Developer documentation

Free tier

Last reviewed 31 August 2026

Free tier

cain signup

No card, no checkout, no sales step. That command creates an account and stores

the key.

What free includes

The whole decision path. Not a demo of it — the real thing, with every stage

enforcing:

• Identity — principals, revocation, delegation tokens
• Policy — default-deny, dry runs, content-addressed policy versions
• Authorization — entitlement and budget enforcement
• Risk — the injection screen and the proven-fragment blocklist
• ActionProof — SMT verification of submitted plans
• MCPGate enforcement — in the call path, not a report afterwards
• Evidence — signed decision records and the evidence access log
• The CLI and both SDKs — every command, --json on all of them
• The conformance and red-team suite — cain test
• Self-hosting MCPGate for your own use
• All documentation, examples and integrations

A free account passing the full suite, on the hosted deployment:

$ cain test
  CONFORMANCE: PASSED
  46 passed, 0 failed, 3 skipped

That is the point of the tier. A free tier that withholds the decision path

cannot let anyone prove CAIN works, which makes it a demo rather than a tier.

Security is never a paid feature

Tenant isolation, evidence signing, fail-closed behaviour, and every other

security control are included on free and always will be. Selling the safety of

the thing we tell you to rely on would be indefensible, and

pricing.validate() fails the build if a security control is ever added to the

gated list.

The limits

Free is bounded by volume and operational scale, not by capability.

Why these things cost money

Stated plainly, because "we wanted money for it" is not a reason anyone respects:

Checking your usage

$ cain status
  tier               free
  decisions          5 of 10,000 used (0.1%)  resets 1st of next month

Shown in cain status rather than hidden behind its own command, because "how

much have I used" is the question a free-tier developer asks most often and

burying it makes the first sign of a limit a 402 in production.

cain status warns at 75% and the --json output carries the full numbers for

alerting.

When you hit the limit

You get a 402 with the numbers and the upgrade path — not an authentication

error:

{
  "error": "monthly decision quota reached on the free tier",
  "used": 10000, "limit": 10000,
  "resets": "the 1st of next month (UTC)",
  "your_credential_is_fine": true,
  "note": "Nothing is wrong with your key or your setup.",
  "upgrade": { "next_tier": "starter", "price_usd": 19.0 }
}

Reporting a spent allowance as "no active subscription" would send you debugging

a credential that is perfectly fine, so it does not.

Reads keep working when the quota is spent. Your evidence, your usage figures,

your policy and the upgrade page all stay available. Locking you out of your own

audit trail at the moment you hit a limit would be both hostile and

self-defeating — you cannot investigate an incident from a 402, and you cannot

pay us from one either. Only new decisions are refused.

Quota is counted from the billing table

Not from a separate counter. The number you are shown and the volume you would be

billed for come from the same rows, so they cannot drift apart.

Upgrading

cain status --json | jq .   # see the upgrade path with real prices

Or go to cainstudio.online/pricing. Founding

customer pricing is live until 15 November 2026, and a price you sign up at is

locked for as long as the subscription stays active.

Self-hosting is free

MCPGate self-hosted, for your own use, has no quota because we are not running

it. See architecture for the deployment models.