Last reviewed May 13, 2026
Statement of Composition. FrankenCoder is built by CeardTech LLC. The product is closed-source under a proprietary commercial license, but it incorporates a number of open-source software components, each subject to its own license terms. This page lists those components and links to their canonical sources.
The major systems that make FrankenCoder distinctive — the AI agent orchestrator, the automatic pipeline, the Blink chat virtualizer, the Cyber Watcher, the Reverse Engineering Toolbox, the FrankenDebug debugger, the FC-Embed hybrid search engine, the fc-uia Windows UI Automation bridge, the fc-hub system-tray service, the agent daemon, the JVM/CIL decompilers, the GPU chat renderer, the Deep Research engine, the Node Agent canvas, the Database Viewer, and the Visual Browser Editor — are original work owned by CeardTech LLC and are not open source.
The open-source dependencies below are leveraged for their well-tested primitives (HTTP, runtimes, ML inference kernels, fonts) so that the FrankenCoder team can spend its time on the product, not on reinventing TCP.
https://github.com/microsoft/vscode
FrankenCoder is built on top of the VS Code source tree (the local-ide/ directory in our repository is a fork). The window-management, editor, terminal, multi-diff editor, scroll-locking, language-detection, output panel, extension API, walkthrough, accessibility-signal, and welcome-page subsystems all originate from VS Code and remain under MIT license.
Microsoft Corporation MIT copyright notice ships in the LICENSE.txt at the root of the IDE installation.
https://github.com/electron/electron
Cross-platform desktop application runtime.
37.3.1 (as declared in VS Code's component manifest).
The browser engine inside Electron. Renders every FrankenCoder window, including the built-in browser and the visual browser editor.
138.0.7204.100 (as bundled in Electron 37.3.1).
https://github.com/nodejs/node
JavaScript runtime for the main process, agent-daemon, and node-based extensions.
22.17.0
FrankenCoder-win32-x64/ffmpeg.dll (~2.9 MB, ships in the install root next to FrankenCoder.exe).
FFmpeg is not directly called by any FrankenCoder code. It is bundled automatically by Electron 37.3.1 because Chromium's media stack uses it for HTML5 <video> / <audio> decoding, the MediaRecorder API, and getUserMedia. The binary rides along with Electron regardless of whether FrankenCoder exposes media features.
The ffmpeg.dll Electron ships is intentionally built without GPL-licensed components and without patent-encumbered codecs (most notably H.264 / AAC). FrankenCoder inherits only LGPL obligations, not GPL obligations and not codec-patent royalty exposure. FrankenCoder ships this stripped DLL verbatim with no modifications.
LGPL-2.1+ obligations and how we satisfy them:
Users may compile their own LGPL-compliant FFmpeg of the same ABI (the Chromium-pinned FFmpeg API for Electron 37.3.1) and drop it in as a replacement for the bundled ffmpeg.dll. FrankenCoder does not statically link FFmpeg, does not check its hash at runtime, and does not refuse to load when it is replaced. We do not modify FFmpeg; the binary is the upstream Electron-pinned build verbatim.
https://developer.microsoft.com/en-us/microsoft-edge/webview2/
Used by the FrankenCoder installer (FrankenCoderSetup.exe) to render the welcome/setup UI on Windows.
This is a proprietary Microsoft component, redistributable under its own license terms. Attribution is required.
FrankenCoder ships a complete local LLM / image / speech stack in local-ide/fc-inference/. The Rust shell, OpenAI-compatible HTTP server, model-management UI, vision pipeline, multi-service orchestrator, and the embedding/cost/tokenization layers are all original work. The inference kernels are these open-source projects, vendored as pre-built binaries in llama_bin/, llama_cuda/, sd_bin/, and whisper_vulkan/:
https://github.com/ggerganov/llama.cpp
Georgi Gerganov
The LLM inference backend. Powers every local text-generation call in fc-inference. Provides GGUF loading, KV-cache, sampling, and the CPU / CUDA / Vulkan / Metal compute kernels.
local-ide/fc-inference/llama_bin/ (CPU + Vulkan), local-ide/fc-inference/llama_cuda/ (NVIDIA CUDA).
https://github.com/ggerganov/whisper.cpp
Georgi Gerganov
Speech-to-text inference for the audio transcription endpoint (/v1/audio/transcriptions).
local-ide/fc-inference/whisper_vulkan/
https://github.com/leejet/stable-diffusion.cpp
leejet
Image-generation inference for the OpenAI-compatible /v1/images/generations endpoint. Supports SD 1.5, SDXL, and Flux models.
local-ide/fc-inference/sd_bin/
https://github.com/huggingface/candle
Hugging Face
Rust ML framework. We use a fork with Blackwell (RTX 50-series) support for the CUDA inference path on newest NVIDIA cards.
local-ide/fc-inference/vendor/candle/
tokenizers Apache-2.0https://github.com/huggingface/tokenizers
Tokenization for non-OpenAI / non-Anthropic models in the local-inference path.
https://github.com/ggerganov/ggml
The tensor library underneath llama.cpp, whisper.cpp, and stable-diffusion.cpp. Distributed as part of those binaries.
https://github.com/BurntSushi/ripgrep
Andrew Gallant ("BurntSushi")
The high-speed text-search backend behind the grep tool, the in-editor Find-in-Files, and many agent investigation flows. Bundled as a native binary.
https://github.com/openai/tiktoken (Python), https://github.com/zurawiki/tiktoken-rs (Rust binding)
OpenAI's BPE tokenizer. Used in our cost-tracking calibration harness and live token estimation to keep our pre-flight token counts within 99.9% of provider-reported counts.
hnswlib-style implementation) Apache-2.0 / MIThttps://github.com/nmslib/hnswlib (reference)
The HNSW vector-index portion of FC-Embed uses HNSW algorithmic design (the underlying technique is well-published; our Rust implementation re-uses standard parameters and tuning from the open literature). The FC-Embed implementation itself is our own code.
Note. FC-Embed's HNSW + BM25 with Reciprocal Rank Fusion pipeline is original Rust code, but the algorithms (HNSW, BM25, RRF) are public-domain academic algorithms.
These ship with VS Code itself and therefore ship with FrankenCoder. The full list is in our build-time cgmanifest.json; the headliners are below:
| Component | License | Purpose |
|---|---|---|
| vscode-codicons | MIT + CC-BY-4.0 (icon glyphs) | The codicon font and SVG set used throughout the UI |
| spdlog | MIT | C++ logging library |
| @iktakahiro/markdown-it-katex | MIT | KaTeX integration for the Markdown renderer |
| @vscode/win32-app-container-tokens | MIT | Windows app-container token utilities |
| cacheable-request | MIT | HTTP request caching |
| @parcel/watcher | MIT | File-system watcher |
| @microsoft/1ds-core-js, @microsoft/1ds-post-js | MIT | Microsoft telemetry SDK (FrankenCoder ships with telemetry disabled by default) |
| mdn-data, @mdn/browser-compat-data | CC0-1.0 | MDN reference data for language services |
| @electron/remote | MIT | Electron renderer / main IPC helpers |
| Component | License | Source |
|---|---|---|
| @anthropic-ai/sdk | MIT | anthropic-sdk-typescript |
| openai (Node SDK) | Apache-2.0 | openai-node |
| @google/generative-ai | Apache-2.0 | generative-ai-js |
| @ai-sdk/anthropic, @ai-sdk/openai (where used) | Apache-2.0 | vercel/ai |
This list is the complete set of third-party libraries the chat actually loads. The diagram, chart, graph, JSON-tree, CSV, GeoJSON, math-plot, color-swatch, multifile-preview, link-preview, and live-HTML renderers are all in-house CeardTech code — see "Homegrown Chat Renderers" below.
| Component | License | Purpose |
|---|---|---|
| marked.js (VS Code's bundled copy) | MIT | The Markdown→HTML parser that turns every agent message into HTML. Loaded via MarkedKatexSupport.loadExtension(). |
| KaTeX | MIT | LaTeX math rendering ($inline$, $$display$$). Inherited verbatim from VS Code's markdown-math extension. |
| @iktakahiro/markdown-it-katex v4.0.2 | MIT | KaTeX bridge for VS Code's markdown-math extension. Source: markdown-it-katex |
| markdown-it | MIT | Markdown parser used by the agent-daemon (not the chat pane). Source: markdown-it |
| Pyodide 0.29.3 | MPL-2.0 | In-browser CPython runtime that powers the live-python fence. Vendored (~470 MB across ~360 files, SHA-256 manifest hash-locked). Source: pyodide |
| React 18.3.1 | MIT | Vendored (base64-inlined, SHA-256 verified at load). Loaded into the live-html preview iframe when the agent's HTML uses JSX/React. |
| Vue 3.5.33 | MIT | Vendored (base64-inlined, SHA-256 verified at load). Loaded into the live-html preview iframe when the agent's HTML uses Vue templates. |
Note. Earlier drafts of this document listed chart.js, d3, @viz-js/viz, and highlight.js. None of those packages are bundled. They were removed after source verification (no imports, no node_modules entries, no manifest paths). The flowchart, chart, and DOT/graphviz fences are rendered by our own renderers — see "Homegrown Chat Renderers" below.
The following fenced-block renderers are 100% original CeardTech LLC code and ship with no third-party runtime dependencies (no Chart.js, no D3, no Graphviz WASM, no highlight.js):
| Fence | Renderer | What it is |
|---|---|---|
| FrankenGrams (flowcharts) | FrankenGramsRenderer (5,531 lines) | Custom flowchart parser + Sugiyama-lite layered SVG layout. No upstream diagram-library code. "Zero external dependencies." |
| ```chart | ChartRenderer (709 lines) | Hand-rolled DSL → SVG. Bar / line / pie / scatter. "Zero external dependencies. Pure TypeScript." |
| ```dot, ```graphviz | DotRenderer (342 lines) | DOT-subset parser, reuses the FrankenGrams Sugiyama layout. "No Graphviz binary, no WASM, no network round-trip." |
| ```json-tree | JsonTreeRenderer | Collapsible JSON viewer. |
| ```csv | CsvRenderer | Sortable HTML table. |
| ```geojson | GeoJsonRenderer | Geographic feature map. |
| ```mathplot | MathPlotRenderer (794 lines) | Math-expression parser + SVG plotter. "Zero external dependencies. Pure TypeScript." |
| ```colors | ColorSwatchRenderer | Color-palette swatch grid. |
| ```multifile | MultiFilePreviewRenderer (338 lines) | Multi-file labeled-tab static preview. "Zero external dependencies." |
| ```live-html | previewRenderer.ts + jsxTransformer.ts | Sandboxed iframe HTML/CSS/JS preview with React/Vue auto-detection. The iframe uses vendored React/Vue (above); the orchestrator, JSX transformer, detector, security policy, and controls are original. |
| (auto-link enhancement) | LinkPreviewRenderer | Bare-URL detection + async metadata fetch + skeleton-card insertion (post-processes marked.js output, which doesn't auto-linkify under GFM). |
These renderers are closed-source original work of CeardTech LLC — they are not derived from, do not embed, and are not encumbered by Chart.js, D3, Graphviz, or any other open-source diagram/chart library.
| Component | License | Purpose |
|---|---|---|
| better-sqlite3 | MIT | Synchronous SQLite bindings for Node — used by the Database Viewer and agent storage |
| SQLite (via better-sqlite3 and via the Rust rusqlite crate's bundled SQLite) | Public Domain | The database engine itself |
All Rust crates listed below are dual-licensed MIT OR Apache-2.0 unless otherwise noted. Both licenses are permissive and only require attribution.
tokio, reqwest, axum, tower, tower-http, tray-icon, tao, image, notify-rust, uuid, serde, serde_json, sha2, hex, zip, tracing, tracing-subscriber, tracing-appender, chrono, time, cron, rusqlite (bundled SQLite — public-domain SQLite + MIT bindings), dirs, anyhow, thiserror, clap, rand, base64, futures-util, bytes, once_cell, parking_lot, windows (windows-rs), winreg, tauri-winrt-notification, nix, embed-resource.
Notable:
tauri-winrt-notification (MIT) — persistent Windows toast notifications with action buttons (used by Cyber Watcher threat alerts).rustls (transitively, via reqwest) is ISC / MIT / Apache-2.0 triple-licensed.uiautomation (MIT), serde, serde_json, tracing, tracing-subscriber, anyhow, thiserror, clap, once_cell, parking_lot, windows (windows-rs), embed-resource.
Rust telemetry collector with windows-rs (MIT/Apache-2.0) for ETW, WMI, and Win32 process/network APIs. (Detailed crate list in fc-watcher/Cargo.toml.)
serde, serde_json, thiserror, log, windows-sys (Win32 debug APIs), nix (Linux ptrace), libc. All MIT or MIT-OR-Apache-2.0.
Reminder. The FrankenDebug debugger itself — the breakpoint engine, the stepping primitives, the hardware-watchpoint fallback, the multi-arch disassembly orchestration, the JSON-line protocol — is original work by CeardTech LLC and is closed-source. Only the underlying Rust standard-library and Win32-API binding crates listed here are open source.
tokio, axum, tower, reqwest, serde, serde_json, tracing, clap, anyhow, thiserror, chrono, rusqlite, etc. Plus the kernel binaries listed in section 2.
Rust + Electron installer with Inno Setup integration. See section 1 for Electron, plus standard Rust crates per its Cargo.toml.
FrankenRemote is a React Native + Expo mobile app. Its runtime dependency tree includes:
| Component | License | Purpose |
|---|---|---|
| React Native | MIT | Cross-platform mobile runtime |
| React | MIT | UI library |
| Expo SDK | MIT | Mobile tooling / runtime |
| react-native-reanimated | MIT | Animation runtime |
| react-native-gesture-handler | MIT | Gesture handling |
| @react-navigation/* | MIT | Navigation |
FrankenRemote ships as a separate APK/IPA — its third-party notice file is bundled inside the app.
| Component | License | Purpose |
|---|---|---|
| Inno Setup | Custom (Jordan Russell) — free for any use including commercial | Windows installer compiler. Distributed binaries only. |
| 7-Zip extras (7z-extra) | LGPL-2.1 + unRAR restriction | Archive extraction during install |
| WebView2 Runtime | Microsoft Edge WebView2 License | Renders the installer UI on Windows |
The following are original, closed-source works of CeardTech LLC and are not covered by any of the open-source licenses above:
delegateTask / parallelDispatch infrastructure.re-bridge tool surface, and the panel-based RE workflow.fc-watcher, the 40+ cyber_* tools, the WMI integration, the watcher control plane, the threat-detection rules).VirtualMessageListBlink / blinkLayout) — the entire CPU-sequential layout pipeline, the height predictor, the height observer, the index, and the React integration.previewRenderer.ts + jsxTransformer.ts (live-html iframe orchestrator). These are zero-dependency original works.fc-inference Rust server (the kernels are open source; the orchestration around them is not).The FrankenCoder Terms of Service and End User License Agreement reference this page as the canonical, evergreen list of open-source components. The clause reads, in substance:
Open Source Software Notice. The Software incorporates open source software components, each subject to its own license terms. A complete list of open source components and their licenses is accessible from within FrankenCoder via Help → Open Source Notices, and is also published online at:
https://frankencoder.com/legal/open-source-licenses
Copies of the MIT, Apache-2.0, BSD-3-Clause, LGPL-2.1, MPL-2.0, and other applicable license texts are accessible from the in-app Help → Open Source Notices viewer.
This is the action list when cutting a release. It is published here so users and downstream auditors can verify the compliance posture of any specific FrankenCoder build:
LICENSE.txt (FrankenCoder proprietary) is in the installed app root.ffmpeg.dll is the dynamic-link, separate-file form (next to FrankenCoder.exe, not statically linked into our code) — preserves the LGPL "user can swap the library" right.licenses/LGPL-2.1.txt (or equivalent) in the install root, and the FFmpeg upstream COPYING.LGPLv2.1 notice is preserved.This document is maintained by CeardTech LLC.
package.json dependencies block, a new Rust crate in any Cargo.toml, a new vendored binary in local-ide/fc-inference/ or any assets/ folder, or a new bundled font/icon set): it is added here in the matching section.cgmanifest.json.Last reviewed: 2026-05-13.
chart.js, d3, @viz-js/viz, and highlight.js from section 5 — none of these packages are bundled. Source verification: no imports, no node_modules entries, no entries in any installed-manifest hash list.extensions/markdown-math/), @iktakahiro/markdown-it-katex (in cgmanifest, transitive of markdown-math), markdown-it (used by the agent-daemon, not the chat pane), Pyodide 0.29.3, React 18.3.1, Vue 3.5.33.vendoredReact.ts / vendoredVue.ts with SHA-256 integrity verification at load (not loaded from CDN at runtime).FrankenCoder-win32-x64/ffmpeg.dll (2.9 MB) is present in the packaged output tree. Bundled by Electron 37.3.1 (not by any FrankenCoder code) and required by Chromium's media stack. Confirmed it is the Electron-stripped LGPL-only build — no GPL components, no patent-encumbered codecs — so FrankenCoder inherits LGPL obligations only.Reporting a compliance issue. If you believe FrankenCoder is not satisfying an obligation imposed by an upstream open source license — missing attribution, missing license text, modified component without notice, or anything else — please email support@ceardtech.com with the component name and a description of the issue. We will investigate and correct in the next release.