Licensing & Plans¶
CloudSlash is built by DeviLabs on an open-core model designed to keep the local CLI, TUI, and mathematical engine 100% free and open-source while allowing anyone to build permissive plugins or use the hosted CloudSlash Horizon platform.
1. Repository & Component Licenses¶
| Component | Path | License | What You Can Do |
|---|---|---|---|
Core Engine, CLI & TUI (cs) |
cloudslash/ |
GNU AGPLv3 | Run locally, in CI/CD, or on your own servers for free forever. Modifications or network-hosted offerings of the core engine must remain open under AGPLv3 unless covered by a Commercial License. |
| Plugin SDK (Protobuf & Go) | cloudslash/sdk/ |
Apache License 2.0 | Build and distribute open-source, private, or commercial gRPC plugins without AGPLv3 copyleft obligations. |
| AWS plugin | plugins/cloudslash-plugin-aws |
MIT | Fork, customize, or embed the AWS source plugin freely. Other systems are community plugins under their own licenses. |
| Horizon Web & Cloud Control Plane | cloudslash-saas/ |
Commercial / Proprietary | Managed multi-tenant SaaS dashboard at app.cloudslash.dev. |
2. Why Dual-Licensed (AGPLv3 + Apache 2.0 SDK)?¶
- Zero Lock-In for Engineers (AGPLv3 Core): Every CLI command (
cs scan,cs tui,cs plan,cs remediate,cs revert,cs diff,cs drift,cs chargeback,cs audit,cs watch) runs locally with zero artificial feature walls. - Permissive Plugin Ecosystem (Apache 2.0 SDK): Plugins run out-of-process over gRPC and only import the Apache 2.0 Plugin SDK. Enterprises and third-party vendors can write proprietary internal plugins without exposing their source code.
- Commercial AGPLv3 Exemption: Organizations that need to embed CloudSlash inside proprietary software, distribute modified binaries privately, or comply with strict corporate no-AGPL procurement policies can subscribe to the Commercial plan.
3. CloudSlash Horizon Plans (app.cloudslash.dev)¶
| Feature | Community ($0 / forever) |
Pro ($29 / mo) |
Commercial ($99 / mo) |
|---|---|---|---|
Local CLI & TUI (cs) |
Unlimited (AGPLv3) | Unlimited (AGPLv3) | Unlimited + AGPLv3 Exemption |
| Cloud Connections | Up to 3 connections | Up to 15 connections | Up to 50 connections |
| Hosted Scans / Uploads | 5 / UTC month | 100 / UTC month | 500 / UTC month |
| Snapshot History Retention | 7 days | 90 days + 30-day forecast | 365 days + 30-day forecast |
| Signed S.A.U. Plan Compilation | View findings | Compile Ed25519-signed .json plans |
Compile Ed25519-signed .json plans |
| Reports (Chargeback, Audit, Diffs) | CLI (cs chargeback, cs audit, cs diff) |
Hosted Web UI + CSV/JSON export + CLI | Hosted Web UI + CSV/JSON export + CLI |
| Custom Finding Rule Packs | Built-in inventory & baseline | Custom Rule Pack toggles & property rules | Custom Rule Pack toggles & property rules |
| DEVI AI Copilot (BYOK) | Beta — free, BYOK | Beta — free, BYOK | Beta — free, BYOK |
| License & Compliance | AGPLv3 open-source | AGPLv3 open-source | Commercial license (bypasses AGPLv3) |
4. Frequently Asked Questions¶
Do I need a paid plan to remediate or roll back resources?¶
No. The cs CLI and cs tui are 100% free under AGPLv3 and can scan, generate plans (cs plan), execute remediations (cs remediate), and unwind actions (cs revert) locally using your own cloud credentials.
Why is remediation disabled inside the Horizon web UI?¶
By design, Horizon SaaS is strictly read-only. Non-engineering stakeholders (Finance, Product, Leadership) can inspect costs and compile a signed S.A.U. plan in the browser without any risk of accidentally deleting production infrastructure. DevOps and Engineers then execute that signed plan in the CLI/TUI (cs remediate --plan-id <id>).
When do I need the Commercial ($99/mo) tier?¶
Choose Commercial if your organization: - Needs higher hosted limits (up to 50 cloud connections and 500 hosted scans/month), or - Has legal/procurement policies that prohibit AGPLv3 software, or wants to modify/embed CloudSlash privately without open-sourcing modifications.