Skip to content

THIRD_PARTY_NOTICES.md

Latest commit

 

History

History
656 lines (516 loc) · 25.2 KB

THIRD_PARTY_NOTICES.md

File metadata and controls

656 lines (516 loc) · 25.2 KB
Raw

Third-Party Notices

This file lists the third-party open-source software incorporated into the Cybernetic Agent Governance Engine (CAGE). It exists to satisfy the attribution requirements of the licenses under which those packages are distributed and to give operators a single place to audit the project's dependency obligations.

Entries are grouped by runtime context and listed alphabetically within each section. Versions shown reflect the ranges declared in pyproject.toml or package.json; exact pinned versions are in uv.lock / package-lock.json.

Last reviewed: 2026-07-02

Python Runtime Dependencies

Packages used by one or more of the Python services (src/gateway, src/governed_financial_advisor, src/compliance_bridge, src/gateway/slm). Declared in pyproject.toml.

aiohttp ≥3.9

anyio ≥4.0

boto3 ≥1.35

cachetools ≥5.5

certifi

click ≥8.0

cryptography ≥48.0

dataclasses-json ≥0.6

dowhy ≥0.12

en-core-web-sm 3.8.0

  • License: MIT
  • Homepage: https://spacy.io/models/en
  • Usage: spaCy English NLP model used by the PII sanitiser for named-entity recognition.

fastapi ≥0.110

flask ≥3.0

frozenlist ≥1.4

google-cloud-storage ≥2.0

googleapis-common-protos ≥1.72

grpcio ≥1.78

  • License: Apache-2.0
  • Homepage: https://grpc.io
  • Usage: gRPC runtime for the NeMo Guardrails bidirectional streaming interface.

httpx ≥0.27

httpx-sse ≥0.4

huggingface-hub ≥1.4

Jinja2 ≥3.1

jsonpatch ≥1.33

jsonschema ≥4.20

langchain ≥1.3.9

langchain-core ≥1.1

langchain-mcp-adapters ≥0.2

langchain-openai ≥0.1

langchain-text-splitters ≥1.1

langgraph ≥1.1

langgraph-checkpoint ≥4.0

langgraph-checkpoint-redis ≥0.3

langgraph-prebuilt ≥1.0

langgraph-sdk ≥0.3

langfuse ≥2.0

  • License: MIT
  • Homepage: https://langfuse.com
  • Usage: LLM observability platform used for trace collection, prompt management, and evaluation datasets.

langsmith ≥0.7

litellm ≥1.0

  • License: MIT
  • Homepage: https://litellm.ai
  • Usage: Unified LLM proxy client providing a single interface to OpenAI, Vertex AI, and other providers.

loguru ≥0.7

lark ≥1.3

mcp ≥0.9

  • License: MIT
  • Homepage: https://modelcontextprotocol.io
  • Usage: Model Context Protocol SDK used by the gateway MCP tool server and infrastructure MCP server.

nemoguardrails ≥0.20,<1.0

nest-asyncio ≥1.6

networkx

  • License: BSD-3-Clause
  • Homepage: https://networkx.org
  • Usage: Graph data structures used by the STPA compiler and causal gatekeeper dependency analysis.

numpy ≥1.26

  • License: BSD-3-Clause
  • Homepage: https://numpy.org
  • Usage: Numerical array operations used by scikit-learn, scipy, and the SLM similarity scorer.

openai ≥1.0

opentelemetry-api ≥1.38

opentelemetry-exporter-gcp-trace

opentelemetry-exporter-otlp ≥1.38

opentelemetry-instrumentation-fastapi ≥0.58b0

opentelemetry-instrumentation-langchain ≥0.52

opentelemetry-instrumentation-requests ≥0.58b0

opentelemetry-sdk ≥1.38

opentelemetry-semantic-conventions-ai ≥0.4

orjson ≥3.9

pandas ≥2.2

  • License: BSD-3-Clause
  • Homepage: https://pandas.pydata.org
  • Usage: DataFrame operations used by the data-analyst agent and evaluation trace analysis.

phonenumbers ≥9.0

pillow ≥11.0

presidio-analyzer ≥2.2.361

presidio-anonymizer ≥2.2.361

protobuf ≥5.26,<7.0

pydantic ≥2.10

pydantic-settings ≥2.0

PyJWT ≥2.0

python-dotenv ≥1.0

python-json-logger ≥2.0

python-multipart ≥0.0.20

python-ulid ≥3.0

PyYAML ≥6.0

  • License: MIT
  • Homepage: https://pyyaml.org/
  • Usage: YAML parsing for OSCAL documents, Lula validation files, and NeMo Guardrails config.

redis ≥5.0

redisvl ≥0.14

regex ≥2026.1

requests ≥2.32

scikit-learn ≥1.4

  • License: BSD-3-Clause
  • Homepage: https://scikit-learn.org
  • Usage: Machine learning utilities used by the confabulation scorer and evaluation pipeline.

sentence-transformers ≥3.0

  • License: Apache-2.0
  • Homepage: https://www.sbert.net
  • Usage: Sentence embedding models used by the SLM sidecar for semantic similarity scoring (Tier-2 symbolic governor).

simpleeval ≥1.0

sniffio ≥1.3

spacy ≥3.8

  • License: MIT
  • Homepage: https://spacy.io
  • Usage: NLP pipeline used by the gateway PII sanitiser for named-entity recognition.

SQLAlchemy ≥2.0

  • License: MIT
  • Homepage: https://www.sqlalchemy.org
  • Usage: ORM used by LangGraph checkpoint backends and NeMo Guardrails conversation history.

sse-starlette ≥1.0

starlette ≥0.37

tenacity ≥9.0

tiktoken ≥0.12

tqdm ≥4.66

  • License: MPL-2.0 AND MIT
  • Homepage: https://tqdm.github.io
  • Usage: Progress bars used by huggingface-hub and fastembed during model downloads.

typer ≥0.21

typing-extensions ≥4.12

urllib3 ≥2.2

uvicorn ≥0.29

  • License: BSD-3-Clause
  • Homepage: https://uvicorn.dev/
  • Usage: ASGI server used to run FastAPI applications in all Python services.

uvloop ≥0.21

websockets ≥13.0

yfinance ≥0.2

JavaScript / TypeScript Dependencies

Packages from src/agentsight-ui/package.json.

ai ^4.0 (Vercel AI SDK)

  • License: Apache-2.0
  • Homepage: https://sdk.vercel.ai
  • Usage: Streaming AI response utilities used by the AgentSight UI to consume gateway SSE streams.

react ^19.2

  • License: MIT
  • Homepage: https://react.dev
  • Usage: UI component library for the AgentSight monitoring dashboard.

react-dom ^19.2

  • License: MIT
  • Homepage: https://react.dev
  • Usage: React DOM renderer for mounting the AgentSight UI into the browser.

zod ^4.3

  • License: MIT
  • Homepage: https://zod.dev
  • Usage: TypeScript-first schema validation used for governance contract types in the UI.

Tooling & Build-time Dependencies

Packages used only during development, testing, linting, or container image builds. Not present in production runtime images.

@vitejs/plugin-react ^5.1 (devDependency)

bcrypt ≥5.0 (dev)

codespell ≥2.2 (lint)

eslint ^9.39 (devDependency)

  • License: MIT
  • Homepage: https://eslint.org
  • Usage: JavaScript/TypeScript linter for the AgentSight UI source.

fakeredis ≥2.35 (dev)

grpcio-tools (build-time)

  • License: Apache-2.0
  • Homepage: https://grpc.io
  • Usage: Protobuf/gRPC code generator used in Dockerfile.nemo to compile nemo.proto into Python stubs.

kfp ≥2.0,<3.0 (dev)

mypy ≥1.15 (lint)

  • License: MIT
  • Homepage: https://mypy-lang.org
  • Usage: Static type checker run in CI against all Python source files.

pip-audit ≥2.10 (dev)

pip-licenses ≥5.0 (dev)

pytest ≥8.3 (dev)

pytest-asyncio ≥0.23 (dev)

respx ≥0.22 (dev)

ruff ≥0.4 (lint)

  • License: MIT
  • Homepage: https://docs.astral.sh/ruff/
  • Usage: Fast Python linter and formatter run in CI (replaces flake8, isort, pyupgrade).

ts-proto ^2.0 (devDependency)

typescript ~5.9 (devDependency)

vite ^7.3 (devDependency)

  • License: MIT
  • Homepage: https://vite.dev
  • Usage: Frontend build tool and dev server for the AgentSight UI.

Infrastructure & Container Images

Third-party container images and services referenced in docker-compose.yml and project Dockerfiles.

ghcr.io/astral-sh/uv (build-time base image)

  • License: MIT AND Apache-2.0
  • Homepage: https://github.com/astral-sh/uv
  • Usage: Ultra-fast Python package manager copied into Python service Dockerfiles to manage venv installation.

nginxinc/nginx-unprivileged:alpine (runtime base image)

node:18-alpine (build-time base image)

  • License: MIT (Node.js) / various (Alpine Linux packages)
  • Homepage: https://hub.docker.com/_/node
  • Usage: Node.js build environment for compiling the AgentSight UI (npm run build).

openpolicyagent/opa:latest-static (service)

python:3.12-slim (runtime base image)

  • License: PSF-2.0 / various (Debian packages)
  • Homepage: https://hub.docker.com/_/python
  • Usage: Base image for the gateway, compliance-bridge, SLM sidecar, and NeMo Guardrails containers.

runai-model-streamer (vLLM image add-on)

runai-model-streamer-gcs (vLLM image add-on)

vllm/vllm-openai:latest (runtime base image)

How to Update This File

  1. After adding or removing a Python dependency in pyproject.toml, run uv sync to update uv.lock, then update the relevant entry in the Python Runtime Dependencies section above.

  2. After adding or removing a Node.js dependency in src/agentsight-ui/package.json, update the JavaScript / TypeScript Dependencies section.

  3. After changing a Docker base image or adding a new service to docker-compose.yml, update the Infrastructure & Container Images section.

  4. To regenerate a raw license table for cross-checking, run:

    uv run pip-licenses --format=markdown --with-urls --with-authors \
    --output-file /tmp/raw-licenses.md

    Then compare the output against this file and reconcile any differences.

  5. Verify SPDX identifiers against https://spdx.org/licenses/ before committing. Do not use informal names such as "BSD License" or "Apache Software License" — use the canonical SPDX identifier (e.g. BSD-3-Clause, Apache-2.0).

  6. Commit changes to this file in the same PR as the dependency change, using a chore(docs): update third-party notices commit message.