OPEN SOURCE · 开源依赖
Full open-source disclosure.
We stand on the shoulders of dozens of OSS projects. This page is InThoth's public dependency and license-compliance declaration — verifiable any time by customers, auditors, and legal teams.
01 — COMMITMENT
Our commitment.
InThoth is built by Inscinstech (苏州英赛斯智能科技有限公司). We commit to:
- Full disclosure — every OSS dependency in production is listed on this page (version · license · purpose · upstream repo).
- Preserve original copyrights — all forks and wrappers retain upstream LICENSE files and copyright notices; nothing is stripped.
- No false in-house claims — we clearly distinguish "in-house (proprietary)" / "built on (fork)" / "depends on (direct dependency)" in both marketing and technical docs.
- Compliant downstream distribution — private-deploy bundles include the full LICENSE, NOTICE, and an offline snapshot of this page.
- Quarterly updates — this page is updated whenever a dependency changes. The last-updated date is at the bottom.
02 — RUNTIME WRAPPING
Core runtime + brand wrapping.
Which brand names are marketing wrappers, which are direct dependencies, which are forks — visible at a glance.
| InThoth brand | Upstream OSS | License | Relationship | Notes |
|---|---|---|---|---|
| inCore | In-house agent runtime + OSS infra | Proprietary · OSS deps under their own licenses | Built in-house | inCore is Inscinstech-built: the agent runtime, multi-tenant isolation, 21 CFR Part 11 audit layer, and IBS integration are all our own code. Open-source components are infrastructure dependencies only, listed in the matrix above. |
| InThoth · the platform | Inscinstech CMC v2.2 knowledge base (proprietary) + BGE-M3 / bge-reranker / ColBERT / Qdrant (RAG) + scikit-learn Gaussian process (DoE) + RDKit / ViennaRNA (chemistry) + OSS infra | Apache 2.0 / MIT / BSD · proprietary knowledge base | Primarily in-house + OSS deps | InThoth's core moat is Inscinstech's CMC v2.2 knowledge base (82+ entries, proprietary), FDA review-doc distillation, the process-prediction and DoE models, the chromatography-column catalog, and the sensitivity-routing layer. Open-source components are infrastructure and published research models, listed individually above. |
03 — FULL MATRIX
Full dependency matrix.
Grouped by purpose. Versions reflect the actual production environment at the time of this page's last update.
3.1 Application platform & agent runtime
| Project | Version | License | Repo | Used for |
|---|---|---|---|---|
| ASP.NET Core | 8.0 | MIT | github.com/dotnet/aspnetcore | Multi-tenant gateway host |
| Entity Framework Core | 8.0 | MIT | github.com/dotnet/efcore | Data access · row-level tenant filters |
| Npgsql | 8.0 | PostgreSQL License | github.com/npgsql/npgsql | PostgreSQL driver |
| Serilog | 8.x | Apache 2.0 | github.com/serilog/serilog | Structured logging |
| Model Context Protocol (MCP) | 1.x | MIT | github.com/modelcontextprotocol | External tool wiring, inbound and outbound |
| Electron | 33.x | MIT | github.com/electron/electron | Desktop shell (same frontend as web) |
| Temporal | 1.22+ | MIT | github.com/temporalio/temporal | GxP long workflows · 21 CFR Part 11 audit |
3.2 Retrieval & RAG
| Project | Version | License | Repo | Used for |
|---|---|---|---|---|
| BGE-M3 | latest | MIT | huggingface.co/BAAI/bge-m3 | Self-hosted embedding model (CLS pooling) |
| bge-reranker-v2-m3 | latest | Apache 2.0 | huggingface.co/BAAI/bge-reranker-v2-m3 | Cross-encoder reranking |
| ColBERTv2.0 | latest | MIT | github.com/stanford-futuredata/ColBERT | Late-interaction reranking (optional track) |
| sentence-transformers | 2.7+ | Apache 2.0 | github.com/UKPLab/sentence-transformers | Embedding / reranking service runtime |
| RAGatouille | 0.0.8+ | Apache 2.0 | github.com/AnswerDotAI/RAGatouille | ColBERT service wrapper |
| Qdrant | 1.x | Apache 2.0 | github.com/qdrant/qdrant | Vector database (default backend) |
| pgvector | 0.7+ | PostgreSQL License | github.com/pgvector/pgvector | Vector backend alternative (inside Postgres) |
3.3 Process ML & DoE
| Project | Version | License | Repo | Used for |
|---|---|---|---|---|
| scikit-learn | 1.3+ | BSD-3 | github.com/scikit-learn/scikit-learn | Gaussian process (ARD RBF) · applicability domain · calibration |
| NumPy | 1.24+ | BSD-3 | github.com/numpy/numpy | Numerics |
| SciPy | 1.10+ | BSD-3 | github.com/scipy/scipy | Optimization · statistics |
| FastAPI | 0.110+ | MIT | github.com/tiangolo/fastapi | Service contract shared by all Python microservices |
| Uvicorn | 0.27+ | BSD-3 | github.com/encode/uvicorn | ASGI server |
| Pydantic | 2.x | MIT | github.com/pydantic/pydantic | Request / response schemas |
3.4 Chemistry & code sandbox
| Project | Version | License | Repo | Used for |
|---|---|---|---|---|
| RDKit | 2024.3+ | BSD-3 | github.com/rdkit/rdkit | Fingerprints · Tanimoto · SMARTS · Murcko scaffolds · ADMET descriptors |
| ViennaRNA | 2.6+ | ViennaRNA license (commercial use permitted) | www.tbi.univie.ac.at/RNA/ | RNA secondary-structure MFE · oligo accessibility |
| Gemmi | 0.6+ | MPL 2.0 | github.com/project-gemmi/gemmi | Structure file handling (PDB / mmCIF) |
| Matplotlib | 3.8+ | PSF-based (BSD-compatible) | github.com/matplotlib/matplotlib | Figures generated inside the sandbox |
| python-docx / openpyxl / python-pptx | latest | MIT | github.com/python-openxml | Word / Excel / PowerPoint deliverables |
| ReportLab · CairoSVG · svglib · Pillow | latest | BSD-3 / LGPL / MIT / MIT-CMU | multiple | PDF and image rendering |
3.5 Scientific models reached through compute routingSelf-hosted in-region GPU broker
| Project | Version | License | Repo | Used for |
|---|---|---|---|---|
| OpenFold3 | latest | Apache 2.0 | github.com/aqlaboratory/openfold | Co-folding (backup folding track) |
| Chai-1 | latest | Apache 2.0 | github.com/chaidiscovery/chai-lab | Co-folding with ligands / nucleic acids |
| ESM-2 | latest | MIT | github.com/facebookresearch/esm | Protein language model embeddings · variant scoring |
| LigandMPNN | latest | MIT | github.com/dauparas/LigandMPNN | Inverse folding with ligand / nucleic-acid context |
| RFantibody | latest | BSD-3 | github.com/RosettaCommons/RFantibody | Framework-grafted antibody CDR design |
| AiZynthFinder | 4.x | MIT | github.com/MolecularAI/aizynthfinder | Retrosynthesis route search |
| OpenFE | 1.x | MIT | github.com/OpenFreeEnergy/openfe | Relative binding free energy (RBFE) |
| Uni-GBSA | latest | LGPL-3.0 | github.com/dptech-corp/Uni-GBSA | MM-GBSA endpoint binding free energy |
| scGPT · scVI-tools · Borzoi | latest | MIT / BSD-3 / Apache 2.0 | multiple | Single-cell and genomics models |
3.5 Scientific models reached through compute routingDomestic compliant track — in-region hosting, data never leaves the region
| Project | Version | License | Repo | Used for |
|---|---|---|---|---|
| Uni-Fold | latest | Apache 2.0 | github.com/dptech-corp/Uni-Fold | Protein folding (AF2 reproduction) |
| Protenix | latest | Apache 2.0 | github.com/bytedance/Protenix | Co-folding (AF3 reproduction) |
| Uni-Dock | latest | Apache 2.0 | github.com/dptech-corp/Uni-Dock | GPU-accelerated docking |
| Uni-Mol | latest | MIT | github.com/dptech-corp/Uni-Mol | Molecular representation and properties |
3.5 Scientific models reached through compute routingOverseas managed APIs — blocked outright for sensitive / confidential sessions
| Project | Version | License | Repo | Used for |
|---|---|---|---|---|
| AlphaFold2 / -Multimer | hosted | Vendor terms (hosted API) | build.nvidia.com | Folding · complex validation — public / internal work only |
| ESMFold · Boltz-2 | hosted | Vendor terms (hosted API) | build.nvidia.com | Folding and co-folding — public / internal work only |
| DiffDock · RFdiffusion · ProteinMPNN | hosted | Vendor terms (hosted API) | build.nvidia.com | Docking and design — public / internal work only |
| MolMIM · GenMol · Evo2 | hosted | Vendor terms (hosted API) | build.nvidia.com | Small-molecule generation, genomics — public / internal work only |
3.6 Document parsing & office formats
| Project | Version | License | Repo | Used for |
|---|---|---|---|---|
| DocumentFormat.OpenXml | 3.2 | MIT | github.com/dotnet/Open-XML-SDK | Office document generation |
| QuestPDF | 2026.x | MIT (Community) | github.com/QuestPDF/QuestPDF | PDF report generation |
| PdfPig | 0.1.x | Apache 2.0 | github.com/UglyToad/PdfPig | PDF text extraction |
| MinerU | 0.x | Apache 2.0 | github.com/opendatalab/MinerU | Chinese PDF / table / formula parsing |
| GROBID | 0.8+ | Apache 2.0 | github.com/kermitt2/grobid | Academic PDF metadata extraction |
3.7 Frontend
| Project | Version | License | Repo | Used for |
|---|---|---|---|---|
| 3Dmol.js | 2.x | BSD-3 | github.com/3dmol/3Dmol.js | Interactive 3D structure viewer |
| ECharts | 5.x | Apache 2.0 | github.com/apache/echarts | Charts and response surfaces |
| KaTeX | 0.16+ | MIT | github.com/KaTeX/KaTeX | Math and chemical equation rendering (with mhchem) |
| PDF.js | 4.x | Apache 2.0 | github.com/mozilla/pdf.js | In-app PDF viewing |
| SheetJS · docx-preview · JSZip | latest | Apache 2.0 / MIT / MIT | multiple | In-app preview of office deliverables |
| Next.js · Tailwind CSS | 15 · 3.4+ | MIT | github.com/vercel/next.js | This marketing site and the console |
3.8 Infrastructure, testing & observability
| Project | Version | License | Repo | Used for |
|---|---|---|---|---|
| PostgreSQL | 16 | PostgreSQL License (BSD-like) | github.com/postgres/postgres | Primary relational DB · row-level security |
| Redis | 7.x | BSD-3 (OSS edition) | github.com/redis/redis | Cache · pub/sub |
| RabbitMQ | 3.13+ | MPL 2.0 | github.com/rabbitmq/rabbitmq-server | Message queue |
| MinIO / S3 SDK | latest | AGPL v3 (server) / Apache 2.0 (SDK) | github.com/minio/minio | Object storage for artifacts |
| Docker | latest | Apache 2.0 | github.com/moby/moby | Service and sandbox isolation |
| Playwright | 1.49+ | Apache 2.0 | github.com/microsoft/playwright | Browser-driven end-to-end tests |
| xUnit · Testcontainers | latest | Apache 2.0 / MIT | multiple | Test suite · real-Postgres integration tests |
| Sentry | self-hosted | BSL 1.1 / FSL | github.com/getsentry/sentry | Error monitoring |
| Prometheus · Grafana · Loki | latest | Apache 2.0 / AGPL v3 | multiple | Metrics, dashboards, logs (internal use only) |
04 — NOT IN USE
Projects we don't use (avoiding license traps).
For transparency we also disclose the projects we evaluated but did not adopt, and why.
| Dify | Apache 2.0 + commercial addenda — multi-tenant SaaS resale requires licensing talks. |
| FastGPT | Same as Dify. |
| n8n | Sustainable Use License — SaaS resale restricted. |
| ESM-3 (EvolutionaryScale) | Non-commercial / commercial license tiers — replaced with Boltz-2. |
| AlphaFold 3 (Google DeepMind) | Commercial restrictions; license complexity — replaced with Boltz-2. |
05 — OBLIGATIONS
License obligations summary.
Compliance obligations grouped by license type. This is the self-check list for our engineering and compliance teams, and the transparent commitment to customers.
MIT / BSD / ISC / Apache 2.0
Obligation
- Retain original copyright notice
- Retain original LICENSE file
- Apache 2.0: also retain NOTICE file if any
How we comply
- All fork repos preserve upstream LICENSE / NOTICE
- Container images and private-deploy bundles ship with THIRD_PARTY_LICENSES.txt — full text of every dependency license
- This page is the public source-of-truth declaration
Mozilla Public License 2.0 (MPL 2.0) — RabbitMQ
Obligation
- Modified MPL 2.0 files must keep MPL marker
- Modified source must be made available (only the modified files)
How we comply
- We do not modify RabbitMQ source — used as a black-box service, no MPL disclosure obligation triggered
LGPL — CairoSVG · Uni-GBSA
Obligation
- Dynamic linking is fine; if the library is modified, the modified source must be made available
- Users must be able to relink against their own build of the library
How we comply
- Used unmodified, invoked as separate processes / services — no relinking obligation is triggered
- If we ever patch them, the patched source ships with the private-deployment bundle
AGPL v3 — Grafana / Loki
Obligation
- If AGPL software is offered over the network to users, the user must be offered the source
- Modified source must be made available
How we comply
- Grafana / Loki are used for internal ops monitoring only; not exposed to customers
- Customer dashboards are built on our own Next.js frontend, unrelated to Grafana
- Customers do not interact with Grafana, so AGPL's "network distribution" condition does not trigger
Academic non-commercial — TAP / SAP
Obligation
- Free for academic use; commercial requires licensing negotiation
How we comply
- Already in commercial license negotiation with Oxford OPIG; used only in the platform R&D antibody-tools track, not in InThoth
06 — PRIVATE DEPLOYMENT
Additional obligations for private deployment.
When customers purchase Enterprise private deployment, the distribution container images and code bundles must include:
THIRD_PARTY_LICENSES.txt— complete dependency list with full license textNOTICE— attribution notice for Apache 2.0 projectsLICENSE— inCore's own license (Inscinstech proprietary)/security/open-sourceoffline snapshot — HTML offline version of this page
Customers do not need to make these files public to their own end-users in a private deployment, but they must retain them in the system for audit purposes.
07 — IP BOUNDARY
IP boundaries.
When you buy InThoth, what you own and what you don't.
| Asset | Owner | What the customer gets |
|---|---|---|
| Inscinstech CMC knowledge base v2.2 content | Inscinstech proprietary | Query access (by subscription tier); raw data not transferred |
| InThoth product code | Inscinstech proprietary | Usage rights (by subscription tier) |
| inCore runtime code | Inscinstech proprietary | Usage rights / private-deploy code access (Enterprise only) |
| Customer-uploaded PDFs / sequences / process data | Customer proprietary | Customer-owned; InThoth gains no rights |
| Customer Memory / Skills accumulated in inCore Profile | Customer proprietary | Customer can export / destroy / migrate |
| Agent outputs (briefs / reports / process plans) | Customer proprietary | Customer-owned; may be commercialized, redistributed, adapted |
08 — REPORTING
How to report a license issue.
If you find that: we use an OSS project not listed here; the version / license on this page differs from reality; or we have violated an OSS project's license terms — please email:
opensource@inthoth.com.cn- Acknowledged within 24 hours
- Fix / explanation / adjustment within 7 business days