Directus puts a governed API and Studio over SQL
Directus turns one SQL schema into three useful surfaces: REST, GraphQL, and a visual Studio. Developers still own the database model. Editors can manage records and files without waiting for a bespoke admin screen, while applications use generated APIs. Permissions reach down to fields, so the same data can look different to an editor, a public client, and an internal service.
The README names seven database families, including PostgreSQL, MySQL, SQLite, Oracle, and CockroachDB. Directus also has flows, extension points, authentication, file storage, an AI assistant, and an MCP server. That breadth is the reason to choose it. It is also why the decision resembles adopting application infrastructure more than installing an admin panel.
A 4,631-file checkout is a platform, not a thin database wrapper
commit f5be756 contained 4,631 files, about 508,860 lines of source, and a 24.9 MB checkout. The pnpm workspaces cover the API, Studio, SDK, extensions, storage drivers, validation, themes, and supporting packages. You avoid building those pieces yourself, but your team inherits their release changes, configuration, and operational boundaries.
The source tree requires Node 22 and pnpm 10. For a self-hosted production instance, the official deployment guide configures a secret, database connection, administrator email and password, persistent storage, and health checks. Its fuller Compose example adds PostgreSQL and Redis. Email, object storage, external identity, and caching each expand the credential and recovery plan.
What happened when we ran it
Our sandbox installed commit f5be756 in 41 seconds. It pulled 2,082 packages and occupied 1,370 MB on disk, then the build completed in 63 seconds. The fresh Debian container had 3 CPUs, 8 GB of RAM, Node 22, no secrets, and no elevated privileges. We measured repository mechanics, not API latency, editor responsiveness, or database throughput.
The test command failed with exit code 1 after 99 seconds. Its supplied Vitest summary recorded 7 passed and 0 failed out of 7. The last visible lines also showed successful groups in the GCS, S3, Supabase, validation, themes, and visual-editing packages before pnpm printed ELIFECYCLE and stopped.
Those passing lines do not turn the command into a pass. The log tail does not include the earlier failure that caused the nonzero exit, so naming a broken package or missing system dependency would be guesswork. The useful result is narrower: install and build worked, while this commit did not complete a green test step in our unprivileged container. The repository did include 18 CI workflow files, a Dockerfile, a Compose file, and a tests directory.
MCP access carries the same consequences as a database role
Directus exposes a native MCP endpoint for agents working with live data. Version 12 added an OAuth 2.1 authorization server with PKCE, controlled by environment settings. The README says agent access follows the same policies as human access, which gives operators one permission system instead of a second agent-only layer.
A shared policy system still needs careful roles. Give an MCP client only the collections, fields, and actions its job requires, and separate read access from mutations where possible. Flows can make a simple record update trigger more work. Issue 27766 also notes that /mcp and its OAuth client routes were missing from the OpenAPI spec, even though the routes existed behind settings and environment gates.
Version 12 makes licensing an architecture input
The project uses the Monospace Sustainable Core License 1.0, which its README describes as source available. Organizations below $5 million in annual revenue and 50 employees can apply for an Open Innovation Grant, while a core tier is available without a commercial license. Larger organizations using advanced or enterprise features need commercial terms. That is a procurement question before Directus becomes the center of a product.
Release v12.0.0 introduced active entitlement enforcement. It says new instances receive enforcement immediately and upgrades get a 30-day grace period. SSO, custom permission rules, custom or self-hosted LLM connections, and AI translations are among the affected features. The same release changed reverse-proxy trust defaults and restricted the dependency health endpoint, so an upgrade review has to cover deployment behavior as well as the Studio.
October activity is strong, but the API description has gaps
GitHub showed 38,023 stars and a last push on October 5, 2026. Search results counted 350 open issues and 54 open pull requests, rather than treating the combined 404 as bugs. The latest release, v12.4.1, shipped on September 23 with a fix for non-admin reads from the folders endpoint. This is an active project with current maintenance.
Activity does not erase interface risk. Open issue 27700 tracks missing paths and methods in the generated OpenAPI description, including dashboards, notifications, shares, deployments, MCP, and the SEARCH method. Teams that generate clients or validate traffic from the specification should compare it with the endpoints they actually use. Open issue 26570 separately documents a custom extension image that builds successfully, then crashes because pnpm 10 suppresses native install scripts.
Pick Directus when several users must share one data model
Directus makes sense when an existing relational model needs an editor, governed APIs, files, and automation in one product. Strapi is more content-shaped, Payload keeps configuration close to a TypeScript application, and NocoDB centers the table interface. Our 63-second build shows the source can compile cleanly at f5be756, while the failed 99-second test step keeps this from being a carefree recommendation. Test your real schema, license tier, permission matrix, and upgrade path before it owns production data.