Plans & Limits
Envpilot has two tiers, Free and Pro. Every gatable feature — resource caps, tool access, security controls — is defined once in a dynamic feature registry and resolved per-organization on every request. This page lists every feature and its value on each tier.
Limits are enforced server-side and can change independently of this page. Check
envpilot usage(add--jsonfor scripting) or the dashboard Usage page for your organization's live numbers against its actual limits.
No pricing is listed here — see the website for current pricing.
Resources#
| Feature | What it does | Free | Pro |
|---|---|---|---|
| Max Projects | Number of active projects an organization can create | 3 | Unlimited |
| Max Variables per Project | Number of active variables allowed in a single project | 50 | Unlimited |
| Max Organizations | Number of organizations a user can create | 1 | Unlimited |
Team#
| Feature | What it does | Free | Pro |
|---|---|---|---|
| Max Team Members | Active members plus pending invitations, counted together | 3 | Unlimited |
| Max Pending Invitations | Outstanding invitations an organization can have open at once | 5 | Unlimited |
Variables#
| Feature | What it does | Free | Pro |
|---|---|---|---|
| Variable Version History | Keep and roll back to prior values of a variable | No | Yes |
| Bulk Import | Import a .env file as many variables in one action | No | Yes |
| Bulk Delete | Delete multiple variables in one action | Yes | Yes |
| Bulk Export | Export multiple variables in one action | No | Yes |
| Variable Tags | Tag variables for organization and filtering | Yes | Yes |
Secret files#
| Feature | What it does | Free | Pro |
|---|---|---|---|
| Secret Files | Store keystores, SSH keys, certificates and service-account JSON | Yes | Yes |
| Max Secret Files | Active secret files an organization can store | 3 | Unlimited |
| Max File Size | Largest single secret file, before encryption | 256 KB | 8 MB |
See Secret files for the object model and the structural ceilings that no tier lifts.
Documentation#
| Feature | What it does | Free | Pro |
|---|---|---|---|
| Project Documentation | Write project pages agents draft over MCP and humans publish | Yes | Yes |
| Max Pages per Project | Active documentation pages allowed in a single project | 10 | Unlimited |
| Max Pages per Organization | Active documentation pages across every project in the org | 25 | Unlimited |
| Documentation Sharing | Hand a published page to a named organization member | Yes | Yes |
| Public Documentation Links | Mint an expiring /d/<token> preview link for a page | No | Yes |
| Max Active Public Links | Public documentation links that may be live at once | 0 | Unlimited |
Both page caps count active pages only — a page in the trash frees its slot immediately, and restoring one re-checks the caps. Creation over MCP is bounded by the same numbers as the dashboard.
See MCP tools for how an agent drafts a page and what a human must do to publish it, and Sharing documentation for what the two sharing gates allow.
Tools#
| Feature | What it does | Free | Pro |
|---|---|---|---|
| API Access | Use the REST API surface at all | Yes | Yes |
| VS Code Extension | Use the VS Code extension to sync variables | Yes | Yes |
| CLI Access | Use the envpilot CLI | Yes | Yes |
| VS Code Unsync Customization | Customize which files the extension excludes from sync | No | Yes |
Security#
| Feature | What it does | Free | Pro |
|---|---|---|---|
| Granular Permissions | Per-variable read/write grants beyond role defaults | Yes | Yes |
| Audit Log Retention (days) | How many days of audit log history stay queryable | 7 | 365 |
| SSO | Single sign-on | No | No |
| Secret Rotation & Expiry | Scheduled rotation reminders and expiry on variables | No | Yes |
| Max Rotation-Enabled Variables | Number of variables that can have rotation enabled | 7 | Unlimited |
| Secret Sharing Links | Create expiring links to share a secret externally | No | Yes |
| Security Hold (Suspend Member Access) | Freeze a member's org-wide access without removing them | No | Yes |
| Max Active Shares | Number of active secret-sharing links allowed at once | 0 | Unlimited |
| Shared Accounts | Store credentials for a shared third-party account on a project | Yes | Yes |
| Max Shared Accounts | Number of shared accounts an organization can store | 5 | Unlimited |
SSO shows
Noon both tiers today — the feature is registered but not yet enabled for any tier.
Customization#
| Feature | What it does | Free | Pro |
|---|---|---|---|
| Custom Keyboard Shortcuts | Rebind CLI TUI / dashboard keyboard shortcuts | Yes | Yes |
| Custom Branding | Replace default branding in the dashboard | No | Yes |
Analytics#
| Feature | What it does | Free | Pro |
|---|---|---|---|
| Analytics Retention (days) | How many days of usage analytics are kept | 7 | 30 |
Support#
| Feature | What it does | Free | Pro |
|---|---|---|---|
| Priority Support | Priority queue for support requests | No | Yes |
Integrations#
| Feature | What it does | Free | Pro |
|---|---|---|---|
| Public REST API | Programmatic access via API keys to /api/v1/* | No | Yes |
| MCP Server | Access via the Model Context Protocol server for AI agents | No | Yes |
| Team Notifications | Slack and Discord delivery of project events | No | Yes |
| Max Notification Channels | Webhook destinations an organization can register at once | 0 | 10 |
The GitHub Action authenticates with an API key over the same core as the REST API, so it inherits the public_api gate.
Ceilings no plan lifts#
Some limits are structural, not commercial:
| Ceiling | Value |
|---|---|
| Environments per project | 3 — development, staging, production |
| Active secret files per project | 1000 |
| Secret file path length | 400 characters |
| Secret file modes | 0600 or 0400 |
| Rotation frequency | 1–3650 days |
| Trash retention | 7 days, then permanent purge |
| API read size | Bounded; a read that cannot complete in full fails loudly |
How enforcement works#
Every gatable feature lives in one dynamic feature registry, resolved fresh on every request — never a hardcoded per-tier check scattered through the app.
Resolution chain. A boolean feature resolves: organization → owner → the owner's tier → an active billing grace period (if downgrading) → the tier's feature override → the registry default. Numeric features resolve the same way, returning either a number or null for unlimited.
Where it's checked. Backend mutations and queries check the resolved value at the exact point of the write or read they're gating — e.g. creating a project checks the project limit against the organization's current active project count before inserting. The dashboard mirrors the same check so the UI reflects what the backend will actually allow, and CLI/extension calls route through the same registry over the API.
Dual gates. Features with recurring background cost (rotation reminders, scheduled scans) pair a boolean gate with a numeric limit — e.g. secret rotation being available at all, plus how many variables can have it enabled. Both are checked before the feature runs.
At a limit. A denied check returns a readable, user-facing error — "Limit reached (3/3). Upgrade your tier for more." — never a silent no-op or a generic server error, and nothing is written before the check passes.
Pre-alpha bypass. All enforcement is gated behind a platform-wide admin toggle. When it's off, every boolean check resolves to allowed and every numeric limit resolves to unlimited — RBAC role checks are unaffected either way.