Free tier

All docs

cain signup

No card, no checkout, no sales step. That command creates an account and stores the key.

What free includes#

The whole decision path. Not a demo of it — the real thing, with every stage enforcing:

• Identity — principals, revocation, delegation tokens
• Policy — default-deny, dry runs, content-addressed policy versions
• Authorization — entitlement and budget enforcement
• Risk — the injection screen and the proven-fragment blocklist
• ActionProof — SMT verification of submitted plans
• MCPGate enforcement — in the call path, not a report afterwards
• Evidence — signed decision records and the evidence access log
• The CLI and both SDKs — every command, --json on all of them
• The conformance and red-team suite — cain test
• Self-hosting MCPGate for your own use
• All documentation, examples and integrations

A free account passing the full suite, on the hosted deployment:

$ cain test
  CONFORMANCE: PASSED
  46 passed, 0 failed, 3 skipped

That is the point of the tier. A free tier that withholds the decision path cannot let anyone prove CAIN works, which makes it a demo rather than a tier.

Security is never a paid feature#

Tenant isolation, evidence signing, fail-closed behaviour, and every other security control are included on free and always will be. Selling the safety of the thing we tell you to rely on would be indefensible, and pricing.validate() fails the build if a security control is ever added to the gated list.

The limits#

	Free	Starter	Full
Decisions / month	10,000	250,000	5,000,000
Agents	3	25	500
Workspaces	1	5	50
Evidence retention	7 days	90 days	365 days
MCP servers	3	25	500
Seats	1	5	25
Support	community	email	priority email

Free is bounded by volume and operational scale, not by capability.

Why these things cost money#

Stated plainly, because "we wanted money for it" is not a reason anyone respects:

Gated	Why
High volume	Each decision is real compute and a stored row. Volume is the honest thing to charge for.
Long retention	Storage, and the compliance value of evidence that outlives an investigation.
Fleet management	Managing many agents across environments is an operations product, not a trust control.
SSO / RBAC	Only meaningful with a team, and supporting an identity provider properly costs real engineering.
Seats	Collaboration, not trust.
Support with a response target	Human time. The most honest line item on this list.
Service-level commitments	See /sla — we publish objectives today, not a contractual SLA, and we say so.

Checking your usage#

$ cain status
  tier               free
  decisions          5 of 10,000 used (0.1%)  resets 1st of next month

Shown in cain status rather than hidden behind its own command, because "how much have I used" is the question a free-tier developer asks most often and burying it makes the first sign of a limit a 402 in production.

cain status warns at 75% and the --json output carries the full numbers for alerting.

When you hit the limit#

You get a 402 with the numbers and the upgrade path — not an authentication error:

{
  "error": "monthly decision quota reached on the free tier",
  "used": 10000, "limit": 10000,
  "resets": "the 1st of next month (UTC)",
  "your_credential_is_fine": true,
  "note": "Nothing is wrong with your key or your setup.",
  "upgrade": { "next_tier": "starter", "price_usd": 19.0 }
}

Reporting a spent allowance as "no active subscription" would send you debugging a credential that is perfectly fine, so it does not.

Reads keep working when the quota is spent. Your evidence, your usage figures, your policy and the upgrade page all stay available. Locking you out of your own audit trail at the moment you hit a limit would be both hostile and self-defeating — you cannot investigate an incident from a 402, and you cannot pay us from one either. Only new decisions are refused.

Quota is counted from the billing table#

Not from a separate counter. The number you are shown and the volume you would be billed for come from the same rows, so they cannot drift apart.

Upgrading#

cain status --json | jq .   # see the upgrade path with real prices

Or go to cainstudio.online/pricing. Founding customer pricing is live until 15 November 2026, and a price you sign up at is locked for as long as the subscription stays active.

Self-hosting is free#

MCPGate self-hosted, for your own use, has no quota because we are not running it. See architecture for the deployment models.