The Commercial Open Source Software (COSS) Directory

Keygraph provides a continuous application-security platform for automated penetration testing of source code and running web applications. The platform combines whitebox and blackbox testing with static analysis, software composition analysis, secrets scanning, and remediation workflows. Its open-source Shannon engine uses AI agents to identify attack vectors and validate vulnerabilities with working exploits.

Traverse Research is a Breda-based rendering research and game-engineering company. It develops Evolve, a GPU and AI benchmark, and provides rendering, GPU architecture, and performance engineering for hardware vendors and game studios. Its open-source work includes gpu-allocator, a Rust library for GPU memory allocation across Vulkan, DirectX 12, and Metal, along with graphics, shader, asset, and platform tools.

StreamNative provides a data platform that keeps streaming data available to applications, analytics, and AI agents. Its platform supports native Apache Pulsar and Kafka workloads, with deployment options including managed cloud and private cloud. The platform combines streams and lakehouse tables on shared open infrastructure for messaging, streaming data pipelines, and AI and agent use cases.

Osaurus develops an MIT-licensed macOS application for running task-oriented AI agents with local or cloud models. The app can access user-approved Mac apps, files, and web resources, retain local agent memory, and run multi-step workflows. Built in Swift for Apple Silicon, it provides MCP and model-provider integrations.

Dograh provides a self-hosted platform for building and deploying voice agents. Its visual workflow builder connects telephony, speech-to-text, language-model, and text-to-speech components, with deployment options on customer infrastructure or a managed cloud. The open-source project is designed for teams that need control over their voice-agent stack and data boundaries.

DroneDB, operated by Digipa s.r.l., provides a cloud and self-hosted platform for managing and sharing geospatial data. It supports storage, browser-based visualization, analysis, and automated workflows for orthophotos, point clouds, 3D models, panoramas, and vector data.

Asterisk provides on-premise AI agents that analyze and understand codebases, offering secure and fast development without data exposure.

JUXT develops and supports XTDB, an open-source immutable SQL database for application development, time-travel reporting, and data-compliance use cases. XTDB uses bitemporal records, SQL:2011 capabilities, and flexible handling of semi-structured data. Its cloud-native ACID engine is built on Apache Arrow and designed for object storage. JUXT provides production support, consulting, and training around XTDB.

Edge Security is an information security research and consulting firm that performs security assessments across applications, networks, infrastructure, and cryptography. It also provides reverse engineering, hardened development, and physical-security services. The firm created WireGuard and provides solutions for using and integrating the secure tunnel.

BetterDB develops BetterDB Monitor, a self-hosted or cloud observability platform for Valkey and Redis. It retains slowlog, command history, and client analytics, and provides real-time dashboards, anomaly detection, and Prometheus and OpenTelemetry integrations.

Greenmask develops an open-source tool for data anonymization and test data management. It transforms database data for testing and staging while preserving data relationships and formats. The project provides configuration-driven transformations, subsetting, validation, and synthetic-data capabilities for production-like development workflows.

Mistral AI is focused on developing advanced AI models and technologies. The company specializes in creating large language models (LLMs) to serve enterprise needs. Mistral AI's core products are built on cutting-edge AI/ML technologies.

Databricks is a cloud-based data, analytics, and AI platform designed to help enterprises build, scale, and govern their data infrastructure. It pioneered the data lakehouse architecture, which combines the capabilities of data warehouses and data lakes for unified analytics. It serves enterprise customers.

OpenZeppelin provides security products to build, automate, and operate decentralized applications. Their technologies focus on smart contract security and blockchain infrastructure, serving primarily enterprise clients in the blockchain industry.

Tailwind Labs develops Tailwind CSS, an MIT-licensed utility-first CSS framework for building user interfaces. It also maintains UI-focused resources and commercial products including Tailwind Plus, Headless UI, Heroicons, and the Tailwind CSS playground.

SUSE is a global leader in innovative, reliable and secure enterprise open source solutions, including SUSE Linux, SUSE Rancher, and SUSE Edge.

HashiCorp provides infrastructure automation tools that enable organizations to provision, secure, connect, and run cloud infrastructure. Its products are built on technologies like Go and distributed systems principles, and they are used by enterprises to manage their cloud environments and automate infrastructure workflows. The company focuses on solving the challenges of multi-cloud environments.

Comp AI is an open-source compliance automation platform that helps companies achieve SOC 2, ISO 27001, HIPAA, and GDPR compliance in hours rather than months. The platform uses AI to eliminate compliance busywork, enabling companies to win more deals and accelerate growth while reducing the traditional time and cost associated with compliance frameworks.

Automattic is a company that builds products for the web, including WordPress.com, WooCommerce, Jetpack, and more. Its core products are built on technologies like PHP, JavaScript, and MySQL, and it primarily serves both consumers and enterprises.

groundcover is a full-stack observability platform powered by eBPF and OpenTelemetry that deploys entirely within the customer's own cloud environment using a Bring Your Own Cloud (BYOC) architecture. The platform provides complete visibility into applications, infrastructure, and AI workloads without requiring code changes or instrumentation, and without sampling or cardinality limits. Founded in 2021, groundcover targets engineering teams seeking to replace legacy SaaS observability tools with a cost-efficient, high-fidelity alternative.

LiveKit offers an open-source platform for building real-time audio and video applications. Their tools support low-latency communication and integration with various devices and platforms.

Onyx offers open-source solutions for real-time data processing and analytics, enabling organizations to analyze large datasets efficiently. Their platform supports various data sources and integrations.

Herdr develops an Apache-2.0 runtime that manages persistent terminal sessions for coding agents. Its background server preserves agent sessions across disconnects and machines while identifying whether agents are working, blocked, or idle. The product provides a terminal UI, CLI, socket API, and plugin system for agent tools including Claude Code, Codex, Cursor, and opencode.

Black Forest Labs is an AI research company that develops state-of-the-art generative models for image and video creation. The company creates the FLUX family of models, including FLUX.1 for text-to-image generation, image editing, and in-context image generation, offering both open-weight models and commercial API services.

Arcee AI is a US-based open intelligence lab that builds open-weight foundation models and enterprise agentic AI platforms. The company develops the Arcee Foundation Models (AFM) family and the Trinity model series — including Trinity Large, a 400B sparse open-weight model — and offers Arcee Cloud and Arcee Enterprise for deploying secure, cost-efficient AI agents within enterprise infrastructure. Arcee pioneered the open-source MergeKit library for model merging and DistillKit for model distillation.

Clastix is an Italian infrastructure software company that provides kMetal, a commercial platform for operating Kubernetes fleets with hosted control planes, governance, and self-service provisioning. Its Apache-2.0 open-source projects Kamaji and Capsule provide hosted control-plane management and Kubernetes multi-tenancy capabilities, respectively. The company provides enterprise platform capabilities, support, and professional services built around those projects.

Tiledesk develops an open-source platform for building and deploying conversational AI agents for customer support and business workflows. Its products combine a visual no-code editor, a knowledge base, multichannel messaging, and handoff from agents to human operators. The platform can be self-hosted with Docker Compose or Kubernetes and offers an enterprise edition.

PickNik develops MoveIt Pro, a commercially supported platform for building and deploying robot-arm applications. It leads the growth and maintenance of MoveIt, an open-source ROS framework for motion planning, manipulation, and kinematics. The company also provides robotics services and supports applications in industrial, warehouse, cleaning, and space settings.

Zed Industries provides a code editor designed to facilitate optimal collaboration between human software engineers and AI coding agents. Its IDE incorporates features for integrating AI in debugging, editing, and predictive analysis.

Temporal provides an open-source platform for durable execution, enabling developers to build applications that are resilient to failures. It ensures that workflows can be paused, resumed, and retried without losing state.