Open Source Licenses - FrankenCoder

Statement of Composition. FrankenCoder is built by CeardTech LLC. The product is closed-source under a proprietary commercial license, but it incorporates a number of open-source software components, each subject to its own license terms. This page lists those components and links to their canonical sources.

The major systems that make FrankenCoder distinctive — the AI agent orchestrator, the automatic pipeline, the Blink chat virtualizer, the Cyber Watcher, the Reverse Engineering Toolbox, the FrankenDebug debugger, the FC-Embed hybrid search engine, the fc-uia Windows UI Automation bridge, the fc-hub system-tray service, the agent daemon, the JVM/CIL decompilers, the GPU chat renderer, the Deep Research engine, the Node Agent canvas, the Database Viewer, and the Visual Browser Editor — are original work owned by CeardTech LLC and are not open source.

The open-source dependencies below are leveraged for their well-tested primitives (HTTP, runtimes, ML inference kernels, fonts) so that the FrankenCoder team can spend its time on the product, not on reinventing TCP.

Base Platform
Local AI Inference Stack (FC-Inference)
Search, Indexing & Tokenization
VS Code-Bundled Dependencies (inherited)
Major npm Runtime Dependencies (FrankenCoder additions)
Rust Crates (fc-hub, fc-uia, fc-watcher, frankendebug, fc-inference, fc-installer)
Mobile Companion App (FrankenRemote)
Installer-Bundled Tools
What Is NOT Open Source
ToS / EULA Reference Notice
Release Compliance Checklist
Maintenance & Changelog

1. Base Platform

Visual Studio Code MIT

Source: https://github.com/microsoft/vscode

Role: FrankenCoder is built on top of the VS Code source tree (the local-ide/ directory in our repository is a fork). The window-management, editor, terminal, multi-diff editor, scroll-locking, language-detection, output panel, extension API, walkthrough, accessibility-signal, and welcome-page subsystems all originate from VS Code and remain under MIT license.

Notice required: Microsoft Corporation MIT copyright notice ships in the LICENSE.txt at the root of the IDE installation.

Electron MIT

Source: https://github.com/electron/electron

Role: Cross-platform desktop application runtime.

Version: 37.3.1 (as declared in VS Code's component manifest).

Chromium BSD-3-Clause

Source: https://www.chromium.org

Role: The browser engine inside Electron. Renders every FrankenCoder window, including the built-in browser and the visual browser editor.

Version: 138.0.7204.100 (as bundled in Electron 37.3.1).

Node.js MIT (+ OpenSSL / ICU sub-licenses)

Source: https://github.com/nodejs/node

Role: JavaScript runtime for the main process, agent-daemon, and node-based extensions.

Version: 22.17.0

FFmpeg LGPL-2.1-or-later (Electron-stripped, LGPL-only build)

Source: https://ffmpeg.org

Verified path: FrankenCoder-win32-x64/ffmpeg.dll (~2.9 MB, ships in the install root next to FrankenCoder.exe).

Role: FFmpeg is not directly called by any FrankenCoder code. It is bundled automatically by Electron 37.3.1 because Chromium's media stack uses it for HTML5 <video> / <audio> decoding, the MediaRecorder API, and getUserMedia. The binary rides along with Electron regardless of whether FrankenCoder exposes media features.

Stripped LGPL-only build: The ffmpeg.dll Electron ships is intentionally built without GPL-licensed components and without patent-encumbered codecs (most notably H.264 / AAC). FrankenCoder inherits only LGPL obligations, not GPL obligations and not codec-patent royalty exposure. FrankenCoder ships this stripped DLL verbatim with no modifications.

LGPL-2.1+ obligations and how we satisfy them:

Attribution. Acknowledge that FrankenCoder uses FFmpeg and that FFmpeg is LGPL-licensed. Satisfied by this page and by the in-app Help → Open Source Notices screen.
License text inclusion. Ship the LGPL-2.1 license text and the FFmpeg copyright notice with the product. Satisfied by the bundled license files in the install root and by the in-app Help → Open Source Notices viewer.
Modification rights notice. Users have the right to modify the LGPL library and FrankenCoder permits replacing it. See "User right to modify or replace" below.
No additional restrictions. The FrankenCoder EULA's restrictions apply only to FrankenCoder's own proprietary components, not to the bundled LGPL libraries. FFmpeg specifically remains under LGPL-2.1+ for the recipient.

User right to modify or replace. Users may compile their own LGPL-compliant FFmpeg of the same ABI (the Chromium-pinned FFmpeg API for Electron 37.3.1) and drop it in as a replacement for the bundled ffmpeg.dll. FrankenCoder does not statically link FFmpeg, does not check its hash at runtime, and does not refuse to load when it is replaced. We do not modify FFmpeg; the binary is the upstream Electron-pinned build verbatim.

Microsoft Edge WebView2 Microsoft Edge WebView2 SDK License

Source: https://developer.microsoft.com/en-us/microsoft-edge/webview2/

Role: Used by the FrankenCoder installer (FrankenCoderSetup.exe) to render the welcome/setup UI on Windows.

Note: This is a proprietary Microsoft component, redistributable under its own license terms. Attribution is required.

2. Local AI Inference Stack (FC-Inference)

FrankenCoder ships a complete local LLM / image / speech stack in local-ide/fc-inference/. The Rust shell, OpenAI-compatible HTTP server, model-management UI, vision pipeline, multi-service orchestrator, and the embedding/cost/tokenization layers are all original work. The inference kernels are these open-source projects, vendored as pre-built binaries in llama_bin/, llama_cuda/, sd_bin/, and whisper_vulkan/:

llama.cpp MIT

Source: https://github.com/ggerganov/llama.cpp

Author: Georgi Gerganov

Role: The LLM inference backend. Powers every local text-generation call in fc-inference. Provides GGUF loading, KV-cache, sampling, and the CPU / CUDA / Vulkan / Metal compute kernels.

Bundled binaries: local-ide/fc-inference/llama_bin/ (CPU + Vulkan), local-ide/fc-inference/llama_cuda/ (NVIDIA CUDA).

whisper.cpp MIT

Source: https://github.com/ggerganov/whisper.cpp

Author: Georgi Gerganov

Role: Speech-to-text inference for the audio transcription endpoint (/v1/audio/transcriptions).

Bundled binary: local-ide/fc-inference/whisper_vulkan/

stable-diffusion.cpp MIT

Source: https://github.com/leejet/stable-diffusion.cpp

Author: leejet

Role: Image-generation inference for the OpenAI-compatible /v1/images/generations endpoint. Supports SD 1.5, SDXL, and Flux models.

Bundled binary: local-ide/fc-inference/sd_bin/

Candle Apache-2.0 OR MIT

Source: https://github.com/huggingface/candle

Author: Hugging Face

Role: Rust ML framework. We use a fork with Blackwell (RTX 50-series) support for the CUDA inference path on newest NVIDIA cards.

Path: local-ide/fc-inference/vendor/candle/

HuggingFace `tokenizers` Apache-2.0

Source: https://github.com/huggingface/tokenizers

Role: Tokenization for non-OpenAI / non-Anthropic models in the local-inference path.

ggml MIT

Source: https://github.com/ggerganov/ggml

Role: The tensor library underneath llama.cpp, whisper.cpp, and stable-diffusion.cpp. Distributed as part of those binaries.

3. Search, Indexing & Tokenization

ripgrep MIT (Unlicense alternative)

Source: https://github.com/BurntSushi/ripgrep

Author: Andrew Gallant ("BurntSushi")

Role: The high-speed text-search backend behind the grep tool, the in-editor Find-in-Files, and many agent investigation flows. Bundled as a native binary.

tiktoken / tiktoken-rs MIT

Source: https://github.com/openai/tiktoken (Python), https://github.com/zurawiki/tiktoken-rs (Rust binding)

Role: OpenAI's BPE tokenizer. Used in our cost-tracking calibration harness and live token estimation to keep our pre-flight token counts within 99.9% of provider-reported counts.

HNSW (`hnswlib`-style implementation) Apache-2.0 / MIT

Source: https://github.com/nmslib/hnswlib (reference)

Role: The HNSW vector-index portion of FC-Embed uses HNSW algorithmic design (the underlying technique is well-published; our Rust implementation re-uses standard parameters and tuning from the open literature). The FC-Embed implementation itself is our own code.

Note. FC-Embed's HNSW + BM25 with Reciprocal Rank Fusion pipeline is original Rust code, but the algorithms (HNSW, BM25, RRF) are public-domain academic algorithms.

4. VS Code-Bundled Dependencies (inherited from the upstream)

These ship with VS Code itself and therefore ship with FrankenCoder. The full list is in our build-time cgmanifest.json; the headliners are below:

Component	License	Purpose
vscode-codicons	MIT + CC-BY-4.0 (icon glyphs)	The codicon font and SVG set used throughout the UI
spdlog	MIT	C++ logging library
@iktakahiro/markdown-it-katex	MIT	KaTeX integration for the Markdown renderer
@vscode/win32-app-container-tokens	MIT	Windows app-container token utilities
cacheable-request	MIT	HTTP request caching
@parcel/watcher	MIT	File-system watcher
@microsoft/1ds-core-js, @microsoft/1ds-post-js	MIT	Microsoft telemetry SDK (FrankenCoder ships with telemetry disabled by default)
mdn-data, @mdn/browser-compat-data	CC0-1.0	MDN reference data for language services
@electron/remote	MIT	Electron renderer / main IPC helpers

5. Major npm Runtime Dependencies (FrankenCoder additions)

AI Provider SDKs

Component	License	Source
@anthropic-ai/sdk	MIT	anthropic-sdk-typescript
openai (Node SDK)	Apache-2.0	openai-node
@google/generative-ai	Apache-2.0	generative-ai-js
@ai-sdk/anthropic, @ai-sdk/openai (where used)	Apache-2.0	vercel/ai

Chat-Rendering Libraries (verified bundled)

This list is the complete set of third-party libraries the chat actually loads. The diagram, chart, graph, JSON-tree, CSV, GeoJSON, math-plot, color-swatch, multifile-preview, link-preview, and live-HTML renderers are all in-house CeardTech code — see "Homegrown Chat Renderers" below.

Component	License	Purpose
marked.js (VS Code's bundled copy)	MIT	The Markdown→HTML parser that turns every agent message into HTML. Loaded via `MarkedKatexSupport.loadExtension()`.
KaTeX	MIT	LaTeX math rendering ( $inline$ , `$$display$$`). Inherited verbatim from VS Code's `markdown-math` extension.
@iktakahiro/markdown-it-katex v4.0.2	MIT	KaTeX bridge for VS Code's `markdown-math` extension. Source: markdown-it-katex
markdown-it	MIT	Markdown parser used by the agent-daemon (not the chat pane). Source: markdown-it
Pyodide 0.29.3	MPL-2.0	In-browser CPython runtime that powers the `live-python` fence. Vendored (~470 MB across ~360 files, SHA-256 manifest hash-locked). Source: pyodide
React 18.3.1	MIT	Vendored (base64-inlined, SHA-256 verified at load). Loaded into the `live-html` preview iframe when the agent's HTML uses JSX/React.
Vue 3.5.33	MIT	Vendored (base64-inlined, SHA-256 verified at load). Loaded into the `live-html` preview iframe when the agent's HTML uses Vue templates.

Note. Earlier drafts of this document listed chart.js, d3, @viz-js/viz, and highlight.js. None of those packages are bundled. They were removed after source verification (no imports, no node_modules entries, no manifest paths). The flowchart, chart, and DOT/graphviz fences are rendered by our own renderers — see "Homegrown Chat Renderers" below.

Homegrown Chat Renderers (CeardTech LLC — closed-source, zero external deps)

The following fenced-block renderers are 100% original CeardTech LLC code and ship with no third-party runtime dependencies (no Chart.js, no D3, no Graphviz WASM, no highlight.js):

Fence	Renderer	What it is
FrankenGrams (flowcharts)	FrankenGramsRenderer (5,531 lines)	Custom flowchart parser + Sugiyama-lite layered SVG layout. No upstream diagram-library code. "Zero external dependencies."
```chart	ChartRenderer (709 lines)	Hand-rolled DSL → SVG. Bar / line / pie / scatter. "Zero external dependencies. Pure TypeScript."
```dot, ```graphviz	DotRenderer (342 lines)	DOT-subset parser, reuses the FrankenGrams Sugiyama layout. "No Graphviz binary, no WASM, no network round-trip."
```json-tree	JsonTreeRenderer	Collapsible JSON viewer.
```csv	CsvRenderer	Sortable HTML table.
```geojson	GeoJsonRenderer	Geographic feature map.
```mathplot	MathPlotRenderer (794 lines)	Math-expression parser + SVG plotter. "Zero external dependencies. Pure TypeScript."
```colors	ColorSwatchRenderer	Color-palette swatch grid.
```multifile	MultiFilePreviewRenderer (338 lines)	Multi-file labeled-tab static preview. "Zero external dependencies."
```live-html	previewRenderer.ts + jsxTransformer.ts	Sandboxed iframe HTML/CSS/JS preview with React/Vue auto-detection. The iframe uses vendored React/Vue (above); the orchestrator, JSX transformer, detector, security policy, and controls are original.
(auto-link enhancement)	LinkPreviewRenderer	Bare-URL detection + async metadata fetch + skeleton-card insertion (post-processes marked.js output, which doesn't auto-linkify under GFM).

These renderers are closed-source original work of CeardTech LLC — they are not derived from, do not embed, and are not encumbered by Chart.js, D3, Graphviz, or any other open-source diagram/chart library.

Storage / Database

Component	License	Purpose
better-sqlite3	MIT	Synchronous SQLite bindings for Node — used by the Database Viewer and agent storage
SQLite (via better-sqlite3 and via the Rust rusqlite crate's bundled SQLite)	Public Domain	The database engine itself

6. Rust Crates (fc-hub, fc-uia, fc-watcher, frankendebug, fc-inference, fc-installer)

All Rust crates listed below are dual-licensed MIT OR Apache-2.0 unless otherwise noted. Both licenses are permissive and only require attribution.

fc-hub (system-tray service, scheduler, updater)

tokio, reqwest, axum, tower, tower-http, tray-icon, tao, image, notify-rust, uuid, serde, serde_json, sha2, hex, zip, tracing, tracing-subscriber, tracing-appender, chrono, time, cron, rusqlite (bundled SQLite — public-domain SQLite + MIT bindings), dirs, anyhow, thiserror, clap, rand, base64, futures-util, bytes, once_cell, parking_lot, windows (windows-rs), winreg, tauri-winrt-notification, nix, embed-resource.

Notable:

tauri-winrt-notification (MIT) — persistent Windows toast notifications with action buttons (used by Cyber Watcher threat alerts).
rustls (transitively, via reqwest) is ISC / MIT / Apache-2.0 triple-licensed.

fc-uia (Windows UI Automation bridge for computer-use tools)

uiautomation (MIT), serde, serde_json, tracing, tracing-subscriber, anyhow, thiserror, clap, once_cell, parking_lot, windows (windows-rs), embed-resource.

fc-watcher (Cyber Watcher native sidecar)

Rust telemetry collector with windows-rs (MIT/Apache-2.0) for ETW, WMI, and Win32 process/network APIs. (Detailed crate list in fc-watcher/Cargo.toml.)

frankendebug-core (debugger primitives)

serde, serde_json, thiserror, log, windows-sys (Win32 debug APIs), nix (Linux ptrace), libc. All MIT or MIT-OR-Apache-2.0.

Reminder. The FrankenDebug debugger itself — the breakpoint engine, the stepping primitives, the hardware-watchpoint fallback, the multi-arch disassembly orchestration, the JSON-line protocol — is original work by CeardTech LLC and is closed-source. Only the underlying Rust standard-library and Win32-API binding crates listed here are open source.

fc-inference (Rust shell around the inference kernels)

tokio, axum, tower, reqwest, serde, serde_json, tracing, clap, anyhow, thiserror, chrono, rusqlite, etc. Plus the kernel binaries listed in section 2.

frankencoder-installer (fc-installer)

Rust + Electron installer with Inno Setup integration. See section 1 for Electron, plus standard Rust crates per its Cargo.toml.

7. Mobile Companion App (FrankenRemote)

FrankenRemote is a React Native + Expo mobile app. Its runtime dependency tree includes:

Component	License	Purpose
React Native	MIT	Cross-platform mobile runtime
React	MIT	UI library
Expo SDK	MIT	Mobile tooling / runtime
react-native-reanimated	MIT	Animation runtime
react-native-gesture-handler	MIT	Gesture handling
@react-navigation/*	MIT	Navigation

FrankenRemote ships as a separate APK/IPA — its third-party notice file is bundled inside the app.

8. Installer-Bundled Tools

Component	License	Purpose
Inno Setup	Custom (Jordan Russell) — free for any use including commercial	Windows installer compiler. Distributed binaries only.
7-Zip extras (7z-extra)	LGPL-2.1 + unRAR restriction	Archive extraction during install
WebView2 Runtime	Microsoft Edge WebView2 License	Renders the installer UI on Windows

9. What Is NOT Open Source

The following are original, closed-source works of CeardTech LLC and are not covered by any of the open-source licenses above:

The FrankenCoder agent orchestrator — Planner, Prepper, Executor, Reviewer, Beta-Tester, Security, Documentation, Refactor, Troubleshooter, Researcher, Node, Browser, Cyber, and RE agents; all prompts; the automatic pipeline; the agent-bridge mechanism; delegateTask / parallelDispatch infrastructure.
FrankenDebug — the entire debugger: core, server, protocol, breakpoint engine, hardware-watchpoint fallback, stepping primitives, multi-arch disassembler integration.
The Reverse Engineering Toolbox — the JVM decompiler engine, the .NET / CIL emitter, the IL lifter, the C# emitter, the re-bridge tool surface, and the panel-based RE workflow.
The Cyber Watcher and Cyber Tools (fc-watcher, the 40+ cyber_* tools, the WMI integration, the watcher control plane, the threat-detection rules).
The Blink chat virtualizer (VirtualMessageListBlink / blinkLayout) — the entire CPU-sequential layout pipeline, the height predictor, the height observer, the index, and the React integration.
The GPU Chat Renderer (WebGPU compositor, worker pipeline, glyph atlas).
All chat-fence renderers except markdown and math — FrankenGramsRenderer (flowcharts), ChartRenderer, DotRenderer, MathPlotRenderer, JsonTreeRenderer, CsvRenderer, GeoJsonRenderer, ColorSwatchRenderer, MultiFilePreviewRenderer, LinkPreviewRenderer, previewRenderer.ts + jsxTransformer.ts (live-html iframe orchestrator). These are zero-dependency original works.
FC-Embed (the FrankenCoder native hybrid search engine — HNSW + BM25 + RRF; the algorithms are public-domain, our implementation is not).
fc-uia RPC server logic, fc-hub service host logic, fc-watcher rule engine — original Rust code wrapped around open-source crates.
The Deep Research engine, Document Intel, Intel Center, Taskmaster, Node-Canvas, Database Viewer, Visual Browser Editor, Checkpoints, Notepad, and Community Hub.
The cost-tracking calibration system (the per-provider empirical harness, the strategy-router factor model, the calibration data).
The context-bar telemetry, performance HUD, and inter-process telemetry pipeline.
All system prompts for all agents.
The fc-inference Rust server (the kernels are open source; the orchestration around them is not).

10. ToS / EULA Reference Notice

The FrankenCoder Terms of Service and End User License Agreement reference this page as the canonical, evergreen list of open-source components. The clause reads, in substance:

Open Source Software Notice. The Software incorporates open source software components, each subject to its own license terms. A complete list of open source components and their licenses is accessible from within FrankenCoder via Help → Open Source Notices, and is also published online at:

https://frankencoder.com/legal/open-source-licenses

Copies of the MIT, Apache-2.0, BSD-3-Clause, LGPL-2.1, MPL-2.0, and other applicable license texts are accessible from the in-app Help → Open Source Notices viewer.

11. Release Compliance Checklist

This is the action list when cutting a release. It is published here so users and downstream auditors can verify the compliance posture of any specific FrankenCoder build:

LICENSE.txt (FrankenCoder proprietary) is in the installed app root.
Help → Open Source Notices menu item is wired to surface the full third-party notice content (component list, sources, license names, and the full license text for each license used).
FrankenRemote APK/IPA bundles its own third-party notice file (separate dependency tree from the desktop app).
The installer surfaces the FrankenCoder EULA on first run, with a link to the open-source notices.
FFmpeg LGPL-2.1+ compliance:
- ffmpeg.dll is the dynamic-link, separate-file form (next to FrankenCoder.exe, not statically linked into our code) — preserves the LGPL "user can swap the library" right.
- Attribution: the FFmpeg entry in section 1 is reproduced verbatim in the in-app Help → Open Source Notices viewer.
- License text: the full LGPL-2.1 license text is shipped at licenses/LGPL-2.1.txt (or equivalent) in the install root, and the FFmpeg upstream COPYING.LGPLv2.1 notice is preserved.
- Modification-rights notice: the FFmpeg "User right to modify or replace" paragraph is reachable from the in-app Help → Open Source Notices screen.
- No additional restrictions: the EULA scopes its restrictions to FrankenCoder's own proprietary components and does not apply them to bundled LGPL libraries.
- The shipped DLL is the Electron-stripped LGPL-only build (no GPL components, no patent-encumbered codecs).
The public website hosts the canonical, evergreen copy of this document at the URL referenced in the EULA.

12. Maintenance & Changelog

This document is maintained by CeardTech LLC.

When a new open-source dependency is added (a new npm package in any package.json dependencies block, a new Rust crate in any Cargo.toml, a new vendored binary in local-ide/fc-inference/ or any assets/ folder, or a new bundled font/icon set): it is added here in the matching section.
When a dependency is removed: marked removed and dated in git history; entries are not silently deleted.
When upgrading the VS Code base: the section 4 table is re-synced from the upstream cgmanifest.json.

Last reviewed: 2026-05-13.

Changelog

2026-05-13 (verification pass):
- Removed chart.js, d3, @viz-js/viz, and highlight.js from section 5 — none of these packages are bundled. Source verification: no imports, no node_modules entries, no entries in any installed-manifest hash list.
- Confirmed section 5 entries are the complete list of chat-rendering third-party dependencies: marked.js (VS Code's bundled copy), KaTeX (from extensions/markdown-math/), @iktakahiro/markdown-it-katex (in cgmanifest, transitive of markdown-math), markdown-it (used by the agent-daemon, not the chat pane), Pyodide 0.29.3, React 18.3.1, Vue 3.5.33.
- Added explicit list of homegrown chat renderers (FrankenGrams / Chart / Dot / MathPlot / JsonTree / Csv / GeoJson / ColorSwatch / MultiFilePreview / LinkPreview / live-html orchestrator) with file paths and "zero external dependencies" file-header citations.
- React and Vue are vendored as base64-inlined source inside vendoredReact.ts / vendoredVue.ts with SHA-256 integrity verification at load (not loaded from CDN at runtime).
- Pyodide is vendored as a 470 MB asset tree with SHA-256 manifest hash-locking (not fetched at runtime).
- FFmpeg verified shipped: FrankenCoder-win32-x64/ffmpeg.dll (2.9 MB) is present in the packaged output tree. Bundled by Electron 37.3.1 (not by any FrankenCoder code) and required by Chromium's media stack. Confirmed it is the Electron-stripped LGPL-only build — no GPL components, no patent-encumbered codecs — so FrankenCoder inherits LGPL obligations only.

Reporting a compliance issue. If you believe FrankenCoder is not satisfying an obligation imposed by an upstream open source license — missing attribution, missing license text, modified component without notice, or anything else — please email [email protected] with the component name and a description of the issue. We will investigate and correct in the next release.

Open Source Components in FrankenCoder

Contents