Enterprise licensing guides published this year keep circling back to the same warning, phrased slightly differently each time: watch for the "rug pull." A vendor builds trust on an open core, gets enough teams dependent on it, then narrows the license, moves key features behind a paywall that didn't exist at adoption time, or quietly stops maintaining the open half once the commercial half is profitable enough. One 2026 compliance guide puts it plainly: since competitors can fork and resell truly open software, a vendor relying on that model can struggle with sustainability, which is exactly the setup for "a sudden switch to a more restrictive license later." It's common enough now that procurement guides have a name for the mitigation: exit-strategy planning, before you've even signed anything.
We'd rather just tell you exactly where our own line sits, in writing, so there's nothing to plan an exit strategy around.
What's actually Apache 2.0, completely, no asterisk
The analysis engine itself, AST parsing, the scoring logic, all three fix tiers, the MCP server, the CI integrations, is Apache 2.0 and complete in every distribution we ship. There's no crippled free build with core functionality stripped out, no telemetry phoning home, no account required, no network call at analysis time. If you pip install truemend today, the engine you get is the same engine a paying customer gets.
What differs between our free and licensed tiers isn't the engine, it's detection content, specifically how much of the anti-pattern library is loaded:
On JavaScript and TypeScript, the free tier includes roughly 37-41% of what a fully licensed install would run, because so much of the real value there sits in framework-specific detectors, React, Next.js, and similar, which are licensed content. On Ruby, Bash, Java, Go, and Swift, the free tier covers 80-97% of the detector set, because those languages' value sits more in the language's own core patterns and its third-party linter ports, which are free by design. Every supported language is genuinely usable for free. The licensed content adds more or less depending on where that language's actual value concentrates, and we say so instead of letting a feature-comparison table imply otherwise.
How the split is actually enforced, and what changed
The tier gets checked by the engine itself, at the point specs are loaded, not by what happens to be sitting in an artifact on disk. An installation below the paid tier skips every non-free spec even if the files are physically present, and it says so once per run rather than silently returning a smaller number of findings and letting you assume that's just what your codebase looks like.
That wasn't always true, and we're not going to pretend otherwise. Packaging, the wheel, the standalone binaries, used to be the only enforcement mechanism. Before one of our own point releases, the standalone binaries actually shipped the full licensed library by an oversight, not a business decision. We fixed the release, not the story, which is the same discipline as everything else in how we talk about this product: when something's wrong, the record shows the wrong version and the fix, not a quietly edited retroactive claim that it was always fine.
# what "truemend definitions" actually reports
$ truemend definitions
engine: apache-2.0, complete
free detectors: loaded (53 spec files)
licensed detectors: not loaded -- run `truemend definitions --update`
with a valid license to fetch framework, AI/LLM,
database, and DevOps detector content
Why this matters more in 2026 than it did two years ago
The open-source trust conversation has shifted this year from an ideological argument into an operational risk category procurement teams are told to actively plan around. A tool that's vague about where its free line sits is asking you to trust a boundary it hasn't actually drawn yet, which means it can move. Ours is drawn in one file, spec_tiers.py, checked by the engine at runtime, and documented in a page that states the actual percentage split instead of a marketing "generous free tier" line that means nothing until you've already integrated the tool.
Where TrueMend fits
Free means free, permanently, for the engine and the core analysis, not as an acquisition funnel with a shrinking definition. The paid tiers add detection content and workflow depth, not the ability to run the tool at all.
- For teams doing vendor due diligence: ask any tool for the exact file or mechanism that enforces its free/paid split. If the answer is "trust the pricing page," that's the risk the 2026 licensing guides are warning about.
- For teams already running the free tier: the engine you have today is the complete engine. Nothing about it degrades if you never upgrade.