate commercial license, and 9 distinct non-OSI license documents appear across the set.

The 2026 agent stack is sold on self-hosting and no vendor lock-in, and a real slice of it is not open source under the only definition that can be checked. So I checked. Not the marketing page, not the GitHub sidebar, not a badge: the actual LICENSE file, fetched from the primary repo through raw.githubusercontent.com, trying main and master and six filename variants, then read line by line and compared against the OSI-approved license list. That list is the yardstick that makes this a count instead of an opinion. All 35 repos resolved on the first pass, so the denominator here is a real 35, not a rounded one.

What did reading 35 LICENSE files actually show?

Thirty-one of 35 are governed by a license the OSI has approved. The distribution is boring in the best way: Apache 2.0 and MIT dominate, with GPL-3.0 at AgentGPT and AGPL-3.0 at Skyvern. Aider, Cline, Continue, goose, opencode, LangChain, LlamaIndex, CrewAI, Haystack, smolagents, Letta, mem0, camel, browser-use, OpenHands, and the rest are exactly what they claim.

Four are not. n8n ships the Sustainable Use License v1.0. AutoGPT puts everything inside autogpt_platform/ under the PolyForm Shield License 1.0.0. Dify ships a "Dify Open Source License", which its own text describes as "a modified version of the Apache License 2.0, with the following additional conditions." LobeChat ships the LobeHub Community License, also Apache 2.0 plus conditions. None of those four names appears anywhere on the OSI list. I searched the page for each of them and got zero hits, while "MIT License," "Apache License, Version 2.0," and "GNU Affero" all hit.

Six of the 35 carve specific file paths out to a separate commercial license: n8n (any file with .ee. in the filename or .ee in the dirname), AutoGPT (autogpt_platform/), Flowise (packages/server/src/enterprise), Activepieces (packages/ee/), Langfuse (ee/, web/src/ee/, worker/src/ee/), and Windmill (anything behind the enterprise compile flag). For Flowise, Activepieces, and Langfuse the core really is MIT or Apache 2.0; the carve-out is the periphery. Counting every distinct non-OSI document in the set, including those enterprise files, I get nine, and eight of them were written by the vendor for its own product. Only PolyForm Shield is an off-the-shelf template.

Which four are not open source, and what do they actually say?

The n8n license is the strictest of the four and the clearest written. The operative sentence: "You may use or modify the software only for your own internal business purposes or for non-commercial or personal use. You may distribute the software or provide it to others only if you do so free of charge for non-commercial purposes." That fails OSI criteria on field-of-use restriction and on redistribution. It is a perfectly coherent license. It is not an open source one.

PolyForm Shield is milder: AutoGPT's own README table summarizes it as "Free for personal and internal business use; cannot be sold as a competing hosted service." Dify's conditions are a multi-tenant ban and a rule against removing the console logo. LobeChat's condition is that "a commercial license must be obtained from the producer if you want to develop and distribute a derivative work." Four different restrictions, four different documents, one shared property: you cannot use them for any purpose, which is the whole point of the OSI definition.

Why is n8n the one that gets this right?

This is where the count refused to cooperate with my expectations. n8n is the standing example in every argument about fake open source, and n8n's README does not say open source. It opens with "Fair-code platform to build and deploy AI agents and workflows," it lists "Source Available: Always visible source code" as a feature, and its license line reads: "n8n is fair-code distributed under the Sustainable Use License and n8n Enterprise License." Both licenses linked. The n8n homepage I fetched does not contain the string "open source" at all.

The other three do. AutoGPT's README headline is "The open-source platform for AI agents," directly above the table conceding that the platform folder is PolyForm Shield. Dify's README calls it "an open-source LLM app development platform," while Dify's own homepage says "Source-available. Self-host with Docker." The same company, two surfaces, two different words. LobeChat's README calls it "an open-source, extensible, high-performance chatbot."

So the honest version of this finding is narrower than the headline everyone wants: three of 35 projects apply the phrase "open source" to something an OSI license does not govern, and all three disclose the real license further down the same page. This is a labeling gap, not a con. The distortion mostly happens downstream, in roundups that read the tagline and never open the file.

What does a shields.io badge actually know?

Nothing. LobeChat's README renders a license badge pointing at img.shields.io/badge/license-apache%202.0-white. That is the static badge endpoint. The string "apache 2.0" is typed into the URL by hand; shields.io does not read the repository to produce it. Sixty lines below that badge, the same README states, correctly, "This project is LobeHub Community License licensed." The badge is not lying about a lookup, because there was never a lookup.

The other trap is filenames. Microsoft's autogen has a root file named LICENSE containing Creative Commons Attribution 4.0, which is not a software license at all. The code license lives in LICENSE-CODE and it is MIT. Any script that classifies a repo by reading the file called LICENSE marks Microsoft's flagship agent framework as CC-BY. Mine nearly did.

Is "open weights" the same question?

No, and conflating them is the most common error in coverage of this topic. Whether a model's trained weights are downloadable under a community license is an argument about redistributing an artifact you cannot practically rebuild. Whether an agent framework's source code carries an OSI license is an argument about what you are permitted to do with code you can read in full. A stack can be OSI-clean at every layer of the harness and still call a closed API, which describes most of the 31, and the harness is where the failures actually live anyway. Keep the two questions in separate columns.

Does any of this mean you should not use them?

No, and I want to be exact about what this count does not prove. Source-available licensing is a legitimate business model, chosen deliberately by companies that would otherwise be strip-mined by hyperscalers, and it is not fraud, deception, or bait-and-switch. Nothing here says the four are worse software. n8n in particular publishes its terms more plainly than several MIT projects publish theirs.

What the count does prove is that the phrase in the roundup headline carries no information, so you have to do the twenty seconds yourself. Open the LICENSE file on the default branch, which is master for n8n and opencode and main for most of the rest. Search it for "internal business purposes," "multi-tenant," "competing," and ee. Then check whether the specific capability you are self-hosting to get, SSO, audit logs, multi-tenancy, RBAC, is sitting inside a carved-out directory, because in six of these 35 that is exactly where the feature you wanted to avoid paying for lives. The lock-in you were dodging by not paying for a stack of subscriptions does not disappear because the code is visible. And the promise that self-hosting makes an agent reliable was always a separate claim from whether it survives real work.

Thirty-five files. Twenty minutes. Four surprises, one of them being that the usual villain reads its own license more carefully than its critics do.