Question 1

Is Suvra really free in production?

Accepted Answer

Yes. Suvra is Apache-2.0 licensed — free including production and commercial use, with no license fee and no phone-home requirement. The Free tier is the CLI, the local zero-config firewall, a local dashboard, and a local SQLite audit trail for one agent, self-hosted forever.

Question 2

What do I pay for?

Accepted Answer

Never the software itself. Team and Enterprise pay for the hosted control plane and the features built on it: Slack approvals, a shared dashboard and audit trail across your agents, Evals, the Learning Loop, Analytics, audit export, RBAC, SSO-ready identity, compliance report packs, enforcement nodes, and priority support.

Question 3

Which agent runtimes are supported?

Accepted Answer

Claude Code, OpenAI Codex, OpenClaw, and Hermes have first-class CLI integrations (suvra init claude-code / codex / hermes), plus the Claude Agent SDK via suvra_hook. Any other stdio MCP server can be firewalled with suvra mcp wrap -- <cmd>, which gates every tools/call through the same engine.

Question 4

How do Slack approvals work?

Accepted Answer

Risky actions pause and wait for a human instead of running or silently failing. Set SUVRA_APPROVAL_WEBHOOK_URL and SUVRA_APPROVAL_WEBHOOK_FORMAT=slack to get a formatted Slack Block Kit message with the action, the reason, and an approve/deny link; SUVRA_DASHBOARD_URL makes that link deep-link straight to the approval in your dashboard.

Question 5

Can I self-host everything?

Accepted Answer

Yes, forever, on the Free tier — CLI, local firewall, local dashboard, and local audit trail on your own infrastructure with no ongoing cost. Team and Enterprise add a shared control plane; Enterprise can also run it with pip install "suvra[postgres]" or docker compose up -d --build.

Question 6

What's the difference between the classifier and the policy engine?

Accepted Answer

The classifier is zero-config and built in — deterministic, regex/parser-based, no LLM and no network call, sub-millisecond. When you add a policy file, the classifier keeps running alongside it and the more restrictive of the two decisions wins: the classifier is a floor, not a ceiling.

Question 7

What are enforcement nodes?

Accepted Answer

Enforcement nodes are lightweight Suvra runtimes deployed near your agents. They enforce policy locally against a cached, signed policy bundle, keep working fail-closed if the control plane is temporarily unreachable, and forward approvals and audit events back once connected. They're an Enterprise feature.

Question 8

What's in the compliance report packs?

Accepted Answer

SOC 2, NIST AI RMF, and ISO 27001 coverage reports generated straight from the explainable audit trail your agents already produce — no separate logging pipeline to build or maintain. Compliance report packs are included in Enterprise.

Feature	Free	Team	Enterprise
Agents	1	Up to 10	Custom
Zero-config classifier
Local policy engine
Local dashboard + audit
Slack approvals
Shared control plane
Evals (quality-drift detection)
Learning Loop
Analytics
Full audit export (CSV/JSON)
RBAC (multi-role, tenant users)
SSO-ready identity
Compliance report packs (SOC 2 / NIST / ISO 27001)
Enforcement nodes (fail-closed, offline)
Memory / Runtime / Gateway modules			Preview
Support	Community	Standard	Priority

Free and open source. Pay for the control plane.

Free

Team

Enterprise

Feature comparison

Frequently asked questions