License

kLLM is open source under the Apache License, Version 2.0. A small set of components for confidential-VM deployments, kLLM Enterprise, is licensed separately by Agent Network. This page states which parts belong to each.

Open-source core

The source code in the ANetResearch/kLLM repository is licensed under Apache-2.0. The full text is in the LICENSE file at the root of the repository, and the package metadata declares the SPDX identifier Apache-2.0.

The open-source package includes:

  • the kllm command-line tool: version, recipes, keygen, seal, serve, unlock, client proxy, client generate and demo;

  • the commands of the upcoming 0.2 line, such as pull, run, key and create, with the model library (Model, key and runtime commands (0.2 line));

  • the website in web/ and the key-application service in services/access/;

  • the keyed code in kllm.keyed: model keys and key files, the orth and perm transforms, sealing for every supported model family, the encrypted tokenizer container, and client-keyed mode;

  • the launch backends for SGLang and vLLM and the built-in serving recipes;

  • the INT8 kernels for the MiniMax H3 diffusion transformer;

  • the env key source (KLLM_MODEL_KEY) used by kllm serve --key in development, and the kllm.keysource entry-point group through which other key sources are registered;

  • the user-side binding check, python -m kllm.keyed.attest, which confirms that a deployment’s attestation evidence names the TLS key of the connection; see Verifying a deployment;

  • the tests, the benchmark scripts in benchmarks/, the attack tools in tools/attacks/, the examples and the Dockerfile.

kLLM Enterprise

kLLM Enterprise is distributed as the separate package kllm-enterprise. It is not covered by the Apache-2.0 license of this repository and is licensed separately. It contains:

Component

Purpose

cdh key source

Obtains the model key from the Confidential Data Hub of Confidential Containers, which releases it only to a confidential VM whose measurements match the deployer’s policy.

gramine key source

A key source that runs inside a confidential VM.

Attesting TLS gateway

Terminates TLS inside the confidential VM and serves the /attestation evidence that binds its TLS key to the VM’s attestation report.

kllm-enterprise registers its key sources with kllm serve through the kllm.keysource entry-point group. The open-source kllm serve accepts --key-source cdh and --production, but without kLLM Enterprise installed the cdh key source is unavailable and kllm serve exits with status 2 and the error key source 'cdh' needs kLLM Enterprise (kllm-enterprise).

The Attested CPU deployment profile therefore requires kLLM Enterprise. The Private Seal profile, client-keyed mode and all sealing and serving functions work with the open-source package alone. See Deployment profiles and Confidential VM deployment.

Note

The Attested CPU profile has not yet been validated on TDX, SEV-SNP or Hygon CSV hardware, and no kLLM profile protects GPU memory. See Claims.

Third-party code and dependencies

  • src/kllm/keyed/d1/zimage_transformer.py is adapted from the Z-Image transformer of Hugging Face Diffusers 0.40, which is licensed under Apache-2.0.

  • kLLM declares its dependencies as optional extras (serve, vllm, int8, client, keyed, seal, image, dev) and does not bundle them. SGLang, vLLM, PyTorch, comfy-kitchen and the other dependencies are distributed under their own licenses.

  • Container images built from the Dockerfile include the SGLang or vLLM base image and are subject to the licenses of its contents.

  • Model checkpoints are not part of kLLM. A sealed checkpoint is derived from the original checkpoint and remains subject to that model’s license.

Contributions

Unless a contributor explicitly states otherwise, a contribution submitted for inclusion in kLLM is licensed under Apache-2.0, as provided in section 5 of the license. See Contributing to kLLM.