Directus 12: APIs over your own SQL database, under a source-available license with revenue limits

MSCL 1.0 is source-available, and the free tier has thresholds

Directus is not under an OSI open source license. It uses the Monospace Sustainable Core License 1.0, a source-available license derived from the Fair Core License. Three tiers follow from it. Organizations under $5M in annual revenue and 50 employees can use Directus for free by applying for an Open Innovation Grant license, which issues a key. A Free Core Tier is open to everyone for exploring and building without a commercial license. Organizations above those thresholds that use advanced or enterprise features need a commercial license, with pricing on directus.com.

The consequence is a planning question, not a technical one. A startup that grows past 50 employees, or an agency building for a large client, can cross a line that changes the cost of a deployed system. Check which features you rely on against the pricing page before Directus sits at the center of a product, and record the grant key along with your other secrets.

The API layer is generated from your existing schema

Directus does not ask you to model content inside its own format first. It connects to a SQL database and generates REST and GraphQL APIs from the schema already there, with no configuration required. Supported vendors include Postgres, MySQL, MariaDB, MS SQL, SQLite, OracleDB and CockroachDB. Engineers keep control of schema and access, while non-technical teammates edit live data through the Studio.

Because the APIs mirror the schema, a schema change is an API change. Renaming a column renames a field that clients and AI agents read, so treat migrations as breaking changes for API consumers. Extensions cover what generation does not: custom endpoints, hooks, interfaces and modules. The repository also ships an sdk directory for client code.

AI agents run under the same policies as human users

Two AI pieces ship in the box. An AI Assistant embedded in the Studio creates content, runs translations and triggers workflows. A native MCP server lets Claude, Cursor, ChatGPT or any MCP-compatible tool connect to your data. Both work on live data rather than a copy.

Access control is policy based and reaches down to individual fields. Agents get no special path around it: they operate under the same role-based permissions as people. That cuts both ways. An agent connected with a broad admin role can change anything that role can, on production data. Create a dedicated role for each agent with only the collections and fields it needs, because there is no separate AI sandbox to catch a bad write.

The repository's docker-compose.yml is a debugging rig

The Compose file at the repository root says in capitals that it is only for debugging and not intended for production. It starts copies of the supported database vendors, Redis, RustFS for S3 storage, Azure blob emulation, Keycloak, CockroachDB and a fake SMTP server called MailDev. Each gets a fixed port: Postgres on 5100, MySQL 5101, MariaDB 5102, MS SQL 5103, Oracle 5104, Redis 5105, RustFS 5106 with its admin on 5112, Keycloak on 5110, and MailDev SMTP and web UI on 1025 and 1080.

The credentials are hardcoded and public: Postgres uses postgres and secret, MS SQL uses sa and Test@123, RustFS uses rustfsadmin for both key and secret and requires S3_FORCE_PATH_STYLE set to true. Running this file on a reachable server exposes a set of databases with known passwords. To route mail into MailDev during development, the file asks for these variables:

[email protected]
EMAIL_TRANSPORT=smtp
EMAIL_SMTP_HOST=0.0.0.0
EMAIL_SMTP_PORT=1025

For production, the file points to the Compose examples in the self-hosting docs.

Building the image needs Node 26 and an 8 GB heap setting

The root package.json pins Node to 26 and pnpm to versions from 12 up to but not including 13, with [email protected] as the package manager. The Dockerfile builds on node:26.12.1-alpine, installs python3 and build-base for native modules, and sets NODE_OPTIONS to --max-old-space-size=8192. A build host with little memory will struggle with that heap setting, so budget RAM for source builds or use a published image.

The build runs as the node user to match production pnpm setups, compiles every workspace package except e2e with a workspace concurrency of 2, then deploys the directus package into dist and creates database, extensions and uploads directories. The runtime stage applies Alpine security upgrades and removes npm, npx and corepack from the final image. With npm gone, do not plan on running npm install inside a container; put extensions in the extensions directory or build your own image.

Directus Cloud and Railway trade control for setup time

If you do not want to run the stack, Directus Cloud provisions a managed project in under 90 seconds. You pick a region, and database, storage, auto-scaling and a global CDN are included, with a dashboard to create and monitor projects. A Railway template deploys Directus with PostgreSQL, Redis and S3-compatible storage connected over Railway's private network.

Both routes remove the debugging Compose file from the picture entirely. Self-hosting keeps the database on your infrastructure, which matters when Directus wraps a database you already run.

Releases move fast and contributions carry a CLA

Version 12 is current: v12.5.0 shipped on 2026-10-07, v12.5.1 on 2026-10-23 and v12.6.0 on 2026-10-27, with the last push on 2026-11-02. Changes are tracked with changesets and a release notes generator in the workspace, so read the release notes before upgrading a deployment that external clients depend on.

Contributors should read contributing.md first. The repository also holds cla.md, so code contributions come with a contributor license agreement, and an ai_policy.md file sits beside it at the root. Security issues go through the security policy rather than public issues. Help channels include the community forum, Discord and a public roadmap for feature requests.

Editorial conclusion

Directus fits teams that already have, or want, a SQL database as the source of truth and need generated APIs, an editing interface and governed AI access without writing a backend. Larger companies must budget for a commercial license once they pass $5M in revenue or 50 employees and use advanced or enterprise features. Before adopting, read the MSCL 1.0 terms, start from the production Compose example in the docs rather than the repository's debug file, and confirm your database vendor is supported.

Frequently asked questions

Official sources

1. directus/directus on GitHub
2. Issues
3. Project website
4. README
5. Releases