Skip to content

Buy a Commercial License

Ready to scale your JSON Schema management? Our commercial licensing ensures you have the tools and support needed for enterprise deployments while contributing to the continued development of industry-leading JSON Schema technology.

Sourcemeta One is publicly available on GitHub with full source code transparency, enabling comprehensive auditing and community contributions. It is source-available rather than open source: the Community edition is free to self-host, while the Enterprise edition's source is published for audit but requires a commercial license to run in production. This is a similar open-core split to the one GitLab, PostHog, and SigNoz apply through their own ee/ directories.

Editions

Sourcemeta One is available in two editions:

  • Community: The free edition, offering a subset of the functionality for self-hosting under the Business Source License 1.1, with certain restrictions. Four years after each release, that release transitions to AGPL-3.0-or-later.

  • Enterprise: Adds the Standard Library, the capabilities described below, and supply chain security features. Its source is published for transparency and audit, but it is commercial software, governed by enterprise/LICENSE and the commercial license.

Read the respective licenses for the specific conditions of each edition and other details.

Model Context Protocol

Every Enterprise instance doubles as a fully-featured Model Context Protocol (MCP) server. Every schema in the catalog is exposed as a discoverable MCP resource and every HTTP API action is offered as a JSON-RPC tool (not as a layer on top of REST but as a true MCP-first integration), helping your AI assistants get the most out of your schema single source of truth.

Linked Data (RDF)

Enterprise instances can promote JSON instances to JSON-LD (and therefore RDF) through the RDF endpoint and the equivalent MCP tool. The mapping is declared through x-jsonld-* annotations on the very schemas that validate the data (see the JSON Schema CLI RDF documentation), so the same single source of truth governs both validation and semantics, letting you feed knowledge graphs and semantic tooling straight from your schema catalog. Learn more about this approach in Fully solving JSON Schema and JSON-LD interoperability.

Authentication

Enterprise instances can gate access behind authentication policies, covering anything from a single schema collection to the entire instance. Keep selected parts private while the rest stays public, or lock down everything, granting access to consumers through API keys or JSON Web Tokens issued by your OAuth 2.0 or OpenID Connect provider.

Standard Library

Sourcemeta maintains a growing library of hand-crafted high-quality schemas called the Standard Library. The standard library provides ready-to-use schemas for commonly used standards and specifications such as IETF URIs, email addresses, JSON Pointers, HTTP problem details, and IEEE POSIX paths, among others. To use it, pull https://github.com/sourcemeta/std as a Git submodule and point to its schemas from your configuration file using a relative path.

For organizations looking to double down on their JSON Schema governance initiative, the standard library provides a strong foundation of high-quality schemas ready on day one, removing the need to invest significant time and effort into authoring and maintaining a large catalog of schemas from scratch.

Every schema in the standard library is maintained by a member of the JSON Schema Technical Steering Committee, extensively unit tested, performance tuned for production use, and checked for compliance against the JSON Schema specification. As part of the Enterprise plan, Sourcemeta will extend the standard library with any additional standard your organization requires.

Supply Chain Security

Starting with v4.2.2, the Enterprise container image ships with built-in supply chain security and regulatory compliance capabilities:

  • Signed Container Images. Every Enterprise image is cryptographically signed using Cosign and the Sigstore transparency log, allowing you to verify image authenticity and integrity before deployment.

  • Software Bill of Materials (SBOM). Each release includes an SPDX SBOM attached as a signed attestation to the container image, covering the vendored, npm, and system-level dependencies built into it, for vulnerability management and audit purposes.

  • FIPS-Ready Cryptography. The Enterprise image is built with the OpenSSL FIPS provider (openssl-provider-fips) for all cryptographic operations, supporting organizations that require FIPS 140 compliance.

  • SLSA Build Level 3 Provenance. Each Enterprise release publishes a SLSA v1.0 Provenance attestation that describes how the image was built, including the source repository, the exact commit, the workflow invocation, and the runner identity. The attestation is generated and signed by GitHub Actions through Sigstore on a hardened, isolated build platform, satisfying the SLSA Build Level 3 non-forgeability requirements and providing verifiable evidence of build integrity for supply chain audits and regulatory frameworks such as the NIST Secure Software Development Framework (SSDF).

Verifying Image Signatures

You can verify that an Enterprise container image was built and signed by Sourcemeta's official GitHub Actions pipeline using Cosign. For example:

cosign verify \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --certificate-identity-regexp "^https://github.com/sourcemeta/one/" \
  ghcr.io/sourcemeta/one-enterprise:v4.2.2

Retrieving the SBOM

The SPDX SBOM is attached as a signed in-toto attestation. You can verify and extract it using Cosign. For example:

cosign verify-attestation --type spdx \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --certificate-identity-regexp "^https://github.com/sourcemeta/one/" \
  ghcr.io/sourcemeta/one-enterprise:v4.2.2 \
  | jq -r '.payload' | base64 -d | jq '.predicate'

Verifying Build Provenance

The SLSA Build Level 3 Provenance attestation can be verified using slsa-verifier, which checks both the Sigstore signature and that the provenance references the expected source repository and tag. Verifying images from ghcr.io requires exporting GH_TOKEN with a GitHub token that has read access to the container registry. For example:

export GH_TOKEN=<your-github-token>
slsa-verifier verify-image \
  ghcr.io/sourcemeta/one-enterprise:v6.2.0 \
  --source-uri github.com/sourcemeta/one \
  --source-tag v6.2.0

Our Commitment to Excellence

Sourcemeta is led by a member of the JSON Schema Technical Steering Committee, ensuring our solutions meet the highest industry standards and remain aligned with JSON Schema ecosystem developments. As an independent, bootstrapped company without venture capital backing, we maintain complete focus on delivering nothing less than exceptional JSON Schema tooling.

Next Steps

Interested in a commercial license? Contact us at hello@sourcemeta.com to discuss further.