Licenses and acknowledgements

Main components

• Xray-core: the VPN engine. Mozilla Public License 2.0. Piko uses it unmodified; the source code of the exact version is linked in the list below.
• libXray: MIT license.
• gVisor (through Xray-core's TUN support): Apache License 2.0.
• Go (runtime and standard library) and golang.org/x/mobile: BSD 3-Clause license.
• hev-socks5-tunnel, with hev-socks5-core, hev-task-system and yaml: MIT license. lwIP: BSD 3-Clause license.
• juju/ratelimit (through Xray-core's REALITY transport): LGPL-3.0 with a static-linking exception. Its source code is linked in the list below.
• Android Jetpack, Kotlin, kotlinx, Ktor, OkHttp, Okio, ZXing and Compose Multiplatform: Apache License 2.0.
• The iOS app also contains skiko (Apache License 2.0) with Skia (BSD 3-Clause), ICU data (Unicode License v3) and the Kotlin/Native runtime (Apache License 2.0).
• The split-tunneling presets use package names from sogonov/anubis (MIT license).

Full list

The tables list every third-party component of the Android app with its version and license (snapshot: Android release build of 2026-10-03). The full license texts are inside the app, under Settings → About Piko, and the texts for the native components are here as a file: native-notices.txt.

Each name links to the component's source code.

Piko core: Go modules (53)

Tunnel engine: C components (6)

Android and Kotlin libraries (180)