GPL-3.0 is strong copyleft: you may use and modify the work freely, and if you distribute it or anything derived from it, the recipients get the complete corresponding source under the same terms. In this catalogue it appears on tooling you would run rather than embed, which is usually why the obligation is tolerable.
Filed under the SPDX identifier GitHub reports for the repository,
not under what the README claims. NOASSERTION means a licence file
exists that GitHub could not match to an SPDX identifier — read it
before you depend on it.
Why NRND: pushed_at = 2025-07-05 — 405 days, inside the 365–1095 day NRND band.
Field
Value at this printing
pushed_at
2025-07-05
archived
false
latest_release
—
license.spdx_id
GPL-3.0
stargazers_count
12800
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/ultrafunkamsterdam/undetected-chromedriver
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why ACTIVE: pushed_at = 2026-07-15 — 30 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-07-15
archived
false
latest_release
—
license.spdx_id
GPL-3.0
stargazers_count
1000
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/Vinyzu/Botright
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why SEMI: pushed_at = 2026-01-28 — 198 days, inside the 90–365 day SEMI band.
Field
Value at this printing
pushed_at
2026-01-28
archived
false
latest_release
—
license.spdx_id
GPL-3.0
stargazers_count
2500
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/QIN2DIM/hcaptcha-challenger
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why ACTIVE: pushed_at = 2026-07-07 — 38 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-07-07
archived
false
latest_release
—
license.spdx_id
GPL-3.0
stargazers_count
1500
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/Danny-Dasilva/CycleTLS
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why ACTIVE: pushed_at = 2026-07-27 — 18 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-07-27
archived
false
latest_release
—
license.spdx_id
GPL-3.0
stargazers_count
445
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/pagpeter/TrackMe
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
The obligation attaches to distribution, not to use
Running a GPL-3.0 program, however commercially, triggers nothing. The obligations attach when you convey the work or a derivative to someone else: complete corresponding source under GPL-3.0, plus installation information for consumer devices, plus the anti-tivoisation and patent provisions that distinguish version 3 from version 2.
That distinction matters for the entries here, because a captcha solver or an automation framework is usually something you run inside your own pipeline rather than something you ship. A library you link into a distributed product is a different calculation entirely.
Reading copyleft beside the state column
This catalogue buckets GPL-3.0, AGPL-3.0, MPL-2.0 and LGPL-3.0 together as copyleft, and the bucket is deliberately coarse: their reach differs enormously and only the licence text settles it. What the bucket is for is filtering, not deciding.
This register reads the identifier from the repository's own licence metadata at the field check, not from a README badge, and prints it exactly as the API returned it.
Questions about the GPL-3.0 entries
Licence questions, answered from the field this register reads and from the licence texts themselves. Nothing here is legal advice.
Can I use a GPL-3.0 anti-detect tool in a commercial project?
Using it internally triggers no distribution obligation at all. Conveying the work or a derivative to a third party requires you to provide the complete corresponding source under the same licence. This register reports identifiers and does not give legal advice.
What is the difference between GPL-3.0 and AGPL-3.0?
AGPL-3.0 adds a network clause: offering modified software to users over a network counts as conveying it, so the source obligation reaches a hosted service where GPL-3.0 does not. Both are filed in the copyleft bucket here and listed separately by identifier.
Why does this registry list the licence at all?
Because it is the field that decides whether you may use what you found, and no other list in this category prints it. A maintenance state tells you whether the code is alive; the licence tells you whether it is yours to use.
Every row above was chosen by somebody who then had to establish two
separate things — whether the code was alive, and whether it was theirs
to use. Donut Browser answers the second in its own repository: an
open-source anti-detect browser under AGPL-3.0, with the desktop
application and the sync server both in that repository, engine-level
fingerprint spoofing through the Wayfern Chromium fork rather than
injected JavaScript, a local REST API and MCP server on your own
machine, zero telemetry, and a pre-launch gate that refuses to start a
profile when the proxy's exit geography contradicts the profile's
fingerprint. Its own licence row is in
this same catalogue, read at the same
field check as everything else.