Licensing
Catalogue poppies are open source — that's non-negotiable. Which open license you pick is your call, within one boundary: it must not collide with how the platform works, and it must not be used to fence other developers out of building their own, different poppies. MIT is what we encourage — and what review looks on most favourably.
| Licenses | Why | |
|---|---|---|
| Encouraged | MIT · Apache-2.0 · BSD-2/3 | Maximum auditability and reuse, zero legal friction for users and for the platform. MIT-licensed poppies are what we feature first and take in greatest consideration. |
| Accepted | MPL-2.0 · LGPL-3.0 · GPL-3.0 · AGPL-3.0 | Copyleft is fine: it keeps the code open, doesn't block platform distribution or the 5% platform fee, and doesn't stop anyone else writing their own competing poppy. |
| Rejected | Non-commercial (CC-NC and kin) · no-derivatives · non-compete / restricted source-available (BUSL, FSL, PolyForm-style) · “all rights reserved” | These collide with the platform legally or with the ecosystem's openness: they'd forbid paid distribution through our checkout, block users from auditing and rebuilding, or let one developer legally fence off a whole category from everyone else. |
Pick your license in the submission form. If you genuinely need something not on the list, choose “Other” and say why — it goes to manual review, with no promise of acceptance. The test applied is always the same two questions: does it stop the platform from distributing and charging for your poppy as agreed? and does it stop other developers from building similar apps of their own? If either answer is yes, it can't be listed.
The fear with open source is being copied. In this catalogue, that fear is our problem, not yours: copy-paste clones of your poppy are rejected at review. Anyone competing with you has to bring genuinely new functionality — your open code cannot be re-skinned into a rival listing. See approval.
An open repository is a hard listing requirement. It's what makes packages verifiable (byte-reproducible zips, pinned hashes) and review meaningful.
Your users are cloud admins installing software into their own AWS account. The ones worth having will point an AI agent at your repo and ask: “does this code do anything beyond what it declares?” When the answer is a verifiable no, that user converts — and stays. Closed source can't compete with that trust, whatever its feature list.
For the record, so nobody overclaims on your behalf: the AgentsPoppy host and SDK are source-available under the PolyForm Perimeter License 1.0.0 (read, run, audit, self-host — not for building competing platforms), and the credential-broker mechanism is patent pending. The hello-poppy example is MIT — copy it freely. Your poppy is yours: your brand, your repo, your license from the list above.
Outside the catalogue, none of this applies — sideloaded poppies are between you and your users, under any license you like. The tiers above are the price of the store shelf, not of the platform.