Under AGPLv3 section 13, if you modify the program and your version supports remote interaction over a network, you must prominently offer all users who interact with it remotely an opportunity to receive your version's Corresponding Source. You must provide it from a network server at no charge.
What the clause says
The text reads, in summary: if you modify the Program and your version supports remote interaction over a computer network, you must prominently offer all users who interact with it remotely an opportunity to receive your version's Corresponding Source. The source must come from a network server at no charge, using standard or customary means of copying software. The offer must also cover the Corresponding Source of any GPLv3 licensed work incorporated under the section's linking provision.
Two conditions trigger it: you modified the program, and users interact with it remotely.
What that means in practice
A company that runs unmodified AGPL software for its own staff has a different position from one that forks it, adds features, and offers the result as a hosted product. The second case is the one the clause was written for. Whether a given arrangement counts as modification or as remote interaction can be a legal question, so involve counsel for edge cases.
The clause says nothing about code that only talks to the program through a separate process. Where the line sits for your architecture is something to confirm with counsel instead of assuming.
How to check your stack
- Search your dependency inventory for AGPL identifiers, including
AGPL-3.0-onlyandAGPL-3.0-or-later. - For each hit, ask: do we modify it? Do users reach it over a network?
- If both answers are yes, plan how you will offer the source to those users, and where.
- If you do not modify it, record that finding and why.
- If you cannot comply, replace the component before launch.
Choosing a policy
Many companies deny AGPL for hosted products by default, then approve exceptions case by case. Others allow it for internal tools only. Pick the stance that fits your risk tolerance and write it down. Automating the check at pull request time prevents surprises; see license policy automation: blocking AGPL at PR.
If you are the author
Choosing AGPL for your own project is a statement that hosted derivatives should share their changes. It will also reduce adoption by some companies that have a blanket policy against it. Weigh that trade before you pick. Background on the license is in AGPL explained.
What to keep as evidence
Keep the inventory entry, the license text version you reviewed, the decision, and the name of the reviewer. If you offer source under section 13, keep a record of where and when the offer was made visible to users.
Safeguard's SBOM and dependency scanning list components for this kind of review, and policies and gates can block denied licenses. You can try a free scan.
Quick check
Does running unmodified AGPL software trigger section 13?
The section applies if you modify the program. Confirm with counsel for your specific case.
Who must receive the source offer?
All users who interact with your modified version remotely over a network.
Sources
Last reviewed: 19 October 2026.
