Is Flagsmith Open Source?

Alex Casalboni

Developer Advocate

November 11, 2026

Flagsmith’s core is open source under BSD-3-Clause. RBAC, SAML/SSO, and certain database integrations are closed-source Enterprise features that ship in licensed images.
Flagsmith’s open-source tier caps an account at one Project and leaves out Change Requests, Flag Scheduling, fine-grained RBAC, Audit Logs, and most additional authentication providers. Unleash’s open-source edition ships basic RBAC roles, a basic audit log, the playground, export/import, and webhooks and integrations by default. It has limits of its own: one Project, two environments, and no change requests or SSO.
Unleash’s AGPLv3 terms apply only when you modify the Unleash source and serve it to users over a network, such as a commercial SaaS fork. Prebuilt Docker images and SDKs keep their permissive licenses, so a standard self-hosted deployment carries no extra obligation.
Before budgeting for a self-hosted platform, check the vendor’s version-comparison or pricing page for the Enterprise-gated governance feature list in addition to GitHub source visibility.

Flagsmith’s code is mostly open. Its GitHub repository publishes the majority of the platform under a permissive license, and anyone can clone it, read it, and stand up a self-hosted instance today. But "open source" and "free to run in production" are two different claims, and evaluation teams risk budgeting for a feature flag platform that turns out to gate fine-grained role-based access control, single sign-on, and audit logging behind a paid tier once the pilot ends.

For enterprise platform, product, and engineering leaders comparing self-hosted options, the licensing boundary around that code determines a team’s deployable scope: specifically, the licensed-to-run scope compared with a competing project’s default feature set. That distinction is where Flagsmith and Unleash diverge.

Your teams ship more code with AI. Decide what reaches users.

DORA research links AI coding agents to lower delivery stability. Unleash lets you release gradually and roll back any feature instantly.

Flagsmith’s open core stops at governance

Flagsmith licenses the core of its platform under BSD-3-Clause, and that license does cover the bulk of the code in the public repository. But Enterprise Edition (EE) features are governed by different terms entirely.

Flagsmith’s own documentation FAQ lists RBAC, SAML/SSO, and certain database integrations as closed-source Enterprise Edition features requiring a license. Its self-hosted page adds that the open-source version and Enterprise self-hosting are not the same thing: the Enterprise plan adds audit logs, role-based access control, SAML/SSO, and change requests.

Those features are not in the public repository, and running them requires an Enterprise agreement. Evaluations built on the open-source-equals-free-to-operate assumption will misjudge Flagsmith’s licensing.

What Flagsmith’s open-source tier leaves out

The restriction isn’t limited to one or two edge features. Flagsmith includes a single-Project cap on the free, self-hosted build, which doesn’t include security and management features like SAML, change requests, and audit logs. Change Requests, Flag Scheduling, Role-Based Access Control, and additional authentication providers are only available on its paid SaaS and Enterprise tiers.

In practice, a team self-hosting Flagsmith’s open-source edition can create and serve feature flags, remote config, and segments, but it skips change approval, audit history, and role-based delegation.

These are the governance controls that let more than one team touch a shared feature flag configuration without one engineer’s mistake reaching production unreviewed.

Side-by-side: Flagsmith OSS vs. Unleash OSS

Unleash draws the line between "open source" and "paid" in a different place. The Unleash open-source build ships basic roles, a basic audit log, the playground, export/import, stale flag detection, and webhooks and integrations. Flagsmith reserves fine-grained roles and audit logging for its paid tiers. Unleash also gates some governance features: change requests, SSO, and SCIM are Enterprise-only, and the open-source edition is limited to one Project, two environments, and 5,000 flags per instance.

Capability	Flagsmith OSS	Unleash OSS
RBAC	Organisation admin or user only	Basic roles
Audit log	None	Basic
Change requests	Not included	Not included
SSO (SAML)	Not included	Not included
Projects	1	1
Environments	Unlimited	2
Playground for testing flags	Not listed	Yes
Frontend evaluation for client SDKs	Served by the self-hosted API; Edge API is SaaS-only, and the Edge Proxy is optional	Frontend API built into the server
Stale flag detection	Not included (Scale-Up and Enterprise, based on change history)	Usage-based flag lifecycle
# of feature flags	Unlimited	5,000 per instance

In Unleash open-source edition, RBAC includes predefined roles like Admin, Editor, and Viewer in every version, not reserved for an Enterprise plan. The platform also includes a playground for testing flag-evaluation outcomes before you ship it, along with the ability to import and export flag configuration between instances as environments evolve. All without negotiating a contract first.

Regarding frontend evaluation, Flagsmith’s Edge API is a globally replicated service for low-latency client evaluation and is part of its SaaS offering. A self-hosted Flagsmith deployment doesn’t use it. Instead, it serves SDK clients from its own API, and it can add the open-source Edge Proxy for evaluation closer to your infrastructure. Unleash builds that evaluation into the server itself via the Frontend API, so a self-hosted deployment doesn’t need a separate component to serve feature flags to a browser or mobile client.

Unleash positions its open-source edition for small-scale deployments and recommends Unleash Enterprise for production workloads. If you need change requests, SSO, or multiple Projects, both projects point you to a paid plan.

Flagsmith’s openness positioning doesn’t match its own tier

Flagsmith’s own website states: "Most open-source tools aren’t as open as they claim." It goes on to say that many tools keep core functionality behind Enterprise plans. That’s a fair critique of the category in general.

And it applies to Flagsmith too. The same page says audit logs, role-based access control, SAML/SSO, and change requests are "not open source, but are available on the Enterprise plan." (Scale-Up and above). Flagsmith is open about where it draws the line. The result is still that the governance controls enterprise teams need are not part of the open-source build.

How the Unleash license protects the project without limiting self-hosters

Flagsmith’s page also warns about tools that “switch to restrictive licences as they scale.” Unleash did change its license in 2026 with the 8.0.0 release, moving its core from Apache 2.0 to AGPLv3. AGPLv3 is an OSI-approved open source license that allows commercial use (unlike SSPL or BSL licenses that restrict commercial use). That same release leaves official open-source Docker images and SDKs under their original permissive terms.

Running Unleash unmodified carries no AGPL obligation, whether you self-host the server, run the official Docker image, or embed an SDK in your application. If you modify the server and let people use it over a network, AGPLv3 asks you to offer those users your modified source code. For an instance only your own team uses, that means sharing the code with your own staff. The license is aimed at companies that would fork Unleash and resell it as a service without contributing back.

Community scale and project history

Comparing community size reveals each project’s current adoption level. Flagsmith’s GitHub repository shows roughly 7.1k stars. Unleash’s repository shows 14.3k stars, more than double Flagsmith’s count and a rough proxy for engineering-team adoption levels.

Unleash has also been open source since 2015, with 45M+ Docker downloads and thousands of production deployments.

This doesn’t make Flagsmith’s open-source tier unusable. Plenty of teams run it for straightforward flagging needs without ever touching RBAC or change requests. Open source is a license term, and the two projects draw the feature-set boundary in different places.

Choose the open-source tier that matches your governance needs

If you’re weighing a self-hosted feature flag platform and need fine-grained role-based access or an audit trail without an Enterprise contract on day one, we’re happy to show Unleash’s open-source edition handling that out of the box. Start a free trial or book a demo of Unleash Enterprise to see it running against your own environment with the complete feature set.

FAQs

Is Flagsmith’s code open source?

Most of it. Flagsmith licenses the core of its platform under BSD-3-Clause, and anyone can read, fork, or self-host that code. Enterprise Edition features such as role-based access control, SAML/SSO, and certain database integrations are separate and closed source, requiring a paid license to run them.

Can I self-host Flagsmith’s Enterprise features without paying for a license?

No. Flagsmith’s own FAQ labels Enterprise Edition features closed source and requires a license to use them. The open-source version is not the same as Enterprise self-hosting, which is a separate paid plan that adds audit logs, fine-grained role-based access control, SAML/SSO, and change requests.

What features does Flagsmith’s open-source tier leave out?

The free, self-hosted build caps an organization at a single Project and withholds Change Requests, Flag Scheduling, fine-grained Role-Based Access Control, Audit Logs, and most additional authentication providers, all of which move to the SaaS or Enterprise tiers.

Does Unleash’s open-source edition include fine-grained RBAC and an audit log?

Yes. In Unleash’s open-source edition, predefined roles like Admin, Editor, and Viewer are available in every version. The edition also includes a basic audit log, the playground, export/import, and stale flag detection, none of which require an Enterprise plan to use. Change requests, SSO, and multiple Projects do require Unleash Enterprise.

Will Unleash’s AGPLv3 license affect a standard self-hosted deployment?

No. The AGPLv3 obligation only applies if you modify the source and make it available to users over a network, such as hosting a modified fork as a commercial SaaS product. Official Docker images and SDKs keep their permissive licenses, so running the official image or embedding an SDK carries no extra obligation.