AGPL-3.0 is GPL-3.0 with one addition that changes everything about how it applies to services: if you let users interact with a modified version over a network, they are entitled to its complete corresponding source. It closes the gap that lets a hosted product build on copyleft code without ever distributing it.
Filed under the SPDX identifier GitHub reports for the repository,
not under what the README claims. NOASSERTION means a licence file
exists that GitHub could not match to an SPDX identifier — read it
before you depend on it.
Anti-detect browser and profile manager. Ships the Wayfern Chromium fork, which spoofs at the engine level over CDP rather than by patching JavaScript, plus a local REST API and MCP server on the user's own machine.
Why ACTIVE: pushed_at = 2026-08-12 — 2 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-08-12
archived
false
latest_release
v0.29.3 · 2026-08-12
license.spdx_id
AGPL-3.0
stargazers_count
3600
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/zhom/donutbrowser
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Both halves are in the repo — the desktop app and the sync server — under AGPL-3.0, and a grep of src/, src-tauri/src and the manifests finds no analytics SDK. Twelve releases between 2026-03-24 and 2026-08-12. Its README's claim about not being detected by named vendors is unsupported by anything in that repo; ignore it and judge the fields. — ED.
Why SEMI: pushed_at = 2026-05-13 — 93 days, inside the 90–365 day SEMI band.
Field
Value at this printing
pushed_at
2026-05-13
archived
false
latest_release
none published
license.spdx_id
AGPL-3.0
stargazers_count
4700
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/ultrafunkamsterdam/nodriver
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Under GPL-3.0 the source obligation is triggered by conveying a copy. A company running modified GPL code entirely on its own servers conveys nothing and owes nothing. Section 13 of AGPL-3.0 treats remote network interaction as the trigger instead, so a hosted service built on AGPL code has to offer that source to its users.
That is why the licence appears where it does. A project choosing AGPL-3.0 is usually making a deliberate statement about not wanting to become the unpaid engine of somebody else's SaaS, and reading it as merely a stricter GPL misses the intent.
What it means for you as an adopter
Running it yourself, unmodified, for your own purposes, triggers nothing. Modifying it and exposing it to users over a network does. Embedding it in a product you distribute does. The decision therefore turns on your deployment shape rather than on whether money changes hands.
This register reads the identifier from the repository's own licence metadata at the field check, not from a README badge, and prints it exactly as the API returned it.
Questions about the AGPL-3.0 entries
Licence questions, answered from the field this register reads and from the licence texts themselves. Nothing here is legal advice.
What does AGPL-3.0 require that GPL-3.0 does not?
That users interacting with a modified version over a network be offered its complete corresponding source. GPL-3.0 attaches its source obligation to conveying a copy, which a purely hosted deployment never does.
Can I use AGPL-3.0 software inside my company?
Internal use of an unmodified version triggers nothing. Modifying it and offering it to users across a network does, as does distributing it. This register reports the identifier the repository declares and gives no legal advice.
Why is Donut Browser under AGPL-3.0?
That is the licence its repository declares, read at the field check like every other row here, and the desktop application and the sync server are both in that repository. This register prints the identifier; the reasoning behind the choice belongs to the project, not to this catalogue.
Every row above was chosen by somebody who then had to establish two
separate things — whether the code was alive, and whether it was theirs
to use. Donut Browser answers the second in its own repository: an
open-source anti-detect browser under AGPL-3.0, with the desktop
application and the sync server both in that repository, engine-level
fingerprint spoofing through the Wayfern Chromium fork rather than
injected JavaScript, a local REST API and MCP server on your own
machine, zero telemetry, and a pre-launch gate that refuses to start a
profile when the proxy's exit geography contradicts the profile's
fingerprint. Its own licence row is in
this same catalogue, read at the same
field check as everything else.