Open-source components bundled with MFCommander
MFCommander is proprietary software. It links the third-party libraries listed below. Each entry names its license, and every license text it names is in this folder.
The libraries under Components are dynamically linked and shipped as separate files inside the application bundle (MFCommander.app/Contents/Frameworks/). A file name carries its library's version, which a later build can change. Many of them are used under the GNU Lesser General Public License: version 2.1 (LGPL-2.1, full text in LGPL-2.1.txt) or, for FFmpeg, version 3 (LGPL-3.0, in LGPL-3.0.txt, which supplements the GNU General Public License version 3 in GPL-3.0.txt). As permitted and required by the LGPL, you may replace those with your own compatible builds — see Replacing a bundled library below. The others are under the permissive licenses their entries name.
The libraries under Statically linked components are compiled into the executable under permissive licenses, which ask that their copyright and permission notices travel with the distribution rather than that a relink path be kept open.
MFCommander's own source that calls these libraries only uses their public API and is not a derivative work of them; it remains proprietary.
SMBClientProvider).libsmb2-COPYING.txt).aff9fa6, the revision AMSMB2 4.0.3 vendors, with one change by MFCommander: lib/init.c adds the bounds check from libsmb2's own fix for CVE-2025-57632 (upstream commit 5e75eebf). Source availability says how to get this source.Contents/Frameworks/libAMSMB2.dylib (libsmb2 is statically compiled into this dynamic library together with the AMSMB2 wrapper).NFSClientProvider).lib and include directories; the .x protocol definitions and generated files are simplified BSD — see libnfs-COPYING.txt).Contents/Frameworks/libnfs.16.dylib.AppleDeviceProvider), over AFC and HouseArrest through macOS's own usbmuxd.libimobiledevice-COPYING.LESSER.txt, libimobiledevice-glue-COPYING.txt, libusbmuxd-COPYING.txt, and libplist-COPYING.LESSER.txt.Contents/Frameworks/libimobiledevice-1.0.6.dylib, libimobiledevice-glue-1.0.0.dylib, libusbmuxd-2.0.7.dylib, libplist-2.0.4.dylib (libplist-2.0.12.dylib from libplist 2.8).iproxy and inetcat utilities and libimobiledevice's command-line tools are GPL-2.0 and are never bundled — only the LGPL libraries are.openssl-LICENSE.txt.Contents/Frameworks/libssl.3.dylib, libcrypto.3.dylib.--disable-gpl --enable-version3, which, as its FFmpeg-LICENSE.md explains, makes the build LGPL version 3 — see LGPL-3.0.txt and GPL-3.0.txt.Contents/Frameworks/libavcodec.61.dylib, libavdevice.61.dylib, libavfilter.10.dylib, libavformat.61.dylib, libavutil.59.dylib, libswresample.5.dylib, libswscale.8.dylib.-Dgpl=false, which, as its mpv-Copyright.txt explains, makes the build LGPL version 2.1 or later — see LGPL-2.1.txt.Contents/Frameworks/libmpv.2.dylib.Each of these is Homebrew's build of the upstream project linked, loaded by mpv or by another library in this table, and never called by MFCommander directly.
| Library | Loaded by | License | Upstream | Shipped as |
|---|---|---|---|---|
| libplacebo (GPU video rendering) | mpv | LGPL-2.1-or-later — LGPL-2.1.txt | https://code.videolan.org/videolan/libplacebo | libplacebo.360.dylib |
| shaderc, with glslang, SPIRV-Tools and SPIRV-Headers compiled in (shader compilation) | libplacebo | Apache-2.0 — shaderc-LICENSE.txt and SPIRV-Tools-LICENSE.txt; glslang's licenses are in glslang-LICENSE.txt and SPIRV-Headers' in SPIRV-Headers-LICENSE.txt | https://github.com/google/shaderc | libshaderc_shared.1.dylib |
| Vulkan Loader | mpv, libplacebo | Apache-2.0 — vulkan-loader-LICENSE.txt | https://github.com/KhronosGroup/Vulkan-Loader | libvulkan.1.dylib |
| Little CMS (color management) | mpv, libplacebo | MIT — lcms2-LICENSE.txt | https://www.littlecms.com/ | liblcms2.2.dylib |
| zimg (image scaling) | mpv | WTFPL — zimg-COPYING.txt | https://github.com/sekrit-twc/zimg | libzimg.2.dylib |
| libjpeg-turbo | mpv | IJG, BSD-3-Clause and zlib — libjpeg-turbo-LICENSE.md. This software is based in part on the work of the Independent JPEG Group. | https://www.libjpeg-turbo.org/ | libjpeg.8.dylib |
| libbluray (Blu-ray reading) | mpv | LGPL-2.1-or-later — LGPL-2.1.txt | https://www.videolan.org/developers/libbluray.html | libbluray.4.dylib |
| libudfread (UDF reading) | libbluray | LGPL-2.1-or-later — LGPL-2.1.txt | https://code.videolan.org/videolan/libudfread | libudfread.3.dylib |
| libass (subtitle rendering) | mpv | ISC — libass-COPYING.txt | https://github.com/libass/libass | libass.9.dylib |
| GNU FriBidi (bidirectional text) | libass | LGPL-2.1-or-later — LGPL-2.1.txt | https://github.com/fribidi/fribidi | libfribidi.0.dylib |
| libunibreak (line breaking) | libass | zlib — libunibreak-LICENCE.txt | https://github.com/adah1972/libunibreak | libunibreak.8.dylib |
| HarfBuzz (text shaping) | libass | MIT ("Old MIT") — harfbuzz-COPYING.txt | https://github.com/harfbuzz/harfbuzz | libharfbuzz.0.dylib |
| Graphite (font rendering) | HarfBuzz | MIT, one of the four licenses its graphite2-LICENSE.txt offers | https://graphite.sil.org/ | libgraphite2.3.dylib |
| FreeType (font rasterizing) | libass, libbluray, Fontconfig, HarfBuzz | The FreeType License — freetype-FTL.txt, chosen as freetype-LICENSE.txt allows. Portions of this software are copyright © 2026 The FreeType Project (https://freetype.org). All rights reserved. | https://freetype.org | libfreetype.6.dylib |
| libpng | FreeType | libpng License version 2 — libpng-LICENSE.txt | https://www.libpng.org/pub/png/libpng.html | libpng16.16.dylib |
| Fontconfig (font lookup) | libbluray | MIT-style — fontconfig-COPYING.txt | https://www.freedesktop.org/wiki/Software/fontconfig/ | libfontconfig.1.dylib |
| GLib | HarfBuzz | LGPL-2.1-or-later — LGPL-2.1.txt | https://docs.gtk.org/glib/ | libglib-2.0.0.dylib |
| libintl, from GNU gettext (message catalogs) | GLib, Fontconfig | LGPL-2.1-or-later — LGPL-2.1.txt | https://www.gnu.org/software/gettext/ | libintl.8.dylib |
| PCRE2 (regular expressions) | GLib | BSD-3-Clause, with the PCRE2 exception — pcre2-LICENCE.md | https://www.pcre.org/ | libpcre2-8.0.dylib |
Sparkle-LICENSE.txt.Contents/Frameworks/Sparkle.framework.TerminalSurfaceView). MFCommander opens the pseudo-terminal and owns the child process itself, so SwiftTerm's own process-spawning path is never used.SwiftTerm-LICENSE.txt.Contents/MacOS/MFCommander, with its resource bundle alongside at Contents/MacOS/SwiftTerm_SwiftTerm.bundle.These are compiled into Contents/MacOS/MFCommander. Citadel, SwiftNIO SSH and the packages under them make the SFTP connection; Swift Markdown and cmark-gfm render the viewer's Markdown preview. Each ships as published at the version named, except for the changes its entry describes.
| Package | Used for | License | Source |
|---|---|---|---|
| Citadel 0.12.1 | the SFTP connection's SSH client | MIT — Citadel-LICENSE.txt, © 2022 Orlandos; the OpenBSD Blowfish and bcrypt code it compiles in, which reads passphrase-protected OpenSSH keys, is under the BSD and ISC terms in Citadel-bcrypt-NOTICE.txt. This product includes software developed by Niels Provos. | https://github.com/orlandos-nl/Citadel. MFCommander's copy changes it: its manifest names the SwiftNIO SSH copy below, and an RSA key also signs with SHA-256 and SHA-512 (RFC 8332), which current OpenSSH servers require. |
| SwiftNIO SSH 0.3.6, the Wellz26 fork | the SSH protocol under Citadel | Apache-2.0 — Apache-2.0.txt | https://github.com/Wellz26/swift-nio-ssh, a fork of https://github.com/apple/swift-nio-ssh. MFCommander's copy changes it: it adds the ECDSA signature check from Apple's fix for CVE-2026-43798, and a sign-in request names the algorithm its RSA key signs with (RFC 8332). |
| SwiftNIO 2.103.0 | the network layer under SwiftNIO SSH | Apache-2.0 — Apache-2.0.txt, with its swift-nio-NOTICE.txt | https://github.com/apple/swift-nio |
| Swift Crypto 3.15.1, with BoringSSL compiled in | SSH's cryptography, host-key fingerprints, and the code challenge of cloud sign-ins | Apache-2.0 — Apache-2.0.txt, with its swift-crypto-NOTICE.txt; the BoringSSL sources it carries are under the same license | https://github.com/apple/swift-crypto |
| Swift ASN.1 1.7.3 | key encoding under Swift Crypto | Apache-2.0 — Apache-2.0.txt, with its swift-asn1-NOTICE.txt | https://github.com/apple/swift-asn1 |
| BigInt 5.7.0 | Citadel's RSA arithmetic | MIT — BigInt-LICENSE.md, © 2016–2017 Károly Lőrentey | https://github.com/attaswift/BigInt |
| Swift Atomics 1.3.1 | used by SwiftNIO | Apache-2.0 with the Runtime Library Exception — Apache-2.0-with-runtime-library-exception.txt | https://github.com/apple/swift-atomics |
| Swift Collections 1.7.1 | used by SwiftNIO | Apache-2.0 with the Runtime Library Exception — Apache-2.0-with-runtime-library-exception.txt | https://github.com/apple/swift-collections |
| SwiftLog 1.15.1 | the logging interface SwiftNIO and Citadel write to | Apache-2.0 — Apache-2.0.txt, with its swift-log-NOTICE.txt | https://github.com/apple/swift-log |
Swift Markdown, at revision 27b7fc1a19 | the viewer's Markdown preview | Apache-2.0 with the Runtime Library Exception — swift-markdown-LICENSE.txt, with its swift-markdown-NOTICE.txt | https://github.com/swiftlang/swift-markdown |
cmark-gfm, as swift-cmark at revision 0101bf2c6f | Markdown parsing under Swift Markdown | BSD-2-Clause, with the licenses of the code it includes — swift-cmark-COPYING.txt, © 2014 John MacFarlane and the others it names | https://github.com/swiftlang/swift-cmark |
MFCommander changes three of these libraries and no others: libsmb2, SwiftNIO SSH and Citadel, each as its entry describes. FFmpeg and mpv are built from the upstream release archives their entries name. The libraries described as from Homebrew are Homebrew's builds of the upstream projects linked, and Homebrew's formula for each (https://github.com/Homebrew/homebrew-core) records the exact source it builds and any patch it applies. For every library MFCommander does not change, the upstream projects and those formulae are our source offer.
libsmb2 and AMSMB2, as MFCommander ships them, are used under the LGPL-2.1 with MFCommander's change. For at least three years after we last distribute a version of MFCommander that contains them, we will provide their complete source, including that change, to anyone who asks at [email protected], for no more than the cost of providing it. If a later build changes another library used under the LGPL, its entry and this section will say so.
The application bundle is signed with the com.apple.security.cs.disable-library-validation entitlement, so a .dylib you build yourself will load even though it is not signed by our Developer ID. To substitute your own build of a library above that is used under the LGPL — libsmb2/AMSMB2, libnfs, libimobiledevice, libimobiledevice-glue, libusbmuxd, libplist, FFmpeg, mpv, libplacebo, libbluray, libudfread, GNU FriBidi, GLib or libintl:
.dylib from the upstream source (keep the same install name / SONAME — for example @rpath/libAMSMB2.dylib, @rpath/libnfs.16.dylib, @rpath/libimobiledevice-1.0.6.dylib, @rpath/libmpv.2.dylib, or @rpath/libavcodec.61.dylib). FFmpeg and mpv are built without their GPL parts (FFmpeg with --disable-gpl --enable-version3 --enable-shared, mpv with -Dlibmpv=true -Dgpl=false); a replacement built with them enabled would be GPL-licensed instead.MFCommander.app/Contents/Frameworks/.codesign --force --deep --sign - MFCommander.app.Connection rows, tabs and detail headers show a service's mark where the row is that service. The marks are single-colour vectors in Contents/MacOS/MFCommander_MFCommander.bundle/, and each stays a trademark of its owner, used only to name that service.
DockerIcon.svg) and Kubernetes (KubernetesIcon.svg): paths from Simple Icons 16.33.0, released under CC0 1.0, which Simple Icons traces from each owner's published artwork (Docker media resources; the logo/ directory of kubernetes/kubernetes). Docker is a trademark of Docker, Inc.; Kubernetes is a registered trademark of The Linux Foundation.S3BucketIcon.svg): a plain bucket drawn for MFCommander, not Amazon's mark, because the connection serves any S3-compatible endpoint.DropboxIcon.svg, GoogleDriveIcon.svg, OneDriveIcon.svg): each owner's mark, rendered as a single-colour template. Dropbox, Google Drive and OneDrive are trademarks of Dropbox, Inc., Google LLC and Microsoft Corporation.MFCommander application footage and branding: MFSoft. The Talos overview is an owner-supplied screenshot. Logs contain synthetic demonstration data.
The launch film’s video viewer displays a muted excerpt from Tears of Steel, © Blender Foundation, mango.blender.org, licensed under CC BY 3.0. The excerpt is scaled and framed inside an MFCommander recording.
The image viewer displays Lago di Braies, a photograph by Luca Bravo, under the Unsplash License.
Launch and Kubernetes film music: Cat Walk by Arulo, Mixkit, under the Mixkit Music Free License.
Sound effects: Whoosh_Rope.wav by Nox_Sound and Riser Hit sfx 078 by AudioPapkin, both CC0.