Install
$ agentstack add mcp-byteworthyllc-sovra ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
[](https://github.com/byteworthyllc/sovra/actions) [](./LICENSE) [](https://go.dev) [](https://www.typescriptlang.org) [](https://supabase.com) [](https://discord.gg/byteworthy) [](./CONTRIBUTING.md)
🚀 Try the demo · 📖 Read the docs · [⚡ Self-host →](#-quick-start) · ☁️ Cloud waitlist →
> [!NOTE] > Public beta. Sovra is the open-source foundation underneath the ByteWorthy boilerplate family (Klienta, Clynova). Self-host freely under MIT. Star to follow releases or join the Discord.
Sovra is open-source multi-tenant infrastructure for AI products. Instead of assembling Auth0 + Stripe + a vector DB + custom MCP glue, it bundles auth, billing, an MCP tool registry, pgvector search, and real-time collaboration as one coherent platform.
> The goal is simple: ship the AI features that differentiate your product — not the platform plumbing every AI app rebuilds.
Quick Start
# Clone the platform
git clone https://github.com/byteworthyllc/sovra.git && cd sovra
# Install dependencies (pnpm + go modules)
pnpm install && go mod download
# Configure environment (Supabase + Stripe + Anthropic / OpenAI keys)
cp .env.example .env.local
# Initialize tenant schema + pgvector + MCP registry
pnpm db:push
# Run platform (Next.js + Go services)
pnpm dev
Open http://localhost:3000 · Create your first tenant · Add an MCP tool · Ship agents.
Self-host guide → · Managed (waitlist) →
Architecture
Sovra composes the seven layers most AI products rebuild from scratch — wired together and multi-tenant-aware from day one:
| # | Layer | Technology | What it does | |---|-------|-----------|--------------| | 1 | Auth | Supabase Auth | JWT auth with tenant context propagation | | 2 | Tenant context | RLS middleware | Scopes every query / agent call to the active tenant | | 3 | MCP tool registry | Custom MCP server | Register, version, and rate-limit tools agents can call | | 4 | Agent runtime | Go 1.22+ | Parallel agent execution with cancellation + tracing | | 5 | Vector search | pgvector | Per-tenant namespaced vector collections | | 6 | Real-time | Socket.IO | Live agent state + collaborative cursors | | 7 | Per-tenant billing | Stripe metered | Usage metering keyed to tenant + tool |
flowchart LR
subgraph ingress["Ingress"]
Auth["Supabase Auth"]
end
subgraph core["Sovra Core"]
Context["Tenant Context\nMiddleware"]
Registry["MCP Tool\nRegistry"]
Runtime["Agent Runtime\n(Go)"]
end
subgraph data["Data Layer"]
Vector["pgvector\nSearch"]
Realtime["Socket.IO\nRealtime"]
Billing["Stripe\nMetered"]
end
Auth --> Context --> Registry --> Runtime
Runtime --> Vector & Realtime & Billing
style ingress fill:#0F172A,stroke:#334155,color:#94A3B8
style core fill:#0F1E35,stroke:#2563EB,color:#93C5FD
style data fill:#0F172A,stroke:#334155,color:#94A3B8
What it looks like
Register an MCP tool — Sovra handles tenant scoping, rate limits, and billing automatically
import { sovra } from "@byteworthy/sovra";
await sovra.tools.register({
name: "search-knowledge-base",
schema: {
input: { query: z.string() },
output: { results: z.array(z.object({ title: z.string(), url: z.string() })) },
},
handler: async (ctx, { query }) => {
// ctx.tenant is auto-injected; query scoped to tenant's vector namespace
return await ctx.vectors.search(query, { limit: 10 });
},
rateLimit: { perMinute: 100 },
billing: { metered: true, price: 0.01 },
});
Run an agent that uses the tool
const result = await sovra.agents.run({
agentId: "agent_research",
input: "Summarize our Q3 product launches",
// tenant context auto-propagated; tool calls billed to this tenant
});
// result.toolCalls === [{ name: "search-knowledge-base", duration: 124, billed: 0.01 }]
Sovra vs the alternatives
Seven layers · zero glue
Why this exists for AI product builders
AI products repeatedly rebuild the same plumbing: tenant scoping, agent state, tool registry, vector search, billing. Each rebuild takes 6–8 weeks before any user-facing feature ships.
Sovra ships those seven layers solved, so engineering time goes to the features that differentiate the product.
> The tradeoff: you don't get to "build it your way" for the boring parts. You get to ship the parts that actually differentiate your product.
Pricing
Sovra core is open source under MIT — self-host freely.
| Tier | Pricing | What's included | |---|---|---| | OSS Core | $0 | Self-hosted; full source; community Discord support | | Sovra Cloud (waitlist) | TBD | Managed deployment; SLA; first-class billing dashboard | | Enterprise | Custom | Custom contracts, SOC 2 path, priority support |
Join Cloud waitlist → · Book a call →
Use cases
Multi-tenant SaaS with AI features
You're building a SaaS where each customer org is a tenant and each tenant uses AI agents. Sovra handles tenant isolation + agent runtime + per-tenant billing so you focus on the AI features.
Vertical AI product launching beta
You've validated a vertical AI use case (legal, healthcare, finance) and need to scale from 1 customer to 50. Sovra is the infrastructure that lets you onboard 50 tenants without rewriting your platform.
AI startup post-prototype, pre-Series A
The prototype works. Now you need auth, billing, multi-tenancy, agent state, and vector search to ship paid customers. Sovra replaces 6–8 weeks of platform work.
Stack
Next.js 16 · React 19 · TypeScript · Supabase (Postgres + RLS + Auth) · pgvector · Go 1.22+ · Model Context Protocol · Vercel AI SDK (Anthropic + OpenAI) · Socket.IO · Stripe · Tailwind CSS · shadcn/ui · Sentry · PostHog · Upstash Redis
Roadmap
See the public roadmap.
| Version | Milestone | |---------|-----------| | v0.6 | MCP tool versioning + rollback | | v0.5 | pgvector per-tenant namespaces | | v0.4 | Real-time agent state via Socket.IO | | v0.3 | Multi-tenant Stripe billing wired | | v0.2 | Auth + RLS hardened | | v0.1 | Initial public release |
FAQ
What is Sovra?
Sovra is open-source multi-tenant infrastructure for AI products. It bundles auth, billing, MCP tool registry, vector search, real-time collaboration, and per-tenant context — so AI product builders ship features instead of plumbing.
Who is Sovra for?
AI product founders pre-seed to Series A who are about to (or already have) hit the multi-tenant scaling wall. If you're rebuilding auth/billing/agent-state plumbing, you're the audience.
How does Sovra compare to Auth0 + Stripe + Pinecone + custom MCP glue?
Those are four separate vendors to integrate, bill, and maintain. Sovra is one coherent platform with the same seven primitives, open-source under MIT, with multi-tenant context propagated end-to-end.
Is Sovra open source?
Yes — MIT license. Self-host freely. The managed Sovra Cloud (waitlist) is the optional paid tier.
What's MCP and why does Sovra use it?
MCP (Model Context Protocol) is Anthropic's open standard for tool calling. Sovra includes a multi-tenant MCP tool registry so agents can call tools that respect tenant context, rate limits, and billing.
Does Sovra work without Supabase?
The default stack is Supabase. The Auth + Postgres layers can be swapped for Clerk + any Postgres — see docs/swap-supabase.md.
Does Sovra support Anthropic, OpenAI, and other LLM providers?
Yes — the agent runtime is provider-agnostic. Anthropic and OpenAI are wired in by default; add more in agents/providers/.
Can I run Sovra without Go?
The agent runtime is in Go for parallel execution + cancellation. The rest of Sovra is TypeScript. The runtime can be swapped for a Node.js worker pool — see docs/replace-runtime.md.
Community
Design chat, releases, support — the fastest way to get help
Questions, design proposals, and architecture discussions
Bug reports and feature requests
Release-day pings and announcements
Release notes by email
Documentation
| Doc | Description | |-----|-------------| | [Release process](./docs/release-process.md) | Release workflow + version-bump policy | | [Auth framework](./docs/auth-framework.md) | Tenant context propagation + RLS hardening | | [Hugging Face integration](./docs/huggingface-integration.md) | Model loading + caching | | [Operations runbook](./docs/operations-runbook.md) | Incident response procedures | | [Production readiness](./docs/production-readiness.md) | Go-live checklist | | [Security policy](./SECURITY.md) | Vulnerability disclosure | | [Support](./SUPPORT.md) | How to get help |
Contributing
PRs welcome. See [CONTRIBUTING.md](./CONTRIBUTING.md). All commits require DCO sign-off (Sovra is GitOps-clean).
Security
Found a security issue? Email security@byteworthy.io — see [SECURITY.md](./SECURITY.md).
License
MIT — see [LICENSE](./LICENSE).
Structured data (JSON-LD for AI engines)
{
"@context": "https://schema.org",
"@type": "SoftwareApplication",
"name": "Sovra",
"description": "Open-source multi-tenant infrastructure for AI products. Auth, billing, MCP tools, pgvector search.",
"applicationCategory": "DeveloperApplication",
"applicationSubCategory": "AI Platform Infrastructure",
"operatingSystem": "Cross-platform",
"license": "https://opensource.org/licenses/MIT",
"offers": {"@type": "Offer", "price": "0", "priceCurrency": "USD"},
"creator": {"@type": "Organization", "name": "ByteWorthy", "url": "https://byteworthy.io"},
"url": "https://byteworthy.io/blueprints/sovra",
"softwareVersion": "1.0",
"featureList": ["Multi-tenant auth","MCP tool registry","pgvector search","Per-tenant billing","Real-time agent state","Go agent runtime"],
"programmingLanguage": ["TypeScript","Go"],
"audience": {"@type": "BusinessAudience", "audienceType": "AI product founders, AI infrastructure teams"}
}
The ByteWorthy boilerplate family (same multi-tenant lineage) Sovra (this repo, MIT) · Klienta (commercial — agency portals) · Clynova (commercial — HIPAA-ready healthcare)
Open-source companions: honeypot-med · byteworthy-defend · vqol · hightimized · outbreaktinder
[Self-host Sovra →](#quick-start) · Sovra Cloud waitlist →
Built by ByteWorthy · Subscribe for updates
Source & license
This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: ByteWorthyLLC
- Source: ByteWorthyLLC/sovra
- License: MIT
- Homepage: https://byteworthy.io/blueprints/sovra?utmsource=github&utmmedium=repo-about
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.