How AGPL Differs from GPL
The GNU General Public License (GPL) triggers its copyleft obligations when software is distributed — delivered to a user outside your organization. The GPL has a well-known "SaaS loophole": if you use GPL software to run a service but never distribute the software itself, the copyleft obligations do not apply. Many SaaS companies have knowingly or unknowingly benefited from this gap.
The AGPL was designed specifically to close this loophole. Under AGPL Section 13, if you modify AGPL-licensed software and users interact with it over a network — even if you never distribute the software binary — you must make the complete source code of your modified version available to those users. Network interaction is the trigger, not distribution.
What "Interact Over a Network" Means
The AGPL's network use clause covers any scenario where users access the software remotely. This includes web applications, APIs, microservices, and any other networked software component. If your product exposes an endpoint that users hit — even if they cannot see the underlying code — and that endpoint is implemented using AGPL-licensed code, the AGPL may require you to publish your source code.
Real-World Exposure Scenarios
Common AGPL-licensed tools that SaaS companies inadvertently incorporate include: Grafana (monitoring dashboards, AGPL v3), certain MongoDB community edition components, some network analysis libraries, and various scientific computing tools. The risk is particularly acute for transitive dependencies — a AGPL component buried in your dependency graph creates the same exposure as a direct dependency.
Mitigating AGPL Risk
The primary mitigation strategies are: establish an explicit AGPL ban in your license policy and enforce it via automated SCA scanning; where AGPL tools are required for internal tooling (not customer-facing products), implement network isolation to prevent user access; for tools that are essential and have no alternative, evaluate commercial licenses — many AGPL projects (MongoDB, iText, Grafana Enterprise) offer commercial licenses that eliminate the copyleft obligation in exchange for a fee; and maintain continuous automated scanning to catch AGPL components introduced through dependency updates.
Automatically Detect AGPL Risk with Fossity
Fossity — Fossity's license policy engine can automatically flag and block the introduction of AGPL, GPL, and other high-risk copyleft licenses in your CI/CD pipeline. Define your policy once and enforce it on every build — before AGPL exposure reaches production.
Visit Fossity.com →