Open source AI agents: read the licence before the README

"Open source" does not always say what you think

The term has a precise definition, held by the Open Source Initiative, and it is about what the licence permits: using the software for any purpose including commercial, modifying it, and redistributing it. A licence restricting any of those three is not open source, however visible the code.

The nuance looks theoretical until the day it decides what you may charge for. Take the most common case in French automation: n8n. The repository states "n8n is fair-code distributed under the Sustainable Use License and n8n Enterprise License". Source available, self-hostable, extensible. And not OSI-approved, because the fair-code model deliberately sits between open source and proprietary: the source stays readable, certain commercial uses are not open.

That does not make n8n a bad choice, and an SME self-hosting it for its own flows will probably never meet the limit. But an agency reselling n8n hosting to its clients has a licence question, not a technical one. It is the first thing to read, before the features.

The habit that avoids most surprises: open the repository's licence file and look for the exact name. MIT and Apache 2.0 raise no questions. A name you do not recognise, containing "sustainable", "fair", "business source" or "commons clause", earns ten minutes of reading.

Four projects, checked at the source

This table does not rank, it situates. The licences were read on the repositories themselves on 3 August 2026, because this is exactly the kind of fact people copy from memory after it has changed.

Three of the four are MIT, so no question to ask. The fourth is the only one in the group that is not open source in the OSI sense, and it is also the one the French market most often cites as such.

A second column deserves attention, the paid offering. An MIT project backed by a commercial product is not suspicious, it is the healthiest business model in the sector. What matters sits elsewhere: which functions live on the paid side, and whether the ones you need are among them. Observability and governance, at LangGraph as at CrewAI, are on the product side. On Hermes Agent there is no product side at all, which means someone has to build those pieces.

Disclosure, since the table above contains a project we deploy: kengdev sells the installation and operation of Hermes Agent under the name Hermes. The software is free and downloadable, and a team with ops has no reason to pay us for that.

The real cost is not in the licence

A zero-euro licence moves the bill, it does not remove it. Four lines make it up, and the first weighs more than the other three combined as soon as the agent genuinely runs.

• Tokens. An autonomous agent consumes without anyone watching. A scheduler firing a task every hour produces a bill while you sleep, and that is the line behind most first-month surprises.
• Hosting. Modest in absolute terms, five to twenty euros a month for personal use, more as soon as availability matters. On architectures that hibernate between sessions, cost follows usage rather than the calendar.
• Operations. Updates, secrets, backups, monitoring. That is human time, and it is the line comparisons forget because it appears on no pricing grid.
• Recovery after an incident. An agent writing into your business tools can get it wrong. What it costs to undo depends entirely on what you put in place beforehand, not on the project you picked.

Those four lines exist whatever the licence. Which is why "how much does it cost" has no answer until you have said what the agent does, how often, and who repairs it.

Choosing on what you already have

The useful question is not which project is best, it is which one fits the team and the need. Here is the grid we apply during scoping.

The fourth line is the expensive one to discover late, because it is settled before the contract rather than after.

The last one is not a sales argument in disguise. An agent writing into business tools with nobody watching its actions is an incident waiting to happen, whether you deployed it yourself or had it deployed.

Three reading traps

Star count says nothing about maintenance. A repository with a hundred thousand stars may have three commits in six months, and one with two thousand may move every week. Look at the last commit date and the release rhythm, not the social counter.

A fast-moving project costs time to follow. It is a quality and a burden at once. On a repository shipping weekly, updating becomes a recurring task rather than an event, and you have to decide immediately who owns it.

"Self-hostable" and "open source" are not synonyms. Plenty of source-available projects are perfectly self-hostable while restricting certain commercial uses. The two properties are checked separately, and the second one decides what you may charge for.