--- title: "Free in the app, paid in the Cloud" description: "Everything that runs inside your app is open source and free forever. You pay only for what MainSDK Cloud runs for you, by plan." section: "concepts" canonical: "https://mainsdk.dev/docs/concepts/free-and-cloud" updated: "2026-10-28" --- # Free in the app, paid in the Cloud > Everything that runs inside your app is open source and free forever. You pay only for what MainSDK Cloud runs for you, by plan. Canonical: https://mainsdk.dev/docs/concepts/free-and-cloud ยท Updated: 2026-10-28 One rule decides what is free: **what runs inside your app is free; what we run in our Cloud for you is paid.** The SDK, the CLI, every interface and driver, every check, gate and guarantee, the policy engine and the MCP server are open source under Apache-2.0 and free forever. An app protecting itself is never a paid action. The second rule: **visibility is everybody's right; action is paid.** Every app collects the same signals from its first run, whatever the plan: destinations it talks to, SBOM and reachable issues, decisions, errors, traces and customer reports. What people pay for is acting from our Cloud, for a team or across a company. ## Free with no account You need no account, card or network to use MainSDK. Nothing leaves your machine until you run `mainsdk login`, and even then only when you opt in: ```yaml title="main.yaml" telemetry: to: [terminal, otel] # add mainsdk to send to MainSDK Cloud after login otel: { endpoint: https://otel.pinecart.dev:4318, headers: { authorization: secret:OTEL_TOKEN } } ``` Sending logs and traces to your own OpenTelemetry backend is free on every plan. ## The three plans | | Free | Teams | Fleet | | --- | --- | --- | --- | | Who | One developer | People who build together | Companies running many MainSDK apps | | Price | Free forever; pay as you go beyond the allowance, under a cap you set | Per active developer, with a yearly cap | Yearly contract, priced by the apps discovered | | Inside your app | Everything, Apache-2.0 | Same | Same | | Online history | 7 days | 30 days, more as an add-on | 13 months, longer on contract | | Events online | Proposed 50,000 a month, then a price per 100,000 with a card | Pooled per seat, then the same price per 100,000 | Fleet observability across every app | | Actions from our Cloud | None beyond pay as you go | Debug sessions, replay, hosted triage and fix PRs, policy rollout to your own projects, project transfer | Critical actions: block or kill an app, enforce egress and approved providers across apps, revoke shared files and keys, admit or stop deploys, respond to incidents | ```mermaid flowchart TB subgraph App["Inside your app: free on every plan"] I[Interfaces and drivers] --- G[Checks, gates, guarantees] --- P[Policy engine] --- N[Network permissions] end subgraph Cloud["MainSDK Cloud: what plans pay for"] F[Free: your app, 7 days, pay as you go] T[Teams: the team's projects, 30 days, workflow] E[Fleet: every app in the estate, critical actions] end App -. opt-in telemetry after login .-> Cloud ``` > **Note:** Plan prices and the Free allowance are proposals (owner, 25 Oct 2026) to test with the first paying teams; the price per 100,000 events and per hosted reviewer run is not set yet. The Cloud and its plans arrive in phase 2; Fleet in phase 4, with paid pilots in phase 3. ## Free: one developer Free is one developer, for good. You get an online allowance (proposed 50,000 events a month, 7 days of history). An event is anything sent to MainSDK Cloud: a trace span, log line, error, policy decision, gate run or action call. Your own machine is never metered. At the limit you get a warning, a grace period, then a 402 from the Cloud. Never a broken app. 1. At 80% of the allowance, a warning in the CLI and by email. 2. Usage may continue to 120% or for 7 days, whichever comes first. 3. After that, with no card, MainSDK Cloud answers HTTP 402. Events stop going online and hosted reviewers stop. ```json { "type": "https://mainsdk.dev/errors/MAIN-CLOUD-0402", "title": "Free allowance used", "status": 402, "detail": "50,000 events used this month. Add a card or move to Teams.", "upgrade": "https://mainsdk.dev/billing?prj=prj_01JC8Q4W7ZK3M5N8P2R6T9V0XY" } ``` Your app keeps running. Every check, gate and guarantee keeps working, and logs stay in the terminal. Over a limit, MainSDK samples what it stores, never what it enforces (see [Never in the request path](https://mainsdk.dev/docs/concepts/fail-static)). ```text $ npx mainsdk usage events this month 41,200 of 50,000 (82%) warning sent history 7 days cap none (no card) ``` Add a card to pay as you go without changing plan: events past the allowance are billed per 100,000, up to a monthly cap you set. One-time add-ons can be bought on Free. A read-only getqr.id link to a launch report or trace needs no seat. Inviting a second member returns a 402 with a link to Teams. ## Teams: people who build together Priced per active developer, with a yearly cap. Past the cap, every extra developer is free (Teams Unlimited), so there is no price jump at any size. You see current prices after you sign in. An active developer is someone who pushed, ran a gate or used the console that month. Client viewers and auditors never count. Teams adds shared projects and policy, 30 days of history, a shared trace explorer, debug sessions, replay of failed requests with fake drivers, hosted reviewers and PR checks, and SSO and SCIM for the console at no extra charge. Agencies can transfer a project to a client's organisation with its history; client people read it on free view-only seats. ## Fleet: every app in a company Fleet is a contract between MainSDK and the enterprise, never with a developer. It covers every MainSDK app in the estate, whoever built it, with five modules: Discover, Observe, Defend, Control and Prove. The **free Fleet view** lets any verified enterprise tenant see every MainSDK app it runs, with owners, destinations, SBOM summaries and detections, keeping 30 days of history with no SLA. The paid contract is for acting: response, enforcement, evidence and revocation across apps. The price is set by the number of distinct apps discovered and trued up yearly; talk to us for a quote. ## What never costs money - Every check, gate and guarantee, offline, in your own CI. - Network permissions and blocking undeclared hosts. - Access decisions, consent, erasure and every runtime safeguard. - SSO, SCIM, audit log and passkeys for your own customers. See [Make your app enterprise ready](https://mainsdk.dev/docs/guides/enterprise-ready). - `mainsdk assure` and its results, in your own CI. - Data regions (US, EU, India) on any plan. ## Next - [Never in the request path](https://mainsdk.dev/docs/concepts/fail-static) - [Security model](https://mainsdk.dev/docs/concepts/security-model) - [Make your app enterprise ready](https://mainsdk.dev/docs/guides/enterprise-ready)