Check capability availability
DVARA has two distributions: an Open Source distribution for governing model calls in one process, and an Enterprise platform for centrally operating a fleet. The Enterprise platform runs in Development without a licence and in Production with a valid licence.
Development and Production are postures of the same Enterprise platform. They are not separate editions or images.
Which deployment should you choose?
| If you need to… | Choose |
|---|---|
| Embed governance engines in a Java application, or run one file-configured LLM Gateway without a database | Open Source distribution |
| Evaluate the complete Enterprise LLM governance platform outside production | Enterprise Development |
| Run the Enterprise platform in production, govern MCP and A2A traffic, and receive support | Enterprise Production |
Read Choose a deployment for the operational trade-offs, then use the tables below to check the exact capability you need.
What does each option include?
| Open Source distribution | Enterprise Development | Enterprise Production | |
|---|---|---|---|
| Licence | None; Apache-2.0 | None | Valid DVARA licence |
| Intended use | Development or production under the Apache licence | Non-production evaluation and development, within 3 workspaces and 100,000 governed calls a month | Production, with no workspace or call limit |
| Runtime shape | One LLM Gateway process, or governance engines embedded in your application | DVARA Gateway plus DVARA Flightdeck | Same Enterprise applications as Development |
| Configuration | gateway.yaml, read at startup | Managed in DVARA Flightdeck and stored in its PostgreSQL; Gateways receive it as a signed bundle | Same as Development |
| Governed planes | LLM | LLM, MCP, and A2A | LLM, MCP, and A2A |
| Production support | Community channels | Not included | Included by your agreement |
The Open Source distribution does not require a database. The Enterprise control plane, DVARA Flightdeck, uses PostgreSQL as its system of record. From 1.8.2 Enterprise Gateway pods have no database: they serve a signed configuration bundle from Flightdeck and spool their records back to it. See How the gateway runs without a database.
Which governance controls are available?
“Configure” means the capability is present but does not enforce the strict behavior until you choose its setting. The condition in each cell is part of the capability.
| Capability | Open Source distribution | Enterprise Development | Enterprise Production |
|---|---|---|---|
| Policy as Code | Included. Policies in gateway.yaml run as ACTIVE. | Included. Manage ACTIVE and SHADOW policies in DVARA Flightdeck. | Same as Development. |
| PII detection | Pattern and checksum detection is included. PII scanning is on by default; the default action is LOG. | Included, with centrally managed settings. Presidio runs only with its configured service. Phileas is in the Gateway image from 1.8.1 and stays off until you enable it. The default action is LOG. | Same as Development. |
PII LOG, BLOCK, and REDACT actions | Included when selected for the workspace. | Included when selected for the workspace. | Same as Development. |
Reversible PII TOKENIZE action | Not included. A configuration that requests it is refused because the runtime has no token store. | Included when you configure the token store and encryption material. | Same as Development. |
| Prompt-injection and content guardrails | Included for requests and responses. The workspace action and threshold decide whether a detection only records or blocks. | Included, with central policy management and the Defender classifier, whose model is in the image. HTTP classifiers still need their own service. | Same as Development. |
| Rate limits | Included when configured. Counters are per API key and per process. | Included when configured, with shared fleet enforcement. | Same as Development. |
| Tamper-evident audit trail | Optional local HMAC-chained file. Set both the file path and HMAC secret; without the path, events are dropped. | Persistent HMAC-signed and hash-chained audit evidence. Prompt storage is off by default. | Same as Development. |
| Audit search, compliance reports, SIEM, and webhooks | Not included. | Included. Exports and destinations run only after you configure them. | Same as Development. |
| Cost attribution, budgets, chargeback, and forecasting | Not included as a central workflow. | Included. Configure provider pricing before relying on cost, budget, or forecast figures; a forecast projects the next seven days from trailing usage. | Same as Development. |
| SSO and RBAC | Not included. File-configured data-plane API keys can identify a workspace. | Included. Built-in authentication is available; configure an identity provider to use SSO. | Same as Development. |
Which gateway capabilities are available?
| Capability | Open Source distribution | Enterprise Development | Enterprise Production |
|---|---|---|---|
| OpenAI-compatible LLM APIs | Included. Endpoint behavior still differs by operation; check the LLM Gateway reference. | Included. | Included. |
| Provider routing | Model prefix, round-robin, weighted, and canary routing are included. | Those strategies plus managed latency-, cost-, geo-, and intelligent routing. | Same as Development. |
| Response cache | Exact in-memory cache, off by default and local to one process. | Exact and semantic caching with fleet operations. | Same as Development. |
| Retries, failover, and circuit breaking | Included when configured. | Included when configured. | Included when configured. |
| Prompt experiments | Not included. A request that asks for one is refused. | Included. Create experiments in DVARA Flightdeck; no request is enrolled until an experiment exists. | Same as Development. |
| Response caching | Not included. | Exact-match caching is off by default. Semantic caching is available and can be disabled globally or per workspace. | Same as Development. |
| Batch tracking | Stored in memory. Restarting the gateway loses local job tracking and prevents later cost booking through that record. | Durable tracking through the Enterprise control plane. | Same as Development. |
| MCP Gateway | Not included. | Included from 1.8.2. Runs inside the DVARA Gateway on port 8080. | Included. Runs inside the DVARA Gateway on port 8080. |
| A2A Gateway | Not included. | Included from 1.8.2. Runs inside the DVARA Gateway on port 8080. | Included. Runs inside the DVARA Gateway on port 8080. |
The Open Source distribution refuses a route that names an Enterprise routing strategy. It does not silently substitute round-robin.
Which operating capabilities are available?
| Capability | Open Source distribution | Enterprise Development | Enterprise Production |
|---|---|---|---|
| DVARA Flightdeck | Not included. | Included. | Included. |
| Central configuration, history, and promotion | Not included. Edit gateway.yaml and restart. | Included. Gateway pods poll the control plane by default; signed bundles are an alternative. | Same as Development. |
| Durable provider credentials and external secret stores | Provider keys come from environment-backed gateway.yaml values. | Included. External secret-store support runs only when configured. | Same as Development. |
| Metrics and structured logs | Included. | Included. | Included. |
| Trace export | Available when you configure an OTLP endpoint. It is off by default. | Available when you configure an OTLP endpoint. It is off by default. | Same as Development. |
| Multi-pod operations | Each process holds its own file configuration and local counters. | Central configuration and shared runtime state are included. | Same as Development. |
Which Enterprise images should you run?
The Enterprise Development and Production postures use the same public images. A licence changes the running posture and removes the limits; it does not require a different image.
| Image | Port | Purpose |
|---|---|---|
ghcr.io/dvarahq/dvara-gateway | 8080 | LLM, MCP, and A2A planes |
ghcr.io/dvarahq/dvara-flightdeck | 8090 | DVARA Flightdeck |
Self-managed deployments do not use a separate MCP image, A2A image, or -ee image. They also do not use the private managed-service Flightdeck image.
Use an explicit released tag rather than latest:
export DVARA_VERSION=<released-1.8-tag>
docker pull "ghcr.io/dvarahq/dvara-gateway:${DVARA_VERSION}"
docker pull "ghcr.io/dvarahq/dvara-flightdeck:${DVARA_VERSION}"
The Open Source distribution is a runnable Java application and can also be embedded through its Java starters. Follow the Open Source distribution quickstart instead of using the Enterprise images.
How do you check the Enterprise posture?
Set DVARA_ACTUATOR_API_KEY, then call the licence endpoint with that operator credential:
curl --fail --silent --show-error \
-H "Authorization: Bearer <actuator-api-key>" \
http://localhost:8080/actuator/license
Check these response fields:
| Field | Meaning |
|---|---|
posture | DEVELOPMENT with no licence; PRODUCTION with a licence, valid or expired. Follows the stored licence while the application runs |
licensed | Whether a valid licence is present |
status | Current licence health, which can change while a Production instance is running |
workspaceLimit, callsThisMonth, callLimit | The limits that apply now; see Get and apply a license |
Do not infer posture from /actuator/gateway-status. That endpoint reports runtime health, providers, routes, limits, region, warnings, and uptime; it does not return licence or posture details.
Add the licence on Flightdeck's License page. From 1.8.2 no restart is needed: Flightdeck applies it at once, and each Gateway pod applies it with its next configuration bundle. Before 1.8.2 the first licence needed a restart of the DVARA Gateway and DVARA Flightdeck.
Continue with Licence and production activation for the complete activation and verification flow.