# Nerve — the full capability matrix

Nerve · capability matrix

## Everything Nerve does, in _one honest list_.

No asterisks buried in a footnote. **Included**means on by default.**Configurable**means it ships off until you switch it on.**Enterprise** means it's in the enterprise tier. If something's still being built, it isn't on this page.

[The one-minute version →](https://dubhlan.com/nerve) [Get early access](https://dubhlan.com/#contact)

Included Configurable Enterprise

## The workforce

Agents that are staff, not stateless runs.

| Capability | What it is | Availability |
| --- | --- | --- |
| Persistent agents | 30 named agents, each with a written brief, discipline, avatar, model, toolset and credentials | Included |
| Sub-agents | Ephemeral helpers that inherit a lead agent's brief, model and tools, then retire | Included |
| Tool library | 71 first-party tools, automatically pruned to what each role should hold | Included |
| Per-agent, per-project models | Claude, vLLM, Ollama or your own — the same agent can run frontier in one project and local in another | Included |
| Team templates | Start with 9, 22 or all 30 agents; add whole teams — security, QA, DevOps, legal — in one click | Included |
| Capability-routed decomposition | Break an epic into subtasks, routed to the right specialist rather than one generic prompt | Included |
| MCP server & API | Drive Nerve's tools from Claude Desktop, Cursor or VS Code; scoped API keys for your own automation | Included |

## Work management

See the work, and where it's stuck.

| Capability | What it is | Availability |
| --- | --- | --- |
| Kanban | The whole workforce's work on one board — epic → feature → task → subtask, filterable by agent, stage and project | Included |
| Human-in-the-loop gates | Consequential decisions pause with a full handoff packet — what was produced, the chat that led there, the tool calls — for one-click approve or reject | Included |
| Live Flow | A real-time graph of dispatch and handoffs between agents, replayable over any past window | Included |
| Chat with any agent | Full streaming chat, with the tool-call trace and task-scoped threads | Included |
| Work-claims registry | Agents claim files before editing them, so the fleet coordinates instead of colliding on shared code | Configurable |

## Delivery & deploy control

You hold the dial between speed and control.

| Capability | What it is | Availability |
| --- | --- | --- |
| Deploy lockdown | Agents are refused every production-mutating tool at the dispatch layer, and can't push to protected branches | Included |
| Human-approved by default | Every deploy waits for a person. Raise an agent's autonomy when you choose to — and every deploy, human or agent, stays attributed and audited | Included |
| DORA metrics | The four keys — deploy frequency, lead time, change-failure rate, MTTR — computed from real deploy records | Included |
| Environment promotion | Move a build along a promotion lane between environments | Included |
| Deployment freeze | Hold everything at the deploy door; work resumes automatically when you lift the freeze — nothing is lost | Configurable |
| Rollback & auto-revert | Roll back on demand, and revert automatically when a post-merge build fails | Included |
| Conflict sentinel | Proactively scans every live branch against main for conflicts, without touching your working tree | Configurable |

## Cost governance

The ceiling you set is the ceiling you see.

| Capability | What it is | Availability |
| --- | --- | --- |
| Spend ceilings | Cap any tenant, team, project, agent or task in tokens _or_ dollars. Budgets stack — a call must clear every ceiling that covers it. Hit one and work pauses for a human instead of quietly spending more | Included |
| Warning thresholds | Get told when spend crosses a line you set, before it reaches the ceiling | Included |
| Cost reporting | Spend broken down by agent and model, with daily trends | Included |
| Savings ledger | Token savings dollarised — and each figure labelled measured or estimated, so you know which to trust | Included |
| Client telemetry | Errors and usage from the product your agents shipped, in a separate store — closing the loop from ship to real users | Configurable |

## Security & governance

The part a CISO reads first.

| Capability | What it is | Availability |
| --- | --- | --- |
| Separation of duties | No one approves their own gate — agent or human. Closing work can require a separate reviewer; maker and checker are different by design | Included |
| Per-agent secret grants | Default-deny: an agent reads a credential only where an explicit grant exists — per agent, integration and field | Included |
| Secret vault | Integration secrets encrypted AES-256-GCM at rest | Included |
| Secret-leak interruption | The stream is cut when a credential appears, and a rotation gate opens | Included |
| Prompt-injection firewall | Deterministic, no model call; sees through disguised text and reads override attempts across 21 languages | Included |
| Tool-input validation | Every tool call checked against its schema; oversized, smuggled and invisible payloads rejected | Included |
| Vulnerability management | Real CVE data from OSV, matched to the actual packages in your bill of materials | Included |
| SBOM | CycloneDX software bill of materials for the platform and each repository | Included |
| AIBOM | A bill of materials for your AI supply chain — models, agents, tools, MCP servers, prompts and data lineage | Included |
| CBOM | A cryptographic bill of materials — where and how you use cryptography, for post-quantum readiness | Included |
| Cloud posture (CSPM) | Policy-based cloud posture, evaluated live against your Kubernetes | Included |
| Compliance evidence | Posture policies map to the control families your auditor uses, so findings double as continuous evidence | Included |
| Risky-tool scoring | Every tool call scored for risk, severity-filterable, with optional gating above a threshold you set | Configurable |
| Permission model | An 80+-capability role model with a shadow mode that reports what enforcement _would_ deny before you switch it on | Configurable |
| Audit trail | Every admin action logged on success and failure; chat audited by fingerprint, never raw text | Included |
| Multi-tenant isolation | Tenant-scoped at every query; host-touching tools refused outside the platform tenant | Included |

## Identity & enterprise

What procurement asks for.

| Capability | What it is | Availability |
| --- | --- | --- |
| OIDC single sign-on | PKCE, state, nonce and JWKS RS256 verification | Included |
| SCIM 2.0 provisioning | User and group provisioning, tolerant of Okta and Entra quirks | Included |
| Audit export | Export the audit trail for your own retention and review | Enterprise |
| Managed cloud | Hosted by Dubhlán — your operational data isolated per tenant and encrypted at rest | Included |
| On-premises deployment | Nerve in your own infrastructure by enterprise engagement, with a licensing check-in | Enterprise |

## Reliability & operations

Keeping the fleet and the product healthy.

| Capability | What it is | Availability |
| --- | --- | --- |
| SRE golden signals | Latency, traffic, errors and saturation across every cluster you register | Included |
| Multi-cluster metrics | Live host and container stats across N clusters, with per-cluster filtering and trend history | Included |
| Resilient task routing | Deterministic dispatch with a staleness watchdog and automatic reassignment of a dead agent's work | Included |

Nerve is a managed service; on-premises is available for enterprise. We list what runs today — if something isn't here, it isn't built yet, not hidden.

## Want a walkthrough against your own checklist?

Send us the capabilities your team actually needs. We'll tell you honestly which are Included, which you'd configure, and which aren't there yet.

[Get early access →](https://dubhlan.com/#contact) [Talk to sales](mailto:lt@dubhlan.com)

Summary: Everything Nerve does, in one list: the agent workforce, work management, delivery and deploy control, cost governance, security (SBOM, AIBOM, CBOM, CSPM, compliance), and enterprise identity.

Canonical page: https://dubhlan.com/capabilities