Open core & licensing

Obsign is open core. The open-source repository is licensed Apache-2.0 and contains the entire critical path:

• the MCP gateway (obsign-proxy) — stdio and Streamable HTTP;
• policy: signed Cedar bundles, the tool catalogue, argument rules;
• identity: OIDC verification, claim mapping, the RFC 8693 delegation chain, hot key rotation;
• the WAL, the ledger (sealing, PKCS#11 HSM support, RFC 3161 anchoring), evidence export;
• the control plane: compiling policies from git, immutable signed releases, fleet export, the read-only console;
• the offline verifier (obsign);
• the full test suite — 319 tests, including the tamper-detection family.

The repository is complete and verifiable without the commercial layer. That is a design constraint: the trust story collapses if the proof depends on code an auditor cannot read. Sealing, anchoring, exporting and verifying all work from the open repository alone, at production grade.

The commercial layer

Separate code, under a separate license, for teams that answer to auditors and regulators at fleet scale:

• Compliance report packs — regulator-shaped reports built on the evidence dossier;
• Console RBAC & SSO — the open-core console is read-only and binds to localhost; authentication and roles are commercial;
• Long-term retention — managed archive lifecycle beyond the runbook;
• Onboarding & priority support.

The core never depends on it, and nothing in the commercial layer touches what verification means: an evidence pack sealed by the open core verifies identically with or without it.

Interested in the commercial layer for your team: guillaume@obsign.tech.

Contributing

Contributions to the open core are accepted under the DCO, sign-off required; see CONTRIBUTING.md in the repository.