# Third-Party Notices

`dsh-tool-retriever` depends on the following runtime host contracts or libraries:

| Package | Role | License |
| --- | --- | --- |
| `@deepseek-ai/cordis` | Plugin lifecycle host, supplied by DSH | MIT |
| `@deepseek-ai/dsh-llm` | Optional query-rewrite service contract, supplied by DSH | MIT |
| `@deepseek-ai/dsh-tools` | Tool Registry and execution contract, supplied by DSH | MIT |
| `@deepseek-ai/schemastery` | Runtime configuration schema | MIT |
| `@huggingface/transformers` | Optional experimental local tokenizer and ONNX inference pipeline | Apache-2.0 |
| `Xenova/multilingual-e5-small` | Optional Transformers.js-compatible ONNX conversion | See model card |
| `intfloat/multilingual-e5-small` | Underlying optional multilingual embedding model | MIT |

Development-only dependencies are declared in `package.json` and resolved by `pnpm-lock.yaml`; their own license files remain authoritative.

No model weights are included in the npm archive. Only an operator who installs the optional Transformers.js peer and enables Dense may fetch weights from Hugging Face. The experiment pins revision `761b726dd34fb83930e26aab4e9ac3899aa1fa78`; the model card and files at that revision remain authoritative.

The Git-only frozen evaluation uses repository-authored DSH projections of operation families from the sources recorded in `evaluation/frozen.json`. That manifest records upstream URLs and licenses, including the mixed licensing transition in Model Context Protocol servers. The evaluation corpus is not included in the npm archive.