Nerve · capability matrix
Everything Nerve does,
Everything Nerve does,
in one honest list.
No asterisks buried in a footnote. Included means on by default. Configurable means it ships off until you switch it on. Enterprise means it's in the enterprise tier. If something's still being built, it isn't on this page.
Included
Configurable
Enterprise
The workforce
Agents that are staff, not stateless runs.
| Capability | What it is | Availability |
|---|---|---|
| Persistent agents | 29 named agents, each with a written brief, discipline, avatar, model, toolset and credentials | Included |
| Sub-agents | Ephemeral helpers that inherit a lead agent's brief, model and tools, then retire | Included |
| Tool library | 71 first-party tools, automatically pruned to what each role should hold | Included |
| Per-agent, per-project models | Claude, vLLM, Ollama or your own — the same agent can run frontier in one project and local in another | Included |
| Team templates | Start with 8, 15 or 18 agents; add whole teams — security, QA, DevOps, legal — in one click | Included |
| Capability-routed decomposition | Break an epic into subtasks, routed to the right specialist rather than one generic prompt | Included |
| MCP server & API | Drive Nerve's tools from Claude Desktop, Cursor or VS Code; scoped API keys for your own automation | Included |
Work management
See the work, and where it's stuck.
| Capability | What it is | Availability |
|---|---|---|
| Kanban | The whole workforce's work on one board — epic → feature → task → subtask, filterable by agent, stage and project | Included |
| Human-in-the-loop gates | Consequential decisions pause with a full handoff packet — what was produced, the chat that led there, the tool calls — for one-click approve or reject | Included |
| Live Flow | A real-time graph of dispatch and handoffs between agents, replayable over any past window | Included |
| Chat with any agent | Full streaming chat, with the tool-call trace and task-scoped threads | Included |
| Work-claims registry | Agents claim files before editing them, so the fleet coordinates instead of colliding on shared code | Configurable |
Delivery & deploy control
You hold the dial between speed and control.
| Capability | What it is | Availability |
|---|---|---|
| Deploy lockdown | Agents are refused every production-mutating tool at the dispatch layer, and can't push to protected branches | Included |
| Human-approved by default | Every deploy waits for a person. Raise an agent's autonomy when you choose to — and every deploy, human or agent, stays attributed and audited | Included |
| DORA metrics | The four keys — deploy frequency, lead time, change-failure rate, MTTR — computed from real deploy records | Included |
| Environment promotion | Move a build along a promotion lane between environments | Included |
| Deployment freeze | Hold everything at the deploy door; work resumes automatically when you lift the freeze — nothing is lost | Configurable |
| Rollback & auto-revert | Roll back on demand, and revert automatically when a post-merge build fails | Included |
| Conflict sentinel | Proactively scans every live branch against main for conflicts, without touching your working tree | Configurable |
Cost governance
The ceiling you set is the ceiling you see.
| Capability | What it is | Availability |
|---|---|---|
| Spend ceilings | Cap any tenant, team, project, agent or task in tokens or dollars. Budgets stack — a call must clear every ceiling that covers it. Hit one and work pauses for a human instead of quietly spending more | Included |
| Warning thresholds | Get told when spend crosses a line you set, before it reaches the ceiling | Included |
| Auto-top-up | When you'd rather it continue, let a budget refill itself instead of pausing | Configurable |
| Cost reporting | Spend broken down by agent, model and day, with a 30-day trend | Included |
| Savings ledger | Token savings dollarised — and each figure labelled measured or estimated, so you know which to trust | Included |
| Client telemetry | Errors and usage from the product your agents shipped, in a separate store — closing the loop from ship to real users | Configurable |
Security & governance
The part a CISO reads first.
| Capability | What it is | Availability |
|---|---|---|
| Separation of duties | Agents can't close their own work or request their own deploys; maker and checker are different by design | Included |
| Per-agent secret grants | Default-deny: an agent reads a credential only where an explicit grant exists — per agent, integration and field | Included |
| Secret vault | Integration secrets encrypted AES-256-GCM at rest | Included |
| Secret-leak interruption | Generation stops mid-stream when a credential appears, the output is redacted, and a rotation gate opens | Included |
| Prompt-injection firewall | Deterministic, no model call; sees through disguised text and reads override attempts across 30+ languages | Included |
| Tool-input validation | Every tool call checked against its schema; oversized, smuggled and invisible payloads rejected | Included |
| Vulnerability management | Real CVE data from OSV, matched to the actual packages in your bill of materials | Included |
| SBOM | CycloneDX software bill of materials for the platform and each repository | Included |
| AIBOM | A bill of materials for your AI supply chain — models, agents, tools, MCP servers, prompts and data lineage | Included |
| CBOM | A cryptographic bill of materials — where and how you use cryptography, for post-quantum readiness | Included |
| Cloud posture (CSPM) | Policy-based cloud posture, evaluated live against your Kubernetes | Included |
| Compliance evidence | Posture policies carry HIPAA and SOC 2 control references, so findings double as continuous evidence | Included |
| Risky-tool scoring | Every tool call scored for risk, severity-filterable, with optional gating above a threshold you set | Configurable |
| Permission model | A 79-capability role model with a shadow mode that reports what enforcement would deny before you switch it on | Configurable |
| Audit trail | Every admin action logged on success and failure; chat audited by fingerprint, never raw text | Included |
| Multi-tenant isolation | Tenant-scoped at every query; host-touching tools refused outside the platform tenant | Included |
Identity & enterprise
What procurement asks for.
| Capability | What it is | Availability |
|---|---|---|
| OIDC single sign-on | PKCE, state, nonce and JWKS RS256 verification | Included |
| SCIM 2.0 provisioning | User and group provisioning, tolerant of Okta and Entra quirks | Included |
| Audit export | Export the audit trail for your own retention and review | Enterprise |
| Managed cloud | Hosted by Dubhlán — your operational data isolated per tenant and encrypted at rest | Included |
| On-premises deployment | Run Nerve entirely in your own infrastructure, so the data stays in your walls | Enterprise |
Reliability & operations
Keeping the fleet and the product healthy.
| Capability | What it is | Availability |
|---|---|---|
| SRE golden signals | Latency, traffic, errors and saturation across every cluster you register | Included |
| Multi-cluster metrics | Live host and container stats across N clusters, with per-cluster filtering and trend history | Included |
| Resilient task routing | Deterministic dispatch with a staleness watchdog and automatic reassignment of a dead agent's work | Included |
Nerve is a managed service; on-premises is available for enterprise. We list what runs today — if something isn't here, it isn't built yet, not hidden.
Want a walkthrough against your own checklist?
Send us the capabilities your team actually needs. We'll tell you honestly which are Included, which you'd configure, and which aren't there yet.