# Third-party components and attributions Alvin Bot is proprietary software (see `LICENSE`). It runs **on top of** components that belong to other people. This file names them, says under which terms they are used, and states plainly what Alvin Bot does and does not do with them. Nothing here grants you rights to those components. Each one remains governed by its own licence and by the terms of whoever provides it. > **Dependencies are not redistributed.** The published npm package contains > only Alvin Bot's own files (see the `files` field in `package.json`); > `node_modules` is not part of it. Every third-party package listed below is > fetched from the public npm registry by *your* package manager, onto *your* > machine, under its own licence. --- ## 1. Anthropic — Claude Code and the Claude Agent SDK **This is the one that is not open source.** `@anthropic-ai/claude-agent-sdk` and its platform binary ship under: > © Anthropic PBC. All rights reserved. Use is subject to the Legal Agreements > outlined here: https://code.claude.com/docs/en/legal-and-compliance Your use of Claude Code and the Agent SDK is therefore subject to Anthropic's own agreements — the [Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) or [Consumer Terms of Service](https://www.anthropic.com/legal/consumer-terms), whichever applies to your plan, and the [Usage Policy](https://www.anthropic.com/legal/aup). Those terms are between **you and Anthropic**. Alvin Bot is not a party to them and cannot widen, narrow or replace them. ### What Alvin Bot does — stated so you can check it - **The Claude Code binary is run unmodified**, exactly as published by Anthropic. Alvin Bot does not patch it, does not repackage it, and does not remove, disable or restrict any authentication method built into it. - **You authenticate with your own credentials.** Whether that is your own Anthropic API key or your own Claude subscription, the sign-in happens through Anthropic's own flow. Alvin Bot does not offer a Claude.ai login of its own, and it does not collect, store or intermediate Claude account credentials or session tokens. - **No usage is resold or intermediated.** Alvin Bot is software you run yourself, on your own machine, billed directly to you under your own agreement with Anthropic. It does not pay for anyone's usage and does not route anyone else's requests. If you are building a product or service on top of Claude's capabilities rather than using Alvin Bot for your own work, Anthropic directs developers to **API key authentication** via the Claude Console. Read the page linked above and decide for your own situation. ### Names and logos "Claude", "Claude Code" and "Anthropic" are names of Anthropic PBC. Alvin Bot uses them **only descriptively** — to say which provider a route talks to. Alvin Bot is **not** built, endorsed, sponsored by or affiliated with Anthropic, and no such relationship is claimed or implied. Anthropic's [Trademark Guidelines](https://www.anthropic.com/legal/trademark-guidelines) apply to any other use of their marks. --- ## 2. Other model providers Alvin Bot can talk to OpenAI, Google, Groq, NVIDIA, OpenRouter, Ollama and any OpenAI-compatible endpoint. In every case: - you supply **your own** API key or endpoint, - the request goes from **your** machine to **that** provider, - their terms, prices and usage policies apply to you directly. "OpenAI", "GPT", "Gemini", "Google", "Groq", "NVIDIA", "OpenRouter" and "Ollama" are names of their respective owners and are used descriptively only. No affiliation or endorsement is claimed. ## 3. Messaging platforms Telegram, Slack, Discord, WhatsApp and Signal are operated by their respective companies under their own terms, which you accept directly with them. Alvin Bot connects to them with credentials you provide. Their names and marks belong to them and are used descriptively; no affiliation or endorsement is claimed. Note especially that automated or unofficial access can be restricted by a platform's own rules. Whether your particular use is permitted there is between you and that platform. --- ## 4. Open-source components Alvin Bot's direct runtime dependencies: | Package | Licence | |---|---| | `@anthropic-ai/claude-agent-sdk` | Proprietary — see section 1 | | `@grammyjs/runner`, `grammy` | MIT | | `@slack/bolt` | MIT | | `better-sqlite3` | MIT | | `dotenv` | BSD-2-Clause | | `electron-updater` | MIT | | `express` | MIT | | `node-edge-tts` | MIT | | `pino` | MIT | | `playwright` | Apache-2.0 | | `uuid` | MIT | | `ws` | MIT | Counting everything they in turn depend on, an installation resolves roughly 680 packages. By licence: about 555 MIT, 42 ISC, 21 BSD-3-Clause, 19 Apache-2.0, 16 BSD-2-Clause, 8 BlueOak-1.0.0, 2 MPL-2.0, 1 LGPL-3.0-or-later, 1 GPL-3.0-or-later, and the two Anthropic packages above. Each ships its own licence text inside its own package directory; run `npm ls --omit=dev` to see the exact tree your installation produced. ### Fonts shipped with the web interface Since 5.149.0 the web interface serves its typeface itself instead of loading it from Google Fonts: | File | Typeface | Licence | |---|---|---| | `web/public/fonts/inter-latin.woff2`, `inter-latin-ext.woff2` | Inter (variable, weights 400–700), © 2016 The Inter Project Authors | SIL Open Font License 1.1 — full text in `web/public/fonts/OFL.txt` (in the npm package: `dist/public/fonts/OFL.txt`) | The files are the unmodified subsets Google Fonts distributes for Inter v20. ### Icons shipped with the web interface `web/public/js/icons.js` contains inline SVG path data from **Lucide** (no package, no build step). The entries were taken from different Lucide releases over time; the `bot` entry is a custom drawing, not a Lucide icon. | Source | Licence | |---|---| | Lucide icons, © Lucide Icons and Contributors | ISC License — full text in `web/public/js/LUCIDE-LICENSE.txt` (in the npm package: `dist/public/js/LUCIDE-LICENSE.txt`) | | Lucide icons derived from Feather (listed in that file), © 2013-present Cole Bemis | MIT License — full text in the same file | The licence file is the one published with `lucide-static` 1.46.0; the two icons added in 5.150.0 (`eraser`, `circle-stop`) are verbatim from that release. ### Copyleft components, named explicitly Two deserve to be called out rather than buried in a count: - **`ffmpeg-static` (GPL-3.0-or-later)** — a prebuilt FFmpeg binary, used for audio and video conversion. It is executed as a **separate process** through its command-line interface. It is not linked into Alvin Bot and no part of it is incorporated into Alvin Bot's own code. FFmpeg's source is available from the FFmpeg project. - **`@img/sharp-libvips-*` (LGPL-3.0-or-later)** — the libvips image library reached through `sharp`, pulled in transitively. It is used **unmodified** and bound dynamically at runtime; you are free to replace it in your own installation. libvips' source is available from its project. Neither is redistributed by us (see the note at the top). If you believe an attribution here is wrong or incomplete, please say so — see `SECURITY.md` for how to reach us. ### Programs you install yourself, which Alvin Bot merely runs These are not dependencies and are not shipped, downloaded or bundled. If you install one, Alvin Bot calls it as a **separate process** through its command-line interface and uses its output. If you do not, the feature falls back to something else or reports that it is unavailable. - **whisper.cpp (MIT)** — speech-to-text on your own machine, used for voice messages when its `whisper-cli` binary and a model file are present. Alvin Bot neither ships the binary nor the models; you obtain both from the whisper.cpp project and from the model host of your choosing, under their terms. Source: https://github.com/ggml-org/whisper.cpp - **openai-whisper (MIT)** — the Python reference implementation of Whisper, used the same way if it is the only one installed. Source: https://github.com/openai/whisper The Whisper *models* are published separately from the software that runs them and carry their own terms; OpenAI released the original weights under MIT. Whichever model you place in the model directory, you obtain it yourself and its licence applies to you directly. **Local memory search (`EMBEDDINGS_PROVIDER=lokal`).** Installed on demand into the bot's data directory, never shipped in the npm package: - **onnxruntime-node (MIT)** — Microsoft's ONNX Runtime for Node.js. Source: https://github.com/microsoft/onnxruntime - **@huggingface/tokenizers (Apache-2.0)** — tokenizer in JavaScript. Source: https://github.com/huggingface/tokenizers.js - **multilingual-e5-small (MIT)** — embedding model by Wang et al. (intfloat/multilingual-e5-small), downloaded in the ONNX conversion `Xenova/multilingual-e5-small` from Hugging Face at a pinned revision, each file checked against its SHA-256. --- ## 5. What this file is not This is an attribution notice, not legal advice, and it does not replace reading the licences and terms it points to. Where this file and an original licence or a provider's terms disagree, the original wins.