Open-sourcing 9 government-data MCPs (and keeping the bundle private)

Home / Blog / Open-sourcing 9 government-data MCPs (and keeping the bundle private)

How we structure the ausdata.io codebase as a standard two-license open-core: 9 sister MCPs under MIT, the hosted API under FSL-1.1-MIT, the cross-source bundle private. No defensiveness, this is how open-core works.

The ausdata.io codebase has three layers and three different licensing decisions:

|---|---|---|---|

| 1. Source-specific MCPs (×9) | abs-mcp, rba-mcp, ato-mcp, apra-mcp, aihw-mcp, asic-mcp, aemo-mcp, au-weather-mcp, wgea-mcp | MIT | Public on PyPI + GitHub |

This is a standard two-license open-core split, not a defensive crouch. The rest of this post explains why each layer gets the license it gets, and what that means if you're using or contributing to the project.

Layer 1: nine sister MCPs under MIT

The nine source-specific MCPs are infrastructure. Each one wraps one agency's public data behind a uniform search_* / describe_* / get_data / latest / list_curated tool surface. They're useful on their own, you can pip install abs-mcp today and query the ABS catalogue without touching anything else of ours.

We chose MIT for these because:

Enterprise procurement teams recognise MIT instantly. Any non-OSI-approved license triggers a legal review. MIT does not.
Academic researchers can use them without license review. Most universities have a blanket pre-approval for MIT-licensed dependencies.
Other library authors can depend on them. If a downstream library used FSL, importing it would force their entire dependency tree to inherit FSL questions. MIT composes cleanly.
Maintainability if we vanish. If ausdata.io shuts down tomorrow, the nine sister MCPs continue to be useful and forkable. The data ecosystem isn't trapped.

The trade-off: anyone can take abs-mcp, wrap it in a paid API, and compete with us using our own infrastructure. We're fine with that. The sister MCPs are not our moat, they're the funnel.

# Try one, it's free, no key, no signup:
pip install abs-mcp
python -c "from abs_mcp import server; print(server.list_curated()[:3])"

Layer 2: the private bundle

ausdata-mcp (the bundle) is the cross-source signal layer. It imports all nine sister MCPs and exposes joined endpoints like real_cash_rate() that combine RBA + ABS in a single call. We described why these signals are the actual product in the cross-source signals post.

The bundle is private. It's not on PyPI. The GitHub repo is private. You can't pip install ausdata-mcp from anywhere public.

Why:

It is the commercial product. The signals are what we charge for. Publishing them as a public package would invite a competitor to take them, host them as a paid API, and compete with the only thing we sell.
It's not a library, it's a service-shape. The signals' value depends on the API layer around them, caching, auth, billing, webhooks, stale-flag fallback. Publishing the signals' code without the service around them is shipping a chassis without a car.
Distribution is hosting, not vendoring. Customers don't want to run an MCP server with API keys for nine sources and pay nine different rate-limit budgets. They want one HTTPS endpoint and one key. The hosted API is the right distribution channel; an open-source bundle isn't.

The hosted API at api.ausdata.io is the signal layer's public interface. Layer 3 is the API wrapper around it.

Layer 3: the API under FSL-1.1-MIT

ausdata-api is the FastAPI service that runs on Fly.io behind api.ausdata.io. Its source is public, but under Functional Source License 1.1 (MIT future), not plain MIT.

FSL-1.1-MIT means:

For 2 years from publication, you can do anything non-competing with the code, read it, modify it, fork it for internal use, run it locally for development, contribute via PR.
After 2 years, the license auto-converts to plain MIT. No friction. No negotiation.

The non-compete is narrowly drawn: "Competing Use means making the Software available to others in a commercial product or service that competes with the Software." You can do everything else.

Why FSL for the API specifically:

The API is where the operational moat lives, auth, caching, webhooks, billing, rate-limiting, the threadpool-safe HTTP client. Re-creating those is the only barrier between "you can take our API code and run it tomorrow" and "you can take our API code and ship a competitor tomorrow."
The 2-year MIT conversion gives us a finite runway. We're not asking for permanent commercial protection. We're asking for two years to build the product. After May 2028, full MIT applies.
It's still source-available. Customers can read the code that's running their data. That matters more than the OSI badge for many of them.

# What you can do with ausdata-api source today:
# - Read it on GitHub
# - Run it locally for development
# - Fork it and modify for internal use at your company
# - Submit PRs back

# What you can't do until May 2028:
# - Rebrand it and resell it as a competing hosted API

Why this isn't defensive

Two-license open-core is the dominant strategy in commercial open-source today. Companies using it: Sentry, GitButler, Convex, Keygen, and increasingly the rest of dev-tools.

The pattern: infrastructure layer is MIT or Apache-2.0; differentiated commercial layer is private or under a delayed-open-source license (FSL, BSL); the boundary is documented explicitly. We're not inventing anything here.

What you can actually do with the code

# Use any of the 9 sister MCPs, free, forever, no questions:
pip install abs-mcp rba-mcp apra-mcp aihw-mcp asic-mcp aemo-mcp au-weather-mcp wgea-mcp ato-mcp

# Use the hosted API on the free tier (500 calls/month, no payment):
curl -H "Authorization: Bearer $AUSDATA_KEY" \
  https://api.ausdata.io/v1/health

# Fork ausdata-api, run it locally for development:
git clone https://github.com/Bigred97/ausdata-api
cd ausdata-api && uv sync && uv run uvicorn ausdata_api.app:app

# Contribute to any of these:
# - github.com/Bigred97/abs-mcp (and the 8 other sisters)
# - github.com/Bigred97/ausdata-api

What this isn't

This split is not:

A claim that closed-source code is somehow better. The 9 sisters are MIT precisely because that's the right license for infrastructure.
A bait-and-switch. The licenses are decided up-front and documented in every repo's LICENSE file.
A permanent closure. The FSL converts to MIT in 2028. The private bundle is the one piece that stays proprietary.

If you want a fully MIT-licensed stack: vendor the 9 sisters and write your own signals. We open-sourced the hard part (parsers, SDMX, cache, trust envelope). The signals themselves are a weekend's work once you have the sisters.

Pricing

Free: 500 calls/month, every endpoint, every signal.
Analyst: $29/mo, 10k calls.
Pro: $99/mo, 100k calls + webhooks.

Free key at ausdata.io.

Open-sourcing 9 government-data MCPs (and keeping the bundle private)

Layer 1: nine sister MCPs under MIT

Layer 2: the private bundle

Layer 3: the API under FSL-1.1-MIT

Why this isn't defensive

What you can actually do with the code

What this isn't

Pricing

Sources