Validibot Self-Hosted Editions¶

Validibot is available in three self-hosted editions: Community (free, open source), Pro (commercial license), and Enterprise (for large organisations).

Philosophy¶

Community is for individuals. Pro is for teams.

The Community edition gives you full access to Validibot's validation capabilities, including advanced validators. Run simple validations (JSON Schema, XML Schema, custom CEL statements, etc.) and advanced validations, explore the results, prove the tool works for your use case. There's no restrictions on what you can validate.

The Pro edition adds team collaboration features, guest access management, and commercial support.

Community Edition¶

The Community edition is licensed under AGPL-3.0. You can use it freely for any purpose, but modifications must be released under the same license.

Run the full self-hosted application:

Start with the Installation Guide. The recommended self-hosted path uses Docker Compose with just commands for day-to-day operations.

If you're embedding Validibot as a Python dependency for development or integrations, you can also install the package directly:

pip install validibot

That direct package install is for embedding Validibot in Python workflows. It does not provision the full self-hosted web application by itself.

What you can do:

• Validate FMUs, configuration files, and other technical artifacts
• Use all validators, including advanced simulation-based validators
• Build and test custom validators
• Integrate into your own tools and scripts (under AGPL terms)

Pro Edition¶

Pro is for teams who need collaboration features and commercial support.

Pricing: $195/month per organization (up to 3 users)

What you get:

• Everything in the Community edition
• Up to 3 users — Pro is a small-team starter tier; teams that grow past 3 users move to Enterprise
• Commercial license — Use Validibot without AGPL obligations
• Team management — Invite team members with role-based access control
• Guest access — Let external collaborators (clients, partners) submit data and view results on workflows you share with them. Guests don't count toward your seat cap, but their workflow runs are billed to your org.
• Verifiable Credentials — W3C Verifiable Credentials 2.0 issued for validation results, signed with your deployment's key so downstream verifiers can confirm the result without trusting the signer's infrastructure (see Evidence: trust by assertion vs trust by cryptography below)
• MCP server — Connect AI assistants (Claude, Cursor, etc.) to your workflows via the Model Context Protocol. The MCP container ships in the community repo but only accepts traffic when a Pro license is active.
• Priority email support — Direct access to the maintainers

Purchase: validibot.com/pricing

Evidence: trust by assertion vs trust by cryptography¶

Both editions produce evidence for every completed validation run. The difference is who has to trust whom for that evidence to mean something.

Community evidence is a structured JSON manifest recording what was checked, by which validator versions, against which input contract, with what result. The manifest's bytes are hashed and the hash is recorded in the database. This is trust by assertion — anyone reading the manifest must trust that your deployment recorded it honestly and hasn't tampered with the bytes since.

Pro evidence adds a W3C Verifiable Credential (compact-JWS) signed by your deployment's key. The credential cryptographically binds the result to the manifest's hash. Anyone, anywhere, can verify the credential against your published JWKS endpoint — no trust in your infrastructure required. This is trust by cryptography.

Think of it like notarization:

• Community gives you a record with your initials on it. Useful for your own files; people who already trust you accept it.
• Pro adds a notary stamp. Anyone can verify the stamp against the notary's public registry, even people who've never met you.

Which tier do you need?¶

If your business depends on third parties trusting your validation reports, you need Pro. If you're running validations primarily for internal use or for audiences who already trust you, Community is enough.

For more on how each tier shows up in the run detail UI and what files you can download, see Reviewing Results — Evidence and Credentials.

Setting up Validibot Pro¶

After purchasing, we'll email a license-ready notice without a package key. Create an account using the same email address used during checkout, verify the address, and generate the package API key on your License Dashboard.

The key is shown once. Validibot stores only a keyed digest and cannot recover or email it later. If it is lost, replace it in the dashboard; replacement invalidates the previous key immediately.

Before you start¶

Make sure you have all three of these:

• the email address used during Stripe checkout
• a verified account at validibot.com using that same email
• the package API key generated once in the dashboard

Once that is done, follow these steps to install and activate Pro features.

Step 1: Store the package credential safely¶

Put the checkout email and newly generated key in a mode-0600 ~/.netrc file:

machine pypi.validibot.com
  login YOUR_EMAIL
  password YOUR_API_KEY

chmod 600 ~/.netrc

Never put the key in a URL, .env file, Docker ARG, or CI command. These can leak through history, logs, process listings, build metadata, and image layers.

Step 2: Get your exact package reference¶

The strongest reference is the credential-free, SHA-256-pinned wheel URL on the dashboard:

https://pypi.validibot.com/packages/validibot_pro-X.Y.Z-py3-none-any.whl#sha256=<hash>

pip reads authentication from ~/.netrc. Quote the URL in shell commands because many parsers treat #sha256=... as a comment.

If you prefer a package-name install, use the private index only for the install command:

pip install --no-deps \
  --index-url https://pypi.validibot.com/simple/ \
  validibot-pro==X.Y.Z

Do not save a global extra-index-url; public and private indexes can then compete for package names.

Step 3: Install the package into your Validibot environment¶

Choose the option that matches how you run Validibot.

cp .envs.example/.production/.docker-compose/.build .envs/.production/.docker-compose/.build

VALIDIBOT_COMMERCIAL_PACKAGE="https://pypi.validibot.com/packages/validibot_pro-X.Y.Z-py3-none-any.whl#sha256=<hash>"

VALIDIBOT_COMMERCIAL_NETRC=/home/operator/.netrc

VALIDIBOT_COMMERCIAL_PACKAGE=validibot-pro==X.Y.Z

cp .envs.example/.local/.build .envs/.local/.build

VALIDIBOT_COMMERCIAL_PACKAGE="https://pypi.validibot.com/packages/validibot_pro-X.Y.Z-py3-none-any.whl#sha256=<hash>"

VALIDIBOT_COMMERCIAL_PACKAGE=validibot-pro==X.Y.Z
VALIDIBOT_COMMERCIAL_NETRC=/home/operator/.netrc

just local-pro up --build

pip install "https://pypi.validibot.com/packages/validibot_pro-X.Y.Z-py3-none-any.whl#sha256=<hash>"

pip install validibot-pro==X.Y.Z

Step 4: Select the Pro settings module¶

Do not edit config/settings/base.py. For a self-hosted production deployment, set:

DJANGO_SETTINGS_MODULE=config.settings.production_pro

For local evaluation, just local-pro selects config.settings.local_pro automatically. If you maintain a custom deployment, create an environment-specific settings module that extends your normal settings and appends validibot_pro to INSTALLED_APPS.

Enterprise currently requires a custom environment-specific module that adds both validibot_pro and validibot_enterprise; it must not modify the shared base settings.

Step 5: Restart or rebuild Validibot¶

Restart or rebuild after you update settings.

Step 6: Run migrations if needed¶

If your deployment does not automate migrations, run:

python manage.py migrate

Installing the package is the license. Adding the Django app to INSTALLED_APPS activates it for that deployment.

You can verify Pro is active by checking the edition badge in the Validibot footer or by running validibot --version.

Enterprise Edition¶

Enterprise follows the same installation flow as Pro, but uses the validibot-enterprise package instead.

Setting up Validibot Enterprise¶

Use the same private package key and netrc flow shown above, but replace the package reference:

• In Docker or local .build files, use the credential-free exact Enterprise wheel URL from the dashboard, or VALIDIBOT_COMMERCIAL_PACKAGE=validibot-enterprise==X.Y.Z; set VALIDIBOT_COMMERCIAL_NETRC to the absolute path of the protected netrc
• In a direct Python environment, install the exact Enterprise wheel URL or run pip install validibot-enterprise==X.Y.Z after configuring the private index
• In Validibot settings, add both validibot_pro and validibot_enterprise to INSTALLED_APPS

Enterprise includes Pro as a dependency, so you do not need to install both wheels manually. You should still add both validibot_pro and validibot_enterprise to INSTALLED_APPS so Django loads both apps.

Installing validibot-enterprise is the license. No runtime Enterprise license key is required.

Frequently Asked Questions¶

Can I evaluate Pro before purchasing?¶

Yes. The Community edition includes all validators — you can prove the validation logic works for your use case locally. Pro adds team collaboration and commercial support.

If you need to evaluate the full Pro feature set, contact us for a trial license.

What if my Pro license expires?¶

You can continue using the version you have installed, but you won't be able to download updates or reinstall. Renew your license to restore access.

Do you offer Enterprise pricing?¶

Yes. The Enterprise edition includes everything in Pro plus: dedicated account manager, SSO/SAML integration, multi-org management, unlimited users, and custom onboarding and training. Contact us at enterprise@mcquilleninteractive.com.

I have AGPL compliance questions¶

If your legal team has concerns about AGPL, the Pro commercial license removes those obligations.

Support¶

• Community: GitHub Issues
• Pro: Email support included with your license
• Documentation: https://validibot.com/resources/docs/