Here is my unpopular opinion: there is no list. Everyone wants a definitive list of open source LLMs you can use commercially, but no fixed list can exist. Licenses change, and "open source" means different things to different labs. There are families worth knowing, though. Here is the version I would give a friend.
Apache 2.0 or MIT: the cleanest starting point. Permissive, well understood, no user-count thresholds. Plenty of strong community models ship under these, and if you are hunting for the best open source LLM for commercial use, I would start the search here. Then the Llama family: commercially usable, but with the 700M MAU threshold and an acceptable use policy you actually have to read. Google's Gemma: commercially usable under its own terms of use, which are not an open source license in the traditional sense. Read them separately. "Google released it" is not a license grant.
Shortlist on capability first. Then check the license of the exact checkpoint you plan to ship, because licenses attach to versions, not families. The checkpoint you tested in March can carry different terms than the one you deploy in September. An open source model license comparison database helps here, but only if it tracks per version. Family-level verdicts go stale fast. I do not trust them.
Do not miss the weights-versus-code split either. Some releases license the code as Apache 2.0 while the weights sit under a separate model license. The repo README is not the license. Open the LICENSE file and the model card separately. They sometimes disagree, and when they do, it is a fun afternoon for your lawyer.
My rule of thumb: an AI model commercial rights lookup tool gives you the verdict, but you sanity-check the actual file before shipping. One more filter most people skip: support. A permissively licensed model from a lab that abandons it is worse than a slightly restricted model with an active community. Licenses matter. So does the ecosystem keeping the weights useful.
I maintain commercial-use verdicts for 200 models at localaitools.fyi, and I write clearance reports if you want a second pair of eyes before you ship.