# Cossistant and the setup-fee clause hiding behind its AGPL tag

> An open source React chat support widget on a Bun and Turborepo monorepo, with a dev command that starts three containers first, a lint script that resolves its own version, and a license that reserves setup fees for a separate grant.

**cossistantcom/cossistant** — Open-source, customer support platform with fully customizable AI support agents for developers / startups shipping SaaS.

- Repository: https://github.com/cossistantcom/cossistant
- Website: https://cossistant.com
- Stars: 728 · Forks: 48
- Language: TypeScript
- License: AGPL-3.0
- Published: 2026-09-10 · Updated: 2026-09-10 · Language: en
- Canonical page: https://hysenlabs.com/projects/cossistantcom-cossistant

## The AGPL tag and the setup-fee clause are different grants

The repository is tagged AGPL-3.0, and the license section in the file says the project is licensed under AGPL-3.0 for non-commercial use. The next heading changes the subject. Commercial use, or deployments requiring a setup fee, are routed to a commercial license request at a named email address rather than covered by the copyleft grant.

A setup fee is not a category of use, it is a category of deployment, so the clause reaches past how you run the code to who arranges the rollout. Anyone self-hosting for a company has to decide whether their deployment is one that requires a fee, and the file offers no test for that. It closes with a single line that puts the burden the other way: by using this software, you agree to the terms of the license. The root also carries SECURITY.md and CODE_OF_CONDUCT.MD, so the governance surface is a normal one; the licensing text is the unusual part.

## bun dev starts with docker compose up

The dev script is the first thing worth reading in this repository, because it is not a command that starts a dev server. It is `sh -c 'docker compose up -d && turbo run dev'`, so containers come up detached and only then does the workspace start.

The compose file defines three services. Postgres is `pgvector/pgvector:pg17` with the user and the password both set to `postgres` and the database named `cossistant`. Redis is `redis:7-alpine`. Both publish their ports to the host, 5432 and 6379, so anything else on the machine already holding those ports collides with a plain dev start. The compose file names no env_file, and every variable it interpolates falls back to an empty string rather than failing, so a missing configuration file produces running containers with blank credentials instead of an error.

## MaxMind keys default to empty and the database refreshes every 24 hours

The third service is the one with a schedule attached. Geoip is built from `./apps/geoip` with its own Dockerfile, listens on 8080 inside the container, and is published to the host as 8083.

Its four variables are all defaulted. `MAXMIND_ACCOUNT_ID` and `MAXMIND_LICENSE_KEY` both default to an empty string, `MAXMIND_EDITION_IDS` defaults to `GeoLite2-City GeoLite2-ASN`, and `GEOIP_UPDATE_INTERVAL_HOURS` defaults to 24. Databases land in `GEOIP_DB_DIR`, which is `/data/geoip` on a named volume, and the healthcheck is a Python one-liner fetching `http://127.0.0.1:8080/health` with urllib on a 30 second interval.

So the container is built to keep two GeoLite databases refreshed every day and to report healthy while doing it, and it is set to start with no MaxMind credentials at all. The shell defaults keep the stack from refusing to boot; they do not tell you whether the database download is actually succeeding.

## One linter is pinned and the other resolves latest on every run

The dependency list pins `@biomejs/biome` at `2.2.6`, an exact version, alongside a `biome.jsonc` config and a `bun.lock`. The script that most people will run first is not that package. `check` is `npx ultracite@latest check` and `fix` is `bunx ultracite fix`.

Two version policies in one repository, and the looser one belongs to the command with no version argument. `npx` and `bunx` both fetch the tool at the tag named in the script, so what `check` reports can change between two runs on two consecutive days without a dependency bump, a commit, or a changelog entry. By contrast `docs:links` pins its checker exactly, at `markdown-link-check@3.11.2`, which makes the gap easier to see: the link checker is versioned and the style checker is not.

## Link checking is pointed at exactly one file

The `docs:links` script runs two things in sequence. First `check:docs-content`, a Bun script at `scripts/checks/docs-content.ts`. Then `npx --yes markdown-link-check@3.11.2 packages/react/README.md --config docs/markdown-link-check.json`.

The file argument is the whole story. That link check covers the React package README and nothing else, even though `docs/` is a top level entry and the root README is dense with links: two npm package pages, a docs site, a Vercel open source program page, a mailto address and a Discord invite. The gate is real, and it is narrow in a way that is easy to miss when reading a repository that appears to have documentation tooling. Nothing in the script walks the rest of `docs/`.

## The publish filter names four targets and three releases exist

`changeset:publish` is the most informative line in the manifest. It runs `check:docs-content`, then `turbo run build` with four filters: `@cossistant/browser...`, `@cossistant/next...`, `@cossistant/protocol...` and `facehash`. Only then does `changeset publish` run.

The published history is three tags, all version 0.3.0, all created on 4 August 2026 within about six minutes of each other: `@cossistant/types@0.3.0`, `@cossistant/react@0.3.0` and `@cossistant/protocol@0.3.0`. Cross the two lists and the mismatch is immediate. Two released packages, types and react, appear in no build filter. Two filter targets, browser and facehash, have never been released under those names. `@cossistant/protocol` is the only name on both sides. There is also a separate `release` script that runs `packages/release/src/index.ts create`, and a `changeset` setup with a `.changeset/` directory and a `@changesets/changelog-github` dependency.

## The Packages list and the release list name different sets

The file's Packages section advertises two npm packages: `@cossistant/react`, described as a React SDK with headless hooks and primitives, and `@cossistant/next`, described as Next.js-specific bindings and utilities. Three packages have actually been released, and only one of those three is in that list.

The Get Started section offers exactly two links, a Quickstart Guide and a Contributors Guide, and both point at cossistant.com/docs rather than at anything in the repository. Meanwhile two runnable examples are checked in, `examples/nextjs-tailwind/` and `examples/react-vite/`, and neither is reachable from the file. The Tech Stack list is the part that tells you what is really there: Turborepo, Bun, React and Next.js, TypeScript, Hono for the API, tRPC, Drizzle ORM, Better Auth, TailwindCSS, WebSockets, and Docker for Postgres and Redis.

## Four working-note files sit in the repository root

A root listing of thirty seven entries includes `AUDIT_DOCS.md`, `findings.md`, `progress.md`, `task_plan.md` and a file named `tinybird-guest-post-cossistant.md`, next to directories for `tinybird/`, `infra/`, `audit/` and a `.tinyb/` folder. Several of those read like the working notes of a tool that was left in the repository rather than documentation a reader was meant to start with.

The enforcement scripts, by contrast, are substantial and wired into the standard commands. `check-types` is a chain of three checks before it reaches the workspace at all: `bash scripts/checks/ai-pipeline-hard-cut.sh`, then `bun scripts/checks/sdk-focused-imports.ts`, then `turbo run check-types`. Add `check:openapi`, `check:browser-embed-size` and `check:docs-content`, and the repository ships five named checks while the entry point most contributors type is one unpinned linter fetch.

## Conclusion

Read the license section before building on this. The repository is tagged AGPL-3.0, and the same file sends commercial use and any deployment requiring a setup fee to a separate commercial license, which is a narrower grant than the tag alone suggests. On the engineering side the facts are concrete: dev will not start without Docker, Postgres and Redis come up on host ports 5432 and 6379 with the password postgres, the MaxMind keys default to empty, and the linter runs at whatever version latest resolves to. All three published packages sit at 0.3.0 from 4 August 2026 while the Packages section advertises a different set, so check npm before pinning anything.

## FAQ

### What is Cossistant?

An open source chat support widget for the React ecosystem, built as a Turborepo monorepo on Bun. It ships headless components and real-time messaging, and the stack list names Hono for the API, tRPC, Drizzle ORM, Better Auth, WebSockets and Docker for Postgres and Redis. Two example apps live under examples/.

### Which Cossistant packages are actually published?

Three releases exist, all at version 0.3.0, all published on 4 August 2026: @cossistant/types, @cossistant/react and @cossistant/protocol. The Packages section of the file names @cossistant/react and @cossistant/next instead, so the advertised list and the published list are not the same set.

### What do you need before running Cossistant locally?

Docker, because the dev script is `sh -c 'docker compose up -d && turbo run dev'` and containers start before the workspace does. The compose file brings up pgvector/pgvector:pg17 on port 5432, redis:7-alpine on 6379 and a geoip service built from ./apps/geoip on port 8083, with POSTGRES_USER and POSTGRES_PASSWORD both set to postgres.

### Can Cossistant be used commercially?

Not on the copyleft grant alone. The license section covers non-commercial use, and sends commercial use or deployments requiring a setup fee to a commercial license request by email. The repository's license field is AGPL-3.0, so the tag and the text do not describe quite the same grant.

## Sources

- [cossistantcom/cossistant on GitHub](https://github.com/cossistantcom/cossistant)
- [License: AGPL-3.0](https://github.com/cossistantcom/cossistant/blob/main/LICENSE)
- [Project website](https://cossistant.com)
- [README](https://github.com/cossistantcom/cossistant/blob/main/README.md)
- [Releases](https://github.com/cossistantcom/cossistant/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/cossistantcom-cossistant