The platform is free. What you buy is us running it.
Every capability ships in the MIT build you self-host, with no seat cap and no licence key. Enterprise is that same build, operated by Attention Labs inside your own VPC.
- MITlicense
- 0runtime deps
- 0egress by default
Your recordings stay inside your boundary.
Hotato has no hosted backend. Scoring runs on the machine that invokes it, against files you already hold.
The core is stdlib-only Python with no required third-party dependencies, so there is no account, no key, and no network call of its own. Sending a recording to a vendor to find out whether your agent talked over a caller is a decision you never have to make.
Network access happens only when you run a command whose job is to reach out, against a stack you connected. The one off-box audio path is a hosted diarizer behind an explicit --egress-opt-in flag; the default diarizer is local.
Command by command: read the security posture →
- License
- MIT
- Install
- pip install hotato
- Required deps
- None
- Account
- None
- Licence key
- None
- Seat cap
- None
- Agent cap
- None
- Telemetry
- None
Every capability is in the build you download.
Nothing on this list is held behind a tier. It is one MIT repository, and the checks that decide a verdict are in it.
| Capability | What you get |
|---|---|
| The scorecard | One score per dimension across outcome, policy, conversation, speech and reliability. They are reported separately and never blended, and there is no overall score. |
| Deterministic assertions | Twenty assertion kinds decide the verdict from your evidence, with no model in the path: phrase, pii, policy, tool_call, outcome, tool_result, tool_error, http_result, state, state_change, handoff, dtmf, termination, latency, timing_contract, entity_accuracy, sequence, count, formula and order. |
| The model judge | A separate advisory lane. Its verdicts are quarantined from the deterministic count, so a model-scored result is never blended into one, and it gates a build only when you pass --gate-judge. |
| Team workspace | hotato serve and hotato console bring up the local workspace — calls, suite health, failure clusters — on 127.0.0.1:8321. Stdlib http.server and sqlite3, a bearer token stored 0600, every request authenticated and audited. |
| Re-scoring stored evidence | hotato contract verify re-scores every bundle's audio against its recorded policy; hotato prove --contracts re-measures the stored evidence. A changed verdict fails the build. |
| Evidence store | Content-addressed with sha256 over the canonical JSON of every field, so a restored artifact is the same bytes that produced the verdict. Ed25519 signing is available through the [sign] extra and verifies from the public key alone. |
| Capture adapters | Vapi, Twilio, Retell, LiveKit and Pipecat hand back one party per channel, so an overlap names who caused it. Bland, ElevenLabs, Synthflow, Millis and Cartesia are mono, which a channel cannot attribute. |
| CI | A composite GitHub Action and a pytest11 plugin with no conftest and no imports. The step exit is hotato's exit code: 0 pass, 1 fail, 2 refuse. |
| Agent access | A local MCP server over stdio, plus AGENTS.md and llms.txt, so a coding agent can drive the loop without a CLI transcript to parse. |
| Scale | No seat cap, no per-agent cap, no licence key, no account, no telemetry. |
Why the whole thing is openThe checks decide whether a call passes, so a check nobody can read is a check nobody should trust. Publishing them is what makes the verdict arguable. Bring it up with one compose command →
The same build, run by the people who wrote it.
We deploy, operate and upgrade hotato inside your VPC. The audio and the evidence stay in your account; the pager is ours.
Inside your VPC
Your cloud account, your network, your storage. We run the deployment and hand you the zero-egress verification that records the posture we set up.
A named engineer
One maintainer assigned to your deployment, reachable directly, who reads your failing calls with you rather than triaging a ticket.
An availability commitment
Written into your agreement and agreed per deployment, because the figure depends on the region, the redundancy and the recording volume you run.
The full inclusion list, and what we need from you to scope it: see the enterprise offer →
What does paying change?
Who operates the deployment, and who you call when a scored run disagrees with what you heard. Not what the tool can measure.
Is any capability held back from the free build?
No. The scorecard, the twenty deterministic assertion kinds, the advisory judge, the workspace, the evidence store and every capture adapter are in the MIT repository, and the enterprise deployment runs that same code.
The commercial line is operation: we stand up the deployment in your account, keep it upgraded, commit to its availability, and put a named engineer on it.
How many people can use it?
As many as you like. There is no seat cap, no per-agent cap and no licence key in the codebase, so nothing counts your users or calls home to check.
What does the enterprise tier cost?
It is scoped per deployment. Send us the stack you record on, your monthly call volume, the cloud account it runs in and the availability you need, and we price it against that.
Do we give anything up by staying self-hosted?
The tool measures the same thing either way. You operate it: the compose bring-up, the upgrades, and the backup of the /data volume that holds the registry, evidence store, token and audit log.
Start free. Talk to us when you want it operated.
One command installs the whole platform. MIT-licensed, no account.
$ pip install hotato
Read the enterprise offer, or write to a person. Enterprise → · [email protected] →