Directus

Short verdict: Directus puts REST and GraphQL APIs and a no-code admin app, the Studio, on top of a SQL database you own, and on the free tier we set up a posts collection with images, versioned drafts, live co-editing and an MCP server without writing code. The catch is the license that came with version 12 in June 2026: free self-hosting is capped in code at 3 Studio logins, 25 collections and 5 automations, without filtered permissions or SSO, and telemetry stays on. Companies under $5M revenue and 50 staff can remove the caps for free through a grant. It suits startups, small companies and agencies with small clients; larger teams should budget $599 a month for Team or look elsewhere.

How we reviewed it: On 25 October 2026 we installed Directus 12.5.1 from npm with SQLite on Linux (Node.js 22.22.0); Directus mainly ships as a Docker image, which could not run here. In the Studio we built a posts collection, served a post with an image to anonymous REST and GraphQL requests, and tried drafts, translations, a second editor and the MCP server. We measured install, start-up and the Studio's first load (Chromium, 1,440 x 900) and logged every request leaving the machine. We did not use Directus Cloud, apply for the grant, add AI keys, or test the Visual Editor, PostgreSQL or SSO. Prices, regions and uptime come from Directus's public pages that day.

What Directus costs and includes

What we found

Collections are ordinary tables in your database

We built the posts collection in five field dialogs: title, slug, rich text, image and a draft/published dropdown. Each became a column in a real table and the image a real foreign key, next to 33 Directus system tables:

CREATE TABLE "posts" (
  `id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
  `title` varchar(255) NULL, `slug` varchar(255) NULL,
  `content` text NULL, `image` char(36) NULL,
  `status` varchar(255) null default 'draft',
  CONSTRAINT `posts_image_foreign` FOREIGN KEY (`image`)
    REFERENCES `directus_files` (`id`) ON DELETE SET NULL)

REST and GraphQL returned the post, filters and image fields included, in about 10 ms after the first call, and adding ?width=400&format=webp to the image URL turned our 55.6 KB JPEG into a 3.5 KB WebP. New collections offer an Archived flag, not a draft/published status field.

The free Core tier is capped in code

Without a license key, Directus 12 runs as Core. The first login asks for a key or "I'm using Core plan", then for a project owner's email "to ensure compliance with our MSCL-1.0-GPL license"; postponing it brings it back at every login. The server enforces the limits: with the admin and two editors in place, a third editor failed with "seats limit exceeded." Turning on translations added two collections, so our one-collection model counted as 3 of 25.

API-only users, such as your site's members, take no seat, per Directus. Projects that upgrade from version 11 above the limits get 30 days, then lose the items API, GraphQL and MCP until usage fits or a license is added.

Public read access is all or nothing on Core

Opening posts to anonymous readers took a few clicks in the Public policy. Hiding drafts needs a rule such as "status equals published": on Core, Use Custom opens an upgrade prompt and the API refused the rule with a 403, so a post saved as a draft stayed public. Images also need public read access to the whole file library, which the Studio flags: "Read access without a filter exposes every record in the collection."

The free way around it is content versioning.

Drafts and live co-editing work on the free tier

With versioning on, a published post is locked and edits go to a Draft version that saves as you type. Anonymous requests for the draft got a 403, and a new post stayed out of the table until we pressed Publish. With WebSockets and collaborative editing on, the admin and an editor opened one draft; the admin saw the editor's avatar, a field lock and the text as it was typed. Neither needed a license. Scheduled publishing is not built in: Directus's guide uses a timed Flow.

AI tools are built in, and mostly free

The MCP server is built into the API at /mcp and is off by default. After one toggle, an MCP request with an admin token listed 12 tools covering items, files, schema and Flows; deletes stay off unless allowed. Per Directus, requests run with the caller's permissions, the AI Assistant works on every tier with your own OpenAI, Anthropic or Google key, and AI translations and custom models need Enterprise or the grant.

What leaves your server

The Studio made no requests outside localhost in our sessions. The server did: each npx directus command checks npm for updates, the Marketplace queries Directus's extension registry, and every start, then every 6 hours, sends a usage report to telemetry.directus.io. Captured locally, it held the public URL, version, database type, project ID, counts of users, collections, items and files, and whether MCP and AI keys are set, but no content. TELEMETRY=false did not stop it on Core; opt-out is an Enterprise feature. The project owner email is sent too. Telemetry fields

Install, start-up and Studio weight

One package carries every database driver, storage adapter and AI library: the Azure SDK (72 MB), Braintrust's AI tooling (66 MB) and OpenTelemetry (54 MB) each match or outweigh Directus's own code (54 MB). The Studio's main script is 7.0 MB and responses are not compressed, so put a proxy or CDN with gzip or Brotli in front. Use /server/ping for health checks: since version 12, /server/health needs a token.

What it costs for a 3-editor site and a 10-editor team

Billed yearly: Cloud Core $89 a month, Cloud Team $588, self-hosted Team $499. Self-hosted figures exclude the server, database and storage. Cloud has a 14-day trial, no free plan and, for self-service projects in its three regions (Northern Virginia, Frankfurt and Singapore), no uptime guarantee. The status page showed 99.33% to 100% uptime over 90 days there and one incident: about 70 minutes of disruption in North America on 6 August 2026. Directus holds a SOC 2 Type 2 report and offers a GDPR data processing agreement.

What you still have to set up

• Hosting. Docker or Node.js 22, a database, file storage such as S3, and Redis for several instances.

• A license plan. Core, a grant key (one per project, renewed yearly) or Team.

• A proxy. TLS, compression and health checks on /server/ping.

• Your front end. Live preview and the Visual Editor need Directus's visual-editing library on your site.

• Drafts and scheduling. Content versioning, and a Flow for timed publishing.

• Email and backups. A mail transport for invites, and backups of the database and uploads.

Pros and cons

Pros

• Content lives in plain SQL tables with real foreign keys, in a database you choose.

• REST, GraphQL, image resizing, versioning, translations, live co-editing and an MCP server worked on the free tier without code.

• The Studio sent nothing outside the machine in our sessions.

• SSO, filtered permissions and unlimited seats are free to self-host for companies under $5M revenue and 50 staff.

Cons

• Free self-hosting stops at 3 logins, 25 collections and 5 Flows; the next step costs $599 a month.

• No filtered permissions on Core, so a status field does not hide drafts from the public API.

• The usage report, with your public URL, cannot be turned off below Enterprise.

• A 706 MB install and a 10.8 MB uncompressed first Studio load.

• No free Cloud plan and no uptime guarantee on self-service Cloud.

How Directus compares

• Strapi also keeps content in your own SQL database, but its self-hosted Community edition costs $0 with unlimited users, against Directus Core's 3 seats. Live Preview and scheduled Releases need Growth, $45 a month for 3 users, and there is no co-editing. Pick it if you need more than three editors without paying.

• Payload is MIT-licensed, $0 with no seat or project limits, and runs inside your Next.js app with the content model in TypeScript code instead of a UI. Payload Cloud is paused, so you host it yourself. Pick it if your developers want the schema in code.

• Sanity keeps content in its hosted Content Lake, so there is no database to run, and includes visual editing and co-editing free; Growth costs $15 per seat a month. Pick it if you would rather not host anything.

See all CMS platforms we list.

Who should use Directus

Use it if you want APIs and an editing app on a SQL database you control, even an existing one, and you fit in three logins, qualify for the grant or can pay $599 a month. Look elsewhere if you need an open-source license, drafts hidden by permission rules for free, or many editors at a larger company on a small budget.

FAQ

Is Directus free?

Partly. Self-hosting is free for anyone on the Core tier, which allows 3 Studio logins, 25 collections and 5 Flows, without SSO or filtered permissions. Companies with under $5M in annual revenue and fewer than 50 employees can get SSO, filtered permissions and unlimited seats free through the Open Innovation Grant. Others who need more than Core pay $599 a month for Team, or $499 a month billed yearly, per Directus's pricing on 25 October 2026.

Is Directus open source?

No. Since version 12 (June 2026) Directus uses the Monospace Sustainable Core License, a source-available license that forbids offering Directus as a competing product or working around its license-key checks. Each release becomes available under GPL-3.0 four years after it ships. Versions 10 and 11 used the Business Source License 1.1, and version 9 was GPL-3.0.

Can agencies use Directus for client projects?

Yes, the license allows deploying and hosting Directus for a client. Free use depends on the client's size: the grant is assessed on the companies whose people log into the Studio, and Directus asks for a separate grant key per project. A larger client that needs more than Core's limits needs a Team or Enterprise license.

Does Directus Cloud have a free plan?

No. Directus Cloud offers a 14-day trial, then Core costs $99 a month ($89 billed yearly) and Team $698 a month ($588 billed yearly). Companies that qualify for the grant pay $99 a month for Cloud hosting with no seat or collection caps.

Can I turn off Directus telemetry?

Only on Enterprise, per Directus's pricing. On the free Core tier, setting TELEMETRY to false had no effect in our test: the server still sent its usage report at start-up. The report includes your public URL, version, database type and usage counts, not your content.