Anyone searching for "open source IT asset management" usually wants three things: no licence costs, no vendor who locks them in, and the chance to read for themselves what happens to their own data. Those are three different wishes, and they do not coincide. This post sorts out which systems really do sit under a licence recognised by the OSI, what running them actually demands — and then says plainly why AssetNode is not one of them.

What "open source" actually means

The term has a definition, and it is not a matter of taste. The Open Source Initiative maintains the Open Source Definition; a licence is open source if it meets all ten criteria. Two of them are decisive here:

  • Criterion 1, free redistribution: the licence may not stop anyone from selling or giving away the software, and may not demand a fee for doing so.
  • Criterion 6, no discrimination against fields of endeavour: the licence may not forbid anyone from using the program in a particular field.

"The source code can be inspected" is not enough for that. For that there is the neutral term source-available — one the OSI itself uses, and which it groups with the proprietary licences rather than treating as a third category in between.

The systems that really are open source

Snipe-IT — AGPL-3.0-or-later

The best-known of them, and for many teams the first port of call. The licence file in the repository is the unmodified AGPL-3.0 text, and composer.json declares AGPL-3.0-or-later. Grokability, the company behind it, also runs a paid cloud version.

Technically it is a PHP application on Laravel 12. MySQL 5.7+ or MariaDB are required — PostgreSQL is explicitly not officially supported, even though a configuration block for it exists. The PHP ceiling is worth noting: the upgrade script refuses to run outside PHP 8.2 to 8.5, so you cannot simply follow the latest version your distribution ships.

GLPI — GPL-3.0-or-later

A considerably broader remit: GLPI is a complete ITSM platform, and asset management is one part of it. If you need ticketing, contract management and a CMDB anyway, you get all of it from one place. If you only want to know which laptop sits with which person, you get a great deal more than you asked for.

PHP again, and on Symfony from version 11. MySQL or MariaDB are mandatory — the documentation says so explicitly, and there are no other databases. One detail worth knowing: the GLPI Agent you roll out to endpoints lives in its own repository and under a different licence (GPL-2.0-or-later).

Ralph — Apache-2.0

Developed by Allegro, Python and Django, and the only one here under a permissive licence. Ralph manages data-centre and office hardware, and for the latter it brings a real assignment model: BackOfficeAsset has both an owner and a user.

Two things are worth knowing before you decide. First, the stack is nailed down: Python exactly 3.10 and Django 4.2 LTS — both have now run out of support. Second, Allegro moved the project to a "Sources only" model in early 2025: the code is still published and maintained, but pull requests are not accepted and there is no commitment on issues. You are then running another company's internal tool, not a community project.

Also worth a mention

OCS Inventory NG (GPL-2.0) is strong at automatic discovery — an agent for Windows, Linux, macOS and other systems inventories whatever is on the network. What it lacks is a first-class model of who currently has a device. Discovery and accountability are two different jobs. i-doit open (AGPL-3.0) is the open part of a commercial product, and is more of a CMDB than device management.

What running it yourself really costs

The licence is free. Running it is not. With the PHP candidates you take on a complete LAMP stack: a web server configuration, a MySQL instance with backups, a dozen PHP extensions and an upgrade path that runs through composer install and database migrations. With Ralph there is the added fact that you are tied to a Python and a Django version that no longer have security support.

That is not an argument against open source. It is an argument for doing the sums honestly: half a day of setup plus a few hours a quarter for updates, backups and certificates is a realistic expectation — and if your team can do that anyway, it is time well spent. If not, you are simply paying the price in a different currency.

Where AssetNode stands

AssetNode is not open source in the sense of the Open Source Initiative. It is licensed under the Sustainable Use License v1.0 (SPDX: SUL-1.0), which the SPDX register explicitly lists as not OSI-approved. The licence permits use "only for your own internal business purposes or for non-commercial or personal use", and redistribution only free of charge and for non-commercial purposes.

That collides with criterion 1 and criterion 6 of the Open Source Definition. We have not submitted the licence to the OSI for review; by those criteria it would not be eligible for approval either. The accurate term is source-available, and that makes AssetNode — one should be honest about this — a proprietary licence whose source code is public.

Important, because it is often reported wrongly: the licence does not prohibit commercial use. You may run AssetNode in production in a company of any size, adapt it and operate it internally. What is forbidden is providing AssetNode to third parties for money.

The established term for this model is fair-code, coined by n8n in 2020. Fair-code is not a licence but a description: source code open, use free, resale restricted. Not to be confused with Fair Source — a different initiative from 2024, which requires a delayed release under an open source licence. AssetNode does not have that.

Why not MIT or AGPL

A permissive licence lets any hyperscaler run AssetNode as their own managed service without giving anything back. For a project built by a small team in Bonn that is not a theoretical risk: it would mean the continued development of the very product you rely on becomes unfundable.

The AGPL would be the obvious middle ground — it is the reason Snipe-IT can count as open source and still not be resold as a service at will. We decided against it because the copyleft effect of the AGPL raises questions around integrations and extensions that a company can only answer with legal advice. The Sustainable Use License instead draws exactly one line: free for your own company, not free to resell. Everything else stays open.

We would rather say that plainly than bury it in the small print.

What that means in practice
✅ Free and permanent for internal use inside your own company, at any size
✅ Self-host at any scale, with unlimited assets and users
✅ Read, audit, adapt and extend the source
✅ Pass it on free of charge for non-commercial purposes
❌ Resell AssetNode or offer it to third parties as a hosted service

What is not open

Files with .ee. in the name, or inside an .ee directory, are commercially licensed and need an enterprise licence. There is currently not a single such file in the repository — you can check that with a grep. The convention is fixed from the start so it stays obvious later what belongs to the free scope, rather than repurposing existing code after the fact.

Self-hosting

You need Node 20 and a MongoDB instance:

git clone https://github.com/elixio-io/asset-node.com.git
cd asset-node.com
npm install

cp .env.example .env        # set MONGODB_URI, JWT_SECRET, JWT_REFRESH_SECRET
npm run db:setup
npm run dev:all

No MDM credentials to hand? npm run dev:mock starts every integration against simulated APIs.

If you would rather compare before you install anything: the comparison with Snipe-IT goes through the differences in detail, and the pricing overview shows what the managed cloud costs.

Getting involved

The project is young and the rough edges are real. If you manage IT assets and something is missing or strikes you as wrong, an issue is worth more than a star.

Both repositories are kept in sync; issues and pull requests are welcome on either. One thing to know beforehand, and it is also stated in CONTRIBUTING.md: contributions are granted to us under a licence that also covers commercial versions of AssetNode. That is usual for commercially maintained projects, but it is a difference from a project under an OSI licence, and you should be aware of it before you invest your time.

If you work with an AI coding agent, AGENTS.md holds the build commands, an architecture overview and the pitfalls you cannot see from the source alone.