Core vs EE comparison¶
Umbryx ships as one source tree with an app/ee package present (EE)
or absent (Core). Anything not listed as EE-only below is available in
both editions. "EE only (unlicensed: read-only)" means the endpoints
exist but mutations return 402 until a license is applied.
| Capability | Umbryx Core | Umbryx EE | Notes |
|---|---|---|---|
| Projects, members, invitations | Available | Available | 11 project roles in both |
| Organizations, teams | Available | Available | >1 organization requires a plan feature (EE license) |
| Hosts, scope, ROE enforcement | Available | Available | |
| Credentials + vault | Available | Available | per-project DEK encryption in both |
| Findings, templates, candidates | Available | Available | |
| Notes, loot, KB, checklist, objectives | Available | Available | |
| Network map, Smart Build, attack graph | Available | Available | |
| Attack paths (manual, MITRE) | Available | Available | |
| Scans over attacker SSH (nmap/nuclei/NetExec/httpx/ffuf/DonPAPI) | Available | Available | tools run on your machines |
| Credential validation + access edges | Available | Available | |
| Playbooks, scheduled runs, automations | Available | Available | |
| Jobs, ROE approvals, SSE output | Available | Available | |
| Reports (PDF/HTML/MD), purple report | Available | Available | |
| Timeline, snapshots, audit log + HMAC | Available | Available | |
| RBAC, MFA | Available | Available | — |
| OIDC SSO | Plan feature | Available | SSO is a plan feature on orgs (tier-gated in both editions) |
| Search, import/export (ZIP/CSV/Nessus/Burp/BloodHound/firewall) | Available | Available | |
| C2 integrations (Adaptix/Mythic/Sliver) + webhooks | Available | Available | |
| C2 Ops (listeners, payload generation) | Available | Available | core router /api/infra-v2/c2 |
| Watch (surface monitoring) | Available | Available | |
| Deconfliction (host claims) | Available | Available | |
| Workstations: register own machines, key grant/revoke, action log | Available | Available | the audit-relevant half of the pool |
| Workstations: provisioning from templates | Not implemented | EE only | Hetzner/Proxmox/Docker/K8s/manual |
| Platform Ops: catalog, stacks, deploy engine | Not implemented | EE only (unlicensed: read-only) | /api/infra-v2 |
| Cloud providers (Hetzner/DO/Vultr API, Proxmox, AWS*, Docker, K8s) | Not implemented | EE only | *AWS/Azure/GCP as pre-provisioned SSH hosts |
| Deploy methods incl. Terraform and bare-metal nginx | Not implemented | EE only | |
| DNS zones/records, ANetExec/Let's Encrypt | Not implemented | EE only | |
| SSL certificates management | Not implemented | EE only | |
| Managed instances (k8s pool, claim/release) | Not implemented | EE only | |
| Instance credentials (per-user, encrypted) | Not implemented | EE only | |
| Image registries administration | Available | Available | router is shared code, mounted in both editions |
| Multi-node HA deployment (2+ app nodes, Sentinel, pg failover) | Not implemented | EE only, separately licensed (ha_cluster option; one license per cluster) |
app-level HA variables work in both; an HA-configured node refuses to start without the option |
| Air-gap installation bundle | Available (script in repo) | Available | published by the EE CI pipeline |
| License key | Not required | Required (signed token) | Core: BSL 1.1 + production grant |
| Free-tier practical limits | 5 members, 90-day audit | per license tier | tiers: team / pro / enterprise |
Upgrade path¶
The database schema is identical between editions (Core creates all tables, including EE ones it never writes). Moving Core → EE is:
# point BACKEND_IMAGE/FRONTEND_IMAGE at the EE images, then:
docker compose pull && docker compose up -d
and activating a license (see Umbryx EE). Downgrade is symmetric — the Core image simply stops mounting EE routers.