Ownership, IP, and licensing

1. Who owns this

Toolproof is built and owned by the Toolproof maintainers. The source code for the scanner, the CLI packages, the rule catalog, and the site is published openly, and the Service itself is operated at toolproof-scan.vercel.app.

The maintainers publish no personal name or address anywhere in the project — the attribution is the project, not a person. Who holds the rights, and how that identity is kept private, is set out in the Terms of Service.

The MIT License in the repository covers the code: you may read, use, modify, fork, and redistribute it, including commercially. What the license does not cover are the marks and formats that identify Toolproof — those are reserved below.

2. What is open

• The rule catalog (TP-101 through TP-304) and the detection logic, so a finding can be checked rather than trusted.
• The lockfile, policy, and evidence formats, so your governance artifacts are yours and are not hostage to a vendor.
• The verification path for every signature, so a verdict or an audit export can be checked without installing anything.
• The toolproof.txt opt-out standard, so tool owners stay in control.

Deliberately open is the point. A trust layer that only one vendor can read is not a trust layer. The moat is not secrecy in the rules — it is that we are paid by nobody we scan.

3. What stays reserved

The MIT License covers the code. It does not cover the marks that identify Toolproof, and the reservation is written into the LICENSE itself rather than only on this page. The following are reserved and are not licensed by the open-source licence:

• the name “Toolproof” and the Toolproof proofmark;
• the letter-grade scale and the verdict-card presentation;
• the rule identifiers and the rule catalog as a branded set;
• the toolproof.txt, lockfile, and evidence format names.

You may not use these in a way that implies Toolproof endorses, sponsors, certifies, or is affiliated with an unrelated product or service. This is the standard separation: open code, reserved identity. It exists so that a fork cannot quietly rebrand the same verdicts as its own certification.

Practical use stays unrestricted. Verifying a signature, importing a published format, embedding a verdict card for a tool you own, or linking to a verdict never requires a trademark license.

4. Neutrality as a property right

Toolproof takes no payment, equity, or sponsorship from any tool, vendor, or marketplace that it scans, and never will. A grade cannot be bought. This is not a promise of goodwill — it is the reason the signatures are worth anything. If funding from scanned vendors ever became the model, the receipts would be worthless, and every customer would be able to see it in the grades.

This is also the part no incumbent can copy. A platform that scans its own marketplace, or a vendor that grades its own tools, is structurally incapable of issuing a verdict a third party would accept as evidence.

5. Contributions and the CLA

The repository is public, and contributions are welcome. Because ownership of a public project fragments the moment the first pull request lands, every contribution is submitted under the Contributor License Agreement in the repository — CLA.md.

The terms are the standard Apache-style arrangement, and it is worth being explicit about what they are not. A contributor retains ownership of their work — the agreement is a licence, not an assignment. What it grants the project is a perpetual, irrevocable licence to use, relicense, and distribute that contribution, together with a patent licence for the claims the contribution necessarily reads on. It exists so the project can be relicensed or defended later without tracking down every contributor, and so a contribution that turns out to belong to someone else cannot hold the whole project hostage.

Contributions made on behalf of an employer require that employer to accept the same terms in writing. We do not accept contributions that carry patent or licensing obligations incompatible with MIT.

6. Contact

For licensing, trademark, or ownership questions — including a request that requires the identity of the rights holder — contact security@toolproof-scan.vercel.app. Vulnerability reports belong on the security page.