What is a Copyleft license?

What the condition actually says

Copyleft is a licence shape, not a single licence. The permission is deliberately broad: use it, study it, modify it, run it, copy it, sell it. The condition is attached to one act and one artefact.

The act is conveying. In the GPL family that means distribution, giving the software to someone else. In AGPL it also means letting users interact with it over a network. Everything else you do with the program, including running it for yourself or your own company, is outside the condition.

The artefact is your version of the licensed work. This is the part people get wrong most often. The obligation is to supply the corresponding source of the modified program, not the source of your entire product, and a program that calls a copyleft library as a separate process over a socket is in a materially different position from one that links its code into its own binary. The licence does not draw that line for you, and the drawing is a legal determination about derivation rather than a technical one.

The family differs on scope, which is the axis worth memorising. GPL is strong copyleft on the whole program, triggered by distribution. AGPL adds the network trigger. LGPL is the library exception: you may link a GPL library into a proprietary program provided the library itself remains replaceable, which in practice means you cannot make the modification permanent in the only way a user could not undo. MPL-2.0 is file-level: publish the files you changed, and you may keep the rest of your program closed. EPL is file-level with an extra option, letting you relicense your modified files under a different licence if you make them available as a patch. Weak copyleft is the useful category for the middle, and it is the answer for a company that wants to improve a library without opening its product.

One more feature appears in the names. AGPL-3.0-or-later allows the project to be offered under this version or any successor; a pinned version does not, which is why the suffix is a real decision rather than boilerplate.

Where the boundary sits in practice

The question that generates the arguments is always some version of: is my code a modified version of theirs?

Linking a library into your program. The GPL family says a derivative work inherits the conditions, and the test is a matter of degree rather than a yes or no. Static linking is treated as the strong case. Dynamic linking has been argued both ways and is not settled in every jurisdiction, which is why a licence with an explicit linking exception exists at all.

Running it as a separate process. Talking to a copyleft program over a socket, or calling it as a command, is the strongest position available to a proprietary product, because the two programs are separate works that happen to exchange data. This is a common and widely used arrangement, and it is also the one a court has not blessed in every case.

File-level licences reduce the question. Under MPL-2.0, you publish the files you modified, and the rest of your program stays closed, so the obligation is proportionate by design rather than by argument.

Modifying without distributing. No trigger, because the trigger is the act. This is why a company can patch an AGPL project internally forever without owing anything, and it is also why the first time the modified instance is exposed to a network user the question becomes live.

What copyleft never reaches is the data. If your service processes a customer's records, those records are not a derived work of the licence, and neither is the output your program produces. This is the distinction people most often get wrong in the pessimistic direction, and it is worth stating because it makes many more projects adoptable than the folklore suggests.

When you want it, and when it blocks the plan

Copyleft is a bargain, and it makes sense when the parties to the bargain are people who would otherwise take the improvement and run.

A company that wants contributions back. The reciprocal condition is how a project with maintainers and no marketing budget keeps a dependency improving. This is the logic behind the licence, and it is why a large amount of infrastructure you already use is copyleft without much discussion.

A project whose value is its modification surface. When the point of the software is that people extend it, publishing the extensions is the feature. The projects at the end of this list are mostly of that kind: node graphs, proxy cores, model interfaces, where the improvement is the product.

A funding strategy. Dual licensing works because copyleft creates a market: the copyright holder can grant a permissive licence to those who will pay for it, and the default remains free. A project that wants a commercial option needs the rights holder to hold the copyright, and copyleft is what makes the position coherent.

It blocks a proprietary product that wants to consume the code. If your business model is closed software and you intend to link, a strong copyleft dependency is a genuine obstacle, and the usual answers are the linking exception, the file-level licences, or replacing the dependency.

It blocks a plan to modify and keep the change private. That is the bargain working as designed, and there is no technical workaround; the answers are to not modify, to modify and publish, or to buy a commercial licence where one exists.

It blocks a compliance policy that forbids reciprocal conditions, which is a policy question rather than a legal one, and it is worth handling explicitly rather than discovering in a scan.

The mistakes that get made

Six, in rough order of how often they are repeated.

Believing it is a prohibition. It is not. Nothing in these licences stops you from using the software commercially, and a great deal of commercial software is built on copyleft without the source being published, because the condition is not triggered.

Conflating copyleft with no-claim. Copyleft licences are approved free software. The licences people are usually thinking of are source-available ones, which grant visibility without a reciprocal condition, and confusing the two makes teams reject software that carries no obligation at all.

Assuming a dependency makes your product copyleft. It does not, unless you create a derivative work, and the second condition of the question above is where that gets decided.

Ignoring the dual-licence question. A project that offers a commercial licence is telling you a specific thing: forking it without contributing is a supported scenario, at a price. If that matters to your plan, the price and the terms are worth finding out before you design around the code.

Over-reading the version suffix, or under-reading it. Whether the project is or-later determines whether your downstream offer can move to a successor version.

Treating a copyleft dependency as a technical choice. It is a strategic one. The licence can change, the project can be discontinued, and the thing you built on top of it can become the thing you have to replace.

How the projects use it

The list is a decent cross-section of where the licence shows up in practice, and it clusters by shape rather than by field.

Network services under AGPL. firecrawl/firecrawl is the clearest case: our analysis describes an API that turns URLs into Markdown or structured JSON, shipping a hosted service, a Docker Compose self-host path and an AGPL-3.0 core, and it names the licence as the part most teams underestimate. immich-app/immich is the other, an AGPL-3.0 TypeScript monorepo running a photo and video library on your own hardware with mobile apps that back up automatically, where our analysis also records the README telling you to keep a 3-2-1 backup. rustdesk/rustdesk is a self-hostable remote desktop you point at your own rendezvous and relay server, and our analysis describes the trade as a heavy build toolchain and an AGPL-3.0 licence that follows the code.

Desktop tools under GPL. clash-verge-rev/clash-verge-rev is a GPL-3.0 desktop client that wraps a proxy core in a Tauri interface for Windows, macOS and Linux, and our analysis describes it as a way to get profile merging, system proxy and TUN without editing configuration by hand. 2dust/v2rayN is the same shape, a C# desktop client wrapping other proxy cores, GPL-3.0, shipping prebuilt release archives and leaving deployment details to its own wiki. AUTOMATIC1111/stable-diffusion-webui is a browser interface over a local Python and PyTorch install with an extension system, and our analysis of stable-diffusion-webui places it under AGPL-3.0 and records the last push to master as 2025-02-09. Comfy-Org/ComfyUI is a Python node-graph front end and backend whose analysis puts it under GPL-3.0, with control over every model and parameter traded against assembling the pipeline yourself.

And a corpus. x1xhlol/system-prompts-and-models-of-ai-tools is, per our analysis, a GPL-3.0 collection of leaked and published system prompts from a couple of dozen AI coding tools, useful as a reference corpus rather than as something you install. It is on the list because copyleft applies to text and data as much as to code, and this is a reminder that a licence can cover a collection as easily as a program.

In practice

Copyleft is a grant of freedom with a reciprocal condition attached, and the family differs mainly in how far the condition reaches: the whole program on distribution, the whole program on network use, a library with a linking exception, or the files you changed. The question you actually have to answer is whether your program is a modified version of the dependency, and everything else follows from that. Prefer the weakest licence that achieves the reciprocal bargain you want, because weak copyleft gets contributions without opening your product. Read the licence and the version suffix, find out whether a commercial licence exists before you design around the code, and remember that no copyleft condition reaches your users' data or your program's output.