github.com/hashicorp/vault safe for commercial use?Go module package · License: BUSL-1.1
github.com/hashicorp/vault is licensed under BUSL-1.1. It carries no source-disclosure obligation, but its terms restrict how the software may be used, so all 5 shipping models below need a reading of the license itself.
| How you ship it | Result | Why |
|---|---|---|
| Hosted SaaS | Needs review | BUSL-1.1 is not an OSI-approved open source license. Licenses in this family commonly restrict offering the software as a commercial or competing service. The specific terms need individual review. |
| Distributed binary / app | Needs review | BUSL-1.1 is not an OSI-approved open source license. Licenses in this family commonly restrict offering the software as a commercial or competing service. The specific terms need individual review. |
| Delivered to customer | Needs review | BUSL-1.1 is not an OSI-approved open source license. Licenses in this family commonly restrict offering the software as a commercial or competing service. The specific terms need individual review. |
| Internal use only | Needs review | BUSL-1.1 is not an OSI-approved open source license. Licenses in this family commonly restrict offering the software as a commercial or competing service. The specific terms need individual review. |
| Published library | Needs review | BUSL-1.1 is not an OSI-approved open source license. Licenses in this family commonly restrict offering the software as a commercial or competing service. The specific terms need individual review. |
None
If you only use it at build time, the answer changes.
BUSL-1.1 appears as a dev dependency, so it is not part of the artifact you ship. Distribution-triggered obligations do not arise. Tools that emit code into your output, such as code generators, are a separate case worth checking individually.
Not open source. Source-available with a time delay: use is restricted — typically barring competing production offerings — until a stated change date, after which the code converts to an open license such as Apache-2.0. The specific Additional Use Grant determines what you may actually do.
github.com/hashicorp/vault is licensed under BUSL-1.1. It carries no source-disclosure obligation, but its terms restrict how the software may be used, so all 5 shipping models below need a reading of the license itself.
BUSL-1.1 is not an OSI-approved open source license. Licenses in this family commonly restrict offering the software as a commercial or competing service. The specific terms need individual review.
BUSL-1.1 is not an OSI-approved open source license. Licenses in this family commonly restrict offering the software as a commercial or competing service. The specific terms need individual review.
BUSL-1.1 is not an OSI-approved open source license. Licenses in this family commonly restrict offering the software as a commercial or competing service. The specific terms need individual review.
BUSL-1.1 is not an OSI-approved open source license. Licenses in this family commonly restrict offering the software as a commercial or competing service. The specific terms need individual review.
BUSL-1.1 is not an OSI-approved open source license. Licenses in this family commonly restrict offering the software as a commercial or competing service. The specific terms need individual review.
BUSL-1.1 appears as a dev dependency, so it is not part of the artifact you ship. Distribution-triggered obligations do not arise. Tools that emit code into your output, such as code generators, are a separate case worth checking individually.
This page covers one package. Your go.sum has many more.
Check your whole manifest →The license was read from the repository's own LICENSE file, falling back to deps.dev and then ClearlyDefined — Go has no central license metadata, so a project's LICENSE at its default branch is the most direct answer to what it is licensed under today, then evaluated against each shipping model. Dependencies in this ecosystem are linked statically, which is assumed here. Only the declared license is considered; code copied into a project's own source files is not detected by this method.
License data last reviewed .
LicenseGuard reports information derived from published license texts and dependency manifests. It is not legal advice and using it does not create an attorney-client relationship. Results reflect license metadata as declared; they do not identify every obligation or violation. Consult qualified counsel for decisions that matter.
Listed in the official MCP registry, on Glama and on Smithery. Source on GitHub (Apache-2.0).