Unpopular opinion: there is no definitive list. Licenses change and "open source" means different things to different labs. There are families worth knowing. - Apache 2.0 or MIT: the cleanest starting point. No thresholds. Start your search here. - Llama: commercially usable, with the 700M MAU threshold and an acceptable use policy you actually have to read. - Gemma: commercially usable under Google's own terms, which are not an open source license. Read them separately. - Check the license of the exact checkpoint you will ship. Family-level verdicts go stale fast. - Watch the weights-vs-code split: code can be Apache while weights sit under a separate model license. I keep commercial-use verdicts for 200 models, and PrivateLLM deploy sets up the licensed model on your own AWS for $50 plus usage.