Why two licenses

The server: AGPL-3.0

Ordinary GPL has a hole exactly the shape of this market. Its obligations trigger on distribution, and a hosted service never distributes anything. Someone could take this server, build a better dashboard on it, sell it as a hosted RMM, and owe nobody a line of source, because their customers only ever touch it over the network. That is not hypothetical: hosted is the default commercial shape of this entire product category.

AGPL closes that hole. If you modify the server and let users interact with it over a network, those users are entitled to your modified source. The improvements come back. That's the deal.

Just as important is who it doesn't burden:

• Run it internally: no obligations. Using AGPL software yourself triggers nothing.
• Host it unmodified for your clients: the source offer is satisfied by pointing at this repository. Done.
• Modify it and host it for others: share your changes. You are the one case the license exists for.

This corner of the ecosystem has already seen the other path: a well-known project reacted to hosting free-riders by moving to a source-available, non-commercial license. That defends the project, but it exits open source entirely, and nothing built on it can ever be open source again. AGPL is the fork in that road where you keep genuine open source and the defense: the free-rider must share, rather than being forbidden to compete.

The agent: Apache-2.0

The agent runs on machines you don't own, and that is exactly where copyleft causes friction without protecting anything. An MSP pushing the agent to a thousand customer endpoints is distributing it, in copyright terms. Under AGPL that raises source-offer questions for any patched build; under Apache-2.0 it raises none. Bake it into golden images, MDM payloads, your own installers, all with no lawyer in the loop.

There's also a gate most endpoint software has to pass that servers don't: legal review before installation. Apache-2.0 is on effectively every corporate approved-license list; AGPL is categorically banned at many organizations. An AGPL agent would stall adoption at precisely the gate that matters most: getting the binary onto fleets.

And AGPL's teeth would bite nothing here anyway. The loophole it closes is hosted-service free-riding, and nobody builds a hosted business on a hoarded fork of a telemetry collector. The risk the strong license defends against simply doesn't live in this half.

Why Apache specifically, over MIT or BSD: the explicit patent grant and retaliation clause. For software that runs with root or SYSTEM privileges on someone else's fleet, that is what corporate counsel wants to see.

The boundary is a wire protocol

The two licenses never entangle because the two halves never link. The agent is its own Go module and talks to the server over a documented NATS subject contract: messages on a wire, not imported code. A protocol is the cleanest license boundary there is: each side can evolve, be replaced, or be reimplemented under any license without contaminating the other. It's also what lets future agent modules, including proprietary ones, exist without touching the server's copyleft.

The DCO makes it permanent

Contributions come in under a Developer Certificate of Origin sign-off, not a CLA. Every contributor keeps their own copyright, which means no entity, including this project, ever accumulates the rights to relicense the commons out from under you. The license can't be pulled, because nobody owns enough of it to pull. If you build a business on Everwas, that permanence is the point.

The choice has already cost us something, which is how you know it's real: telemetry storage uses plain PostgreSQL range partitioning rather than a popular time-series extension, because that extension's license can't ship alongside an AGPL server. We took the constraint. The license is a design input here, not a README ornament.