Open source
The part that makes the claim is the part you can read.
Nacre's whole pitch is that an agent reaches only what the person behind it is cleared for. That is not a claim anybody should take on trust, and it is not one a vendor can prove with a datasheet — so the code that decides it is Apache 2.0, along with the tests that hold it to its own specification.
The resolver, the scope tree, the pre-filter that goes inside the index traversal, and the six invariants written down as a specification rather than described afterwards. docs/authz.md is normative: where the code and that document disagree, one of them is a bug.
Every case the specification names runs against a real PostgreSQL and a real Qdrant, on its own CI job, and cannot pass having run nothing. There is also a deliberately naive second implementation of the resolver, kept obvious rather than fast, so a property test can catch the real one drifting from it.
The REST API, both MCP transports, the indexing worker, the TypeScript SDK,
the nacre command and the admin UI. It is a complete installation
on its own: nothing is removed to make room for something to sell.
Where the line falls
The test is who needs it, not which features are good. If one developer on a laptop needs it, it is in the core. What is commercial is what an organization needs once several teams, several tenants and an auditor are involved — and even there the split is careful: evaluation of deny rules and document-level grants is in the open core and stays there, because that is the code the guarantee rests on. What you pay for is issuing and administering them.
This is the arrangement that lets somebody check the claim instead of believing it, which is worth more to this product than a feature held hostage would be. docs/licensing.md states the line in the project's own words.
If it was useful
Saying thank you.
The core is free and stays free, and nothing below changes what it does or what you get. This is here because people ask, and because “there is no way to” is a worse answer than a link.
- Wise wise.com/pay/business/siarheidudko
- dudko.dev/donate the maintainer's own page
- PayPal paypal.me/dudkodev
There are two other things worth more than money, and both are free: tell us what broke, and tell us what you could not work out from the documentation. Most of what this project has fixed came from somebody running it rather than from reading it — that is not modesty, it is written down in the release notes, one defect at a time.