Nacre

Nacre is a self-hosted, permission-aware context layer for AI agents: one searchable index across an organisation's content, where every user and every agent sees only what they are authorised to see.

The distinction that matters is where the filter runs. Most retrieval layers filter after the search, which means a request for ten results returns however many survived - and the existence of the removed documents leaks through the count, the ranking and the latency. Nacre applies the permission predicate inside the index traversal, so top-k returns k permitted documents. Permissions are computed per request from live grants rather than copied into the index, so a revoked grant is reflected in the next search; a request without permission returns 404 rather than 403, so "not permitted" is indistinguishable from "does not exist".

Retrieval is hybrid - dense vectors and BM25 fused with Reciprocal Rank Fusion, with optional cross-encoder reranking. Embeddings come from any OpenAI-compatible endpoint. Two interfaces: MCP for agents, REST for applications. Eleven MCP tools on /mcp since 0.29.0: search, list_layers, get_document, ingest_document, request_upload, upload_file, ingest_status, delete_document, list_skills, get_skill, update_skill.

Administration is a second MCP server, at /mcp/admin - people, groups, layers, grants, skills and the access log from a sentence, with fifteen read tools and writes that are proposals a person applies rather than calls that take effect. It is separate on purpose, and for the same reason the rest of the product exists: documents are untrusted input, and a sentence inside one can ask an agent to grant somebody access. So there is no search, no get_document and no ingest_document on that surface, it needs its own token audience and its own consent, and only a person holding org_admin is offered it - never a service account.

Runs on your own infrastructure via Docker Compose, on amd64 and arm64, or on Kubernetes with the Helm chart. The core is Apache 2.0 - permission model, its test suite and the Helm chart included, nothing gated to get started. Nine commercial modules ship separately: tenancy (suspension, offboarding, quotas), SSO over OIDC with SCIM group sync, issuing document-level grants and deny rules, Enterprise-Managed Authorization and ID-JAG, SIEM forwarding, global admin, an encrypted backup of the whole installation, requiring a second factor, and filtered administration for very large directories. Four things a reader expects to find on that list are not on it - one vector collection per organization, evaluating grants and deny rules, the air-gapped Compose profile, and the audit log: writing it, reading it at GET /v1/audit and its JSONL/CSV export are all in the open repository. What a security team pays for is forwarding those events to a SIEM, not the events.

It is an index you push documents into over REST, MCP, the SDK or the CLI - UTF-8 text, PDF, Word, PowerPoint, Excel, OpenDocument, EPUB and RTF, S3-compatible object storage, URL ingest for text. Nothing crawls on the index's own account; you own the sync. Six Apache-2.0 reference connectors ship separately at https://github.com/nacre-work/connectors - git, S3, SQL, Google Drive, MongoDB and IMAP - each one container that pushes a single source and removes what the source dropped. There is no Confluence, SharePoint, Slack, Notion or Jira connector.

Pricing: the core is Apache 2.0 and free to self-host. Commercial modules are licensed separately; there is no public price list today.