An AI project with public source code is only usable if its repository says what the code may be used for. PyTorch, scikit-learn, TensorFlow, Hugging Face Transformers, and llama.cpp all publish their code under permissive licenses (BSD-style, Apache 2.0, or MIT), but the license covers the code, not necessarily the trained models that run on it. Checking the license file, the redistribution conditions, and who maintains the project takes about ten minutes and prevents most later problems.
Key takeaways
- A public repository without a license file grants no right to copy, modify, or redistribute the code under default copyright law.
- BSD-3-Clause, Apache 2.0, and MIT all allow commercial use, but each attaches different notice duties, and Apache 2.0 adds an explicit patent grant.
- Code license and model license are separate documents: llama.cpp is MIT-licensed, while the weights a user loads into it carry their own terms.
- Loading a model file in Python's pickle format can run code, which is why the PyTorch documentation says never to load data from an untrusted source.
- Star counts say little about upkeep; release history, review practices, and a named governing body say more.
Five well-known projects and the license each one declares
The table lists what each repository declared when checked on October 27, 2026. It is a reading aid, not a ranking: the five projects do different jobs and none is presented as better than another.
| Project | What it does | License shown on GitHub | Detail worth knowing |
|---|---|---|---|
| PyTorch | Deep learning framework | BSD-style (GitHub labels it "Other") | The LICENSE file lists several copyright holders, among them Facebook, DeepMind Technologies, NYU, and Kakao Brain |
| scikit-learn | Classical machine learning in Python | BSD-3-Clause | Started in 2007 as a Google Summer of Code project |
| TensorFlow | Deep learning framework | Apache 2.0 | Carries the Apache patent grant |
| Transformers | Library of model definitions for text, vision, and audio | Apache 2.0 | Works with PyTorch 2.6 or newer |
| llama.cpp | Runs language models on ordinary hardware | MIT | The MIT license covers the program, not any model |
PyTorch shows why a badge on a repository page is only a starting point. GitHub's automatic detection could not match its license file to a single standard text, because the file combines notices from the original PyTorch authors and from the Caffe2 project. The terms still follow the three-condition BSD pattern, so a reader has to open the file itself.
What the common licenses ask of a user
The three conditions of the BSD 3-Clause License are short. Source redistributions keep the copyright notice, the conditions, and the disclaimer. Binary redistributions reproduce the same text in documentation. The names of the copyright holders cannot be used to endorse a derived product without written permission. A company that ships an app built on scikit-learn therefore has to carry a notice, and it cannot imply that INRIA or the project endorses the app.
The Apache License 2.0 asks for more paperwork and gives more in return. Redistributors must hand over a copy of the license, mark files they changed, keep notices, and pass along any NOTICE file. In section 3, each contributor grants a perpetual, worldwide, royalty-free patent license for their own contributions. If a user starts patent litigation claiming that the work infringes a patent, the patent licenses granted to that user end on the filing date. MIT, used by llama.cpp, is the shortest of the group and asks mainly that the copyright and permission notice stay with copies.
When a repository has no license at all
GitHub's documentation on licensing a repository states that without a license, default copyright law applies. The author keeps all rights, and nobody else may reproduce, distribute, or make derivative works. Viewing and forking a public repository is allowed by the platform's terms of service, but that is not the same as a license to reuse the code in a product. A project that appears in a "projects with source code" list but has no license file is therefore a reading exercise only, and a short message to the maintainers asking them to add a license is the usual first step.
Code is one thing, weights are another
An open-source inference program and the model it runs are two different artifacts. The llama.cpp README names the MIT license for the project and for several third-party libraries, and it says nothing about the terms of model files. Those terms sit on each model's own page and can differ widely, from permissive to restricted by use or by company size. What counts as open for a model is a separate debate, covered in the Open Source AI definition article linked below.
Model files raise a security point as well. The current PyTorch documentation for torch.load says the function uses an unpickler under the hood and warns, "Never load data from an untrusted source." In practice a downloaded checkpoint should come from a publisher whose identity can be checked, and the file format deserves as much scrutiny as the license.
Signs that a project is looked after
Governance is easier to verify than quality. The PyTorch Foundation describes itself as a vendor-neutral home hosted by the Linux Foundation, with a Governing Board and a published technical governance page. The scikit-learn about page shows a different model: a community project with named maintainer teams, a first public release on February 1, 2010 from a group at INRIA, and a release cycle of roughly three months.
For a quick, repeatable check, the OpenSSF Scorecard tool scores a repository from 0 to 10 on checks such as Maintained, Code-Review, Pinned-Dependencies, Security-Policy, and License. A low score does not prove a project is unsafe, and a high one does not prove it is good, but it replaces a vague impression with a list of specific gaps.
A ten-minute checklist before adopting a repository
- Open the LICENSE file itself and confirm it matches the badge.
- Note the notice and attribution duties that apply when the app ships to customers.
- Look for a NOTICE file, a security policy, and a contributing guide in the repository root.
- Check the date of the last release and whether recent issues receive replies.
- Read the dependency list and the licenses of the larger dependencies.
- Find where the model weights come from and read their license separately.
- Run unfamiliar code in an isolated environment first, never on a machine holding client data.
This article gives general information about software licenses. It is not legal advice, and questions about a specific product or contract belong with a qualified lawyer.
FAQ
Is there a definitive list of the top AI projects with source code?
No source-checked ranking exists, because popularity, quality, and fit depend on the task. The projects above are examples of what a license check looks like, and the same steps work on any repository.
Can an open-source AI library be used in a commercial product?
Under BSD, MIT, and Apache 2.0, yes, as long as the notice duties are met. Copyleft licenses such as the GPL carry stronger conditions, so they need a separate reading.
Does an open-source license cover the training data?
Not automatically. A code license covers the code in the repository. Datasets and model weights come with their own terms, which a repository page may not repeat.
What should be done if a useful repository has no license?
Treat it as all rights reserved, use it for study only, and ask the authors to add a license before relying on it.
Related reading
- What the Open Source AI definition requires
- Security findings on AI-written code
- Timefold Solver as an open-source optimizer
- What code still does in AI systems
More in AI Tools and Industry.
Last verified: October 2026
Sources
- GitHub license metadata for pytorch/pytorch, scikit-learn/scikit-learn, tensorflow/tensorflow, huggingface/transformers, and ggml-org/llama.cpp, GitHub, checked October 2026
- PyTorch LICENSE file, PyTorch contributors, GitHub, 2026
- BSD 3-Clause License, Open Source Initiative, 2026
- Apache License, Version 2.0, Apache Software Foundation, 2004
- Licensing a repository, GitHub Docs, 2026
- llama.cpp README, ggml-org, GitHub, 2026
- torch.load documentation, PyTorch, 2026
- PyTorch Foundation, PyTorch, 2026
- About us, scikit-learn, 2026
- OpenSSF Scorecard, Open Source Security Foundation, GitHub, 2026