Questions about XLiteOCR? The source is on GitHub; for anything else, reach out:
contact@edgexene.ioXLiteOCR is not a wrapper around a cloud API. It is a real, CPU-only OCR pipeline you run on your own servers, built entirely from commercially usable open-source components. This page documents exactly what is inside it and how the pieces fit together.
XLiteOCR turns images and PDFs into structured, machine-readable data. There are two modes, both running on plain CPUs with no GPU.
Text with precise bounding boxes and per-line confidence, plus the detected color of each line returned as hex, RGB, and a readable color name.
Passing ?structured=true adds markdown, typed
layout blocks (title / text / table / figure), HTML tables, and
figures vectorized to scalable SVG.
Every layer is a permissively licensed open-source component. There is no GPL or AGPL anywhere in the pipeline, and no proprietary model weights, so the whole thing is free to run, modify, and ship.
| Layer | Component | License |
|---|---|---|
| Language & runtime | Python 3.11+ engine & API -- atop a polyglot native runtime: C++ (PaddlePaddle, PDFium) and Rust (VTracer) | -- |
| Text detection + recognition | PaddleOCR 2.10.0 -- PP-OCRv3 detection + PP-OCRv4 English recognition (code + released weights) | Apache-2.0 |
| Layout, structure & tables | PP-Structure -- document layout analysis, table parsing, markdown reconstruction | Apache-2.0 |
| Inference runtime | PaddlePaddle 3.3.1 -- CPU build, MKL-DNN enabled | Apache-2.0 |
| PDF rasterization | pypdfium2 5.13.0 -- Google PDFium, V8-free build (no JavaScript engine bundled) | BSD-3 / Apache-2.0 |
| Raster → SVG vectorizer | VTracer 0.6.11 -- geometric tracing of figures, logos, and line art (never potrace, which is GPL) | MIT |
| Imaging & numerics | Pillow 12.3.0 + NumPy 1.26.4 -- color detection and array math (deliberately no OpenCV in the color path) | MIT-CMU / BSD-3 |
| HTTP service |
FastAPI 0.139.0 + Uvicorn 0.34.0
-- the /ocr and /health API,
single worker
|
MIT / BSD-3 |
PaddleOCR 2.10.0 with lang='en' serves PP-OCRv3 detection
and PP-OCRv4 English recognition, both Apache-2.0. PP-OCRv4
multilingual weights are a configuration swap; the pipeline shape is
identical. The 63-package pinned dependency closure, resolved from each
package's authoritative license metadata, ships in the source as
THIRD_PARTY_LICENSES.md.
A single pipeline on your own machine. Nothing leaves it, and no document is kept after the request that sent it. A document over 50 pages is refused rather than trimmed, so a result is never a partial answer presented as a complete one, and every frame of a multipage TIFF is read. One document is processed at a time; a request that arrives during another is asked to retry.
Image or PDF is read in, buffering to a temporary file if it is large. PDFs are rasterized page by page with pypdfium2.
PaddleOCR finds text regions and reads them, returning boxes, text, and confidence.
Pillow + NumPy sample the dominant glyph-stroke color of each line.
On request, PP-Structure reconstructs layout into markdown, blocks, and HTML tables.
Figure regions are traced to SVG by VTracer and returned inline as JSON.
An upload exists only for the request that sent it. While that request is in flight it may be buffered to a temporary file on the server, which is released when the request ends. No document is kept afterward, in any location.
Every component runs on ordinary CPUs. No accelerator, no specialized hardware bill.
A test in the source (tests/test_compliance.py) is
a hard license gate: the build fails if any GPL/AGPL component
appears or if the bundled PDFium is not V8-free.
It binds to localhost and expects to sit behind your own reverse proxy and access control. Honest about its boundaries.
XLiteOCR is released under the Apache License 2.0 and is assembled only from commercially usable components: Apache 2.0, MIT, BSD, MIT-CMU, PSF, and the like. There is no GPL, LGPL or AGPL anywhere in the stack. The only copyleft present is MPL-2.0, in certifi and tqdm, and it is weak and file-scoped. Running XLiteOCR obliges you to nothing. If you redistribute those two packages, MPL-2.0 asks you to keep their notices and to point recipients at the source for those files, modified or not. It never reaches your own code.
This release is signed with Sigstore, keyless. There is no public key to manage: the signature is bound to an identity and recorded in a public transparency log.
cosign verify-blob XLiteOCR-1.1.1.zip \
--bundle XLiteOCR-1.1.1.zip.bundle \
--certificate-identity contact@edgexene.io \
--certificate-oidc-issuer https://accounts.google.com
Substitute the version you downloaded. Verify the named artifact
rather than the archives GitHub generates on the fly, which are not
guaranteed to stay byte-identical. The v1.1.1 archive is
1a531282d2425e5de24d4b1b1c558ef72308446a9fed4187dfd08e1f239cac8a.
XLiteOCR is open source under Apache-2.0. Browse or clone the full repository on GitHub, or download a signed release archive from the releases page -- no account, no password either way. The interactive demo stays behind a lightweight login; email us for demo access.