# Third-Party Notices

> **INCOMPLETE — PENDING VERIFICATION.** This inventory lists third-party
> components the project uses. License identifiers are **NOT asserted here** and
> must be confirmed against each component's upstream notice before release
> (e.g. with `go-licenses`, `go mod download` + license scan, and an `npm`
> license scan for the frontends). Do not treat this list as complete or as a
> substitute for upstream LICENSE/NOTICE files. Items are marked
> `[VERIFY]` until confirmed.

## A. Linked Go libraries (direct dependencies, compiled into binaries)

Source of truth: `go.mod` (module `github.com/Armur-Ai/Pentest-Swarm-AI`).
Transitive (indirect) dependencies also apply and must be enumerated by a license
scanner; only direct requires are listed here.

| Module | Version | License |
|--------|---------|---------|
| github.com/anthropics/anthropic-sdk-go | v1.26.0 | [VERIFY] |
| github.com/aws/aws-sdk-go-v2 (+ config, credentials, service/bedrock, service/bedrockruntime) | v1.47.x / v1.63–73.x | [VERIFY] |
| github.com/aws/smithy-go | v1.28.4 | [VERIFY] |
| github.com/charmbracelet/bubbles, bubbletea, lipgloss | v1.x | [VERIFY] |
| github.com/chromedp/cdproto, chromedp | v0.x | [VERIFY] |
| github.com/fasthttp/websocket | v1.5.12 | [VERIFY] |
| github.com/gofiber/contrib/websocket, gofiber/fiber/v2 | v1.3.4 / v2.52.12 | [VERIFY] |
| github.com/google/uuid | v1.6.0 | [VERIFY] |
| github.com/jackc/pgx/v5 | v5.8.0 | [VERIFY] |
| github.com/spf13/cobra, spf13/viper | v1.10.2 / v1.21.0 | [VERIFY] |
| github.com/zalando/go-keyring | v0.2.8 | [VERIFY] |
| go.uber.org/zap | v1.27.1 | [VERIFY] |
| go.yaml.in/yaml/v3 | v3.0.4 | [VERIFY] |
| golang.org/x/term | v0.32.0 | [VERIFY] |

> Generate the authoritative, transitive list before each release, e.g.
> `go-licenses report ./... > THIRD_PARTY_GO.txt`, and attach it to the release
> compliance manifest (see docs/legal/RELEASE_COMPLIANCE.md).

## B. Separately invoked external tools (NOT linked; executed as subprocesses)

These are installed in the container image (see Dockerfile) and invoked as
separate programs. They are **not** linked into the binary; each keeps its own
license. Confirm the license and redistribution terms of any tool actually
bundled in a distributed image:

amass, arjun, crlfuzz, dalfox, dnsx, feroxbuster, ffuf, gau, gitleaks, gobuster,
gxss, httpx, interactsh (interactsh-client), katana, naabu, nikto, nmap, sqlmap,
subfinder, wafw00f, whatweb — all **[VERIFY]** (several ProjectDiscovery tools,
plus nmap/sqlmap/nikto/etc., each under its own license and redistribution
terms).

## C. Frontend / web assets

- `web/package.json` and `website/package.json` dependencies — **[VERIFY]** via
  an npm license scan; enumerate before shipping any bundled frontend.

## D. Models, templates, data

- Any bundled detection templates, wordlists, or model weights shipped with a
  distribution must be listed here with their licenses — **[VERIFY / none bundled
  yet: confirm]**.

Unresolved items above are flagged for human review; this file is not final.