--- title: "On whose shoulders · siteBits" description: "The open-source projects siteBits is built on, and the full list of components from the software bill of materials." url: https://sitebits.de/open-source/ lang: en software_version: "0.10.3" --- Open source # On whose shoulders. siteBits is a few tens of thousands of lines of its own code on top of millions written by others. This page names them. - **Viewer:** 47 - **Platform server:** 23 - **MCP server:** 31 - **Import (Python packages):** 98 - **Import container, total:** 3,008 - **Bill of materials:** siteBits 0.10.3 ## Who makes this, and why Behind each name are people. Some are paid by companies that depend on the code, many work in their spare time, often for years. Some projects are carried by foundations, some by a single maintainer. They publish their work so that others can use it, check it and improve it. Without that, a tool like siteBits would not exist: much of it was not built here, but put together from what others patiently developed. If you use one of these projects yourself: a star, a well-written bug report or a small donation helps more than you might think. ## What siteBits uses them for ### In the viewer - [three.js ](https://threejs.org) Draws every point, line and surface in the browser. - [Giro3D ](https://giro3d.org) Streams large point clouds in levels of detail, in real coordinates. - [COPC · laz-perf ](https://copc.io) The cloud format that makes partial loading possible, and the decoder that unpacks it. - [OpenLayers ](https://openlayers.org) The minimap and every flat map view. - [proj4js ](https://github.com/proj4js/proj4js) Converts between coordinate systems, so measurements land where they belong. - [Spark ](https://sparkjs.dev) Renders Gaussian splats next to the point cloud. - [MediaPipe ](https://github.com/google-ai-edge/mediapipe) Face tracking for the window effect, entirely in the browser. ### In the import - [PDAL ](https://pdal.io) Reads, filters and writes point clouds in almost every format. - [PROJ ](https://proj.org) Geodetic transformations, height systems included. - [libE57Format · pye57 ](https://github.com/asmaloney/libE57Format) Opens E57 scans from terrestrial laser scanners. - [laspy ](https://github.com/laspy/laspy) LAS and LAZ in Python. - [NumPy · SciPy ](https://numpy.org) The arithmetic underneath every check and conversion. - [meshoptimizer · KTX-Software ](https://github.com/zeux/meshoptimizer) Make meshes and textures small enough for a phone. ### On the server - [FastAPI · Starlette · Uvicorn ](https://fastapi.tiangolo.com) The platform API and its web server. - [SQLite ](https://sqlite.org) Projects, accounts and findings in a single file. - [py\_webauthn ](https://github.com/duo-labs/py%5Fwebauthn) Passkeys instead of passwords. - [Argon2 · cryptography ](https://cryptography.io) Password hashing and signatures done properly. - [Caddy ](https://caddyserver.com) HTTPS with automatic certificates in front of every instance. - [Model Context Protocol ](https://modelcontextprotocol.io) The open standard that lets AI assistants use siteBits as a tool. ### In every release check - [Trivy · Syft ](https://trivy.dev) Software bills of materials and vulnerability scans. - [OSV ](https://osv.dev) The open vulnerability database every release is checked against. - [Semgrep · Bandit ](https://semgrep.dev) Static analysis of our own code. - [CycloneDX · REUSE ](https://cyclonedx.org) Standards for the parts list and for licence information in every file. - [Playwright · axe-core ](https://playwright.dev) Click through the viewer in real browsers and check accessibility. - [Python · uv · Node.js · Vite · TypeScript ](https://www.python.org) The languages and build tools everything above is written with. ## Every component, from the bill of materials Generated from the CycloneDX SBOM of siteBits 0.10.3\. Name, version and licence of every component that ships. #### Viewer47 | Component | Version | Licence | | -------------------------- | --------- | --------------------------- | | 3d-tiles-renderer | 0.4.28 | Apache-2.0 | | basis-universal-transcoder | 1.50.0 | Apache-2.0 AND BSD-3-Clause | | chart.js | 3.9.1 | MIT | | copc | 0.0.8 | MIT | | cross-fetch | 3.2.0 | MIT | | earcut | 2.2.4 | ISC | | fflate | 0.8.3 | MIT | | float16 | 3.9.3 | MIT | | geojson | 7946.0.16 | MIT | | geotiff | 3.0.5 | MIT | | giro3d | 2.0.4 | MIT | | laz-perf | 0.0.7 | Apache-2.0 | | lerc | 3.0.0 | Apache-2.0 | | lil-gui | 0.17.0 | MIT | | lru-cache | 10.4.3 | ISC | | MediaPipe Face Landmarker | 1 | Apache-2.0 | | mgrs | 1.0.0 | MIT | | node-fetch | 2.7.0 | MIT | | numcodecs | 0.3.2 | MIT | | ol | 10.10.0 | BSD-2-Clause | | pako | 2.2.0 | (MIT AND Zlib) | | parse-headers | 2.0.6 | MIT | | pbf | 4.0.2 | BSD-3-Clause | | pmtiles | 4.5.0 | BSD-3-Clause | | point-geometry | 1.1.0 | ISC | | proj4 | 2.22.0 | MIT | | protocol-buffers-schema | 3.6.1 | MIT | | quick-lru | 6.1.2 | MIT | | quickselect | 3.0.0 | ISC | | rbush | 4.0.0 | MIT | | rbush | 4.0.1 | MIT | | reference-spec-reader | 0.2.0 | MIT | | resolve-protobuf-schema | 2.1.0 | MIT | | spark | 2.3.0 | MIT | | storage | 0.2.0 | MIT | | tasks-vision | 1.0.1 | Apache-2.0 | | three | 0.180.0 | MIT | | tr46 | 0.0.3 | MIT | | unzipit | 2.0.0 | MIT | | vector-tile | 2.0.5 | BSD-3-Clause | | web-worker | 1.5.0 | Apache-2.0 | | webidl-conversions | 3.0.1 | BSD-2-Clause | | whatwg-url | 5.0.0 | MIT | | wkt-parser | 1.5.6 | MIT | | xml-utils | 1.10.2 | CC0-1.0 | | zarrita | 0.7.5 | MIT | | zstddec | 0.2.0 | MIT AND BSD-3-Clause | #### Platform server23 | Component | Version | Licence | | -------------------- | ------- | -------------------------- | | annotated-doc | 0.0.5 | MIT | | annotated-types | 0.8.0 | MIT | | anyio | 4.15.1 | MIT | | argon2-cffi | 25.1.0 | MIT | | argon2-cffi-bindings | 26.1.0 | MIT | | cbor2 | 6.1.4 | MIT | | cffi | 2.1.1 | MIT-0 | | click | 8.5.0 | BSD-3-Clause | | cryptography | 50.0.1 | Apache-2.0 OR BSD-3-Clause | | fastapi | 0.141.1 | MIT | | h11 | 0.16.0 | MIT | | idna | 3.20 | BSD-3-Clause | | pyasn1 | 0.6.4 | BSD-2-Clause | | pyasn1\_modules | 0.4.2 | BSD License | | pycparser | 3.0 | BSD-3-Clause | | pydantic | 2.13.5 | MIT | | pydantic\_core | 2.46.5 | MIT | | pyOpenSSL | 26.4.0 | Apache Software License | | starlette | 1.6.0 | BSD-3-Clause | | typing\_extensions | 4.16.0 | PSF-2.0 | | typing-inspection | 0.4.4 | MIT | | uvicorn | 0.53.0 | BSD-3-Clause | | webauthn | 3.0.0 | BSD-3-Clause | #### MCP server31 | Component | Version | Licence | | ------------------------- | --------- | ---------------------------------------------- | | annotated-types | 0.8.0 | MIT | | anyio | 4.15.1 | MIT | | attrs | 26.1.0 | MIT | | certifi | 2026.7.22 | MPL-2.0 / Mozilla Public License 2.0 (MPL 2.0) | | cffi | 2.1.1 | MIT-0 | | click | 8.5.0 | BSD-3-Clause | | cryptography | 50.0.1 | Apache-2.0 OR BSD-3-Clause | | h11 | 0.16.0 | MIT | | httpcore | 1.0.9 | BSD-3-Clause | | httpcore2 | 2.13.0 | BSD-3-Clause | | httpx | 0.28.1 | BSD-3-Clause / BSD License | | httpx2 | 2.13.0 | BSD-3-Clause | | idna | 3.20 | BSD-3-Clause | | jsonschema | 4.26.0 | MIT | | jsonschema-specifications | 2025.9.1 | MIT | | mcp | 2.2.0 | MIT | | mcp-types | 2.2.0 | MIT | | opentelemetry-api | 1.44.0 | Apache-2.0 | | pycparser | 3.0 | BSD-3-Clause | | pydantic | 2.13.5 | MIT | | pydantic\_core | 2.46.5 | MIT | | PyJWT | 2.15.0 | MIT | | python-multipart | 0.0.32 | Apache-2.0 | | referencing | 0.37.0 | MIT | | rpds-py | 2026.6.3 | MIT | | sse-starlette | 3.4.11 | BSD-3-Clause | | starlette | 1.6.0 | BSD-3-Clause | | truststore | 0.10.4 | MIT | | typing\_extensions | 4.16.0 | PSF-2.0 | | typing-inspection | 0.4.4 | MIT | | uvicorn | 0.53.0 | BSD-3-Clause | #### Import (Python packages)98 98 Python packages are listed; the import container holds 3,008 components in total, including the operating system. The full SBOM is part of every release. | Component | Version | Licence | | ----------------------- | --------- | -------------------------------------------------- | | annotated-types | 0.8.0 | MIT | | anyio | 4.15.1 | MIT | | archspec | 0.2.5 | Apache-2.0 OR MIT | | autocommand | 2.2.2 | LGPLv3 | | backports-tarfile | 1.2.0 | MIT | | boltons | 26.2.0 | not stated | | brotli | 1.2.0 | MIT | | build | 1.6.0 | MIT | | cached-property | 2.0.1 | BSD | | certifi | 2026.7.22 | MPL-2.0 | | charset-normalizer | 3.5.1 | MIT | | colorama | 0.4.6 | BSD-3-Clause | | conda | 26.7.2 | BSD-3-Clause | | conda | 26.7.3 | BSD-3-Clause | | conda-index | 0.13.0 | BSD-3-Clause | | conda-libmamba-solver | 26.7.0 | BSD-3-Clause | | conda-lockfiles | 0.2.1 | BSD-3-Clause | | conda-pack | 0.0.0 | BSD-3-Clause | | conda-package-handling | 2.6.0 | not stated | | conda-package-streaming | 0.13.0 | not stated | | conda-pypi | 0.11.0 | MIT | | conda-rattler-solver | 0.1.1 | BSD-3-Clause | | conda-self | 0.2.1 | not stated | | dataclasses-json | 0.6.7 | MIT | | Deprecated | 3.0.0 | MIT | | distro | 1.9.0 | Apache License, Version 2.0 | | exceptiongroup | 1.3.1 | not stated | | frozendict | 2.4.7 | LGPL v3 | | h11 | 0.16.0 | MIT | | h2 | 4.4.1 | MIT | | hpack | 4.2.0 | MIT | | httpcore | 1.0.9 | BSD-3-Clause | | httpx | 0.28.1 | BSD-3-Clause | | hyperframe | 6.1.0 | MIT | | idna | 3.19 | BSD-3-Clause | | importlib-metadata | 8.7.1 | Apache-2.0 | | importlib-metadata | 9.0.1 | Apache-2.0 | | importlib-resources | 7.1.0 | Apache-2.0 | | installer | 1.0.1 | MIT | | jaraco-context | 6.1.0 | MIT | | jaraco-functools | 4.4.0 | MIT | | jaraco-text | 4.0.0 | MIT | | jinja2 | 3.1.6 | not stated | | laspy | 2.7.0 | BSD-2-Clause | | lazrs | 0.8.2 | MIT | | libmambapy | 2.9.0 | BSD-3-Clause | | markupsafe | 3.0.3 | BSD-3-Clause | | marshmallow | 3.26.2 | MIT | | menuinst | 2.5.2 | BSD-3-Clause | | meshoptimizer | 0.2.30a0 | MIT | | more-itertools | 10.8.0 | MIT | | msgpack | 1.2.2 | Apache-2.0 | | mypy\_extensions | 1.1.0 | MIT | | numpy | 2.5.3 | BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0 | | packaging | 26.3 | Apache-2.0 OR BSD-2-Clause | | packaging | 26.0 | Apache-2.0 OR BSD-2-Clause | | pathspec | 1.1.1 | not stated | | pdal | 3.5.4 | BSD-3-Clause | | pdal-plugins | 1.6.7 | BSD-3-Clause | | pillow | 12.3.0 | MIT-CMU | | pip | 26.2.1 | MIT | | platformdirs | 4.11.6 | MIT | | platformdirs | 4.4.0 | MIT | | pluggy | 1.6.0 | MIT | | py-rattler | 0.25.0 | BSD-3-Clause | | pybind11 | 3.1.0 | BSD-3-Clause | | pybind11-global | 3.1.0 | BSD-3-Clause | | pycosat | 0.6.6 | MIT | | pydantic | 2.13.5 | MIT | | pydantic-core | 2.46.5 | MIT | | pye57 | 0.4.19 | MIT | | pygltflib | 1.16.5 | MIT | | pyproj | 3.8.0 | MIT | | pyproject-hooks | 1.2.0 | MIT | | pyquaternion | 0.9.9 | MIT | | pysocks | 1.7.1 | BSD | | requests | 2.34.2 | Apache-2.0 | | ruamel-yaml | 0.19.1 | MIT | | ruamel-yaml-clib | 0.2.15 | MIT | | scikit-build-core | 1.0.3 | Apache-2.0 | | scipy | 1.18.1 | BSD License | | setuptools | 84.0.0 | MIT | | sniffio | 1.3.1 | MIT OR Apache-2.0 | | tomli | 2.4.0 | MIT | | tomli | 2.4.1 | MIT | | tomli-w | 1.2.0 | MIT | | tqdm | 4.70.0 | MPL-2.0 AND MIT | | truststore | 0.10.4 | MIT | | typing\_extensions | 4.16.0 | PSF-2.0 | | typing-extensions | 4.16.0 | PSF-2.0 | | typing-inspect | 0.9.0 | MIT | | typing-inspection | 0.4.4 | MIT | | unearth | 0.18.3 | MIT | | urllib3 | 2.7.0 | MIT | | wheel | 0.46.3 | MIT | | wrapt | 2.5.0 | BSD-2-Clause | | zipp | 3.23.0 | MIT | | zipp | 4.1.0 | MIT | This website uses Astro, three.js, GSAP and the fonts Familjen Grotesk and Martian Mono (SIL Open Font License). GSAP is free to use but under its own licence, not an open-source one.