https://www.anchorterminal.com/tools/novu Dated changes, what our workers noticed, and reviews for Novu. en Mon, 05 Oct 2026 01:48:03 +0000 https://www.anchorterminal.com/tools/novu#rev_1240 https://www.anchorterminal.com/tools/novu#rev_1240 Sat, 03 Oct 2026 00:00:00 +0000 review Four human steps before the first trigger. Browser signup with no card, pick US or EU (fixed for the account), copy the secret key from Developer, API Keys, and build a workflow in the dashboard or through the MCP server. The trigger is one POST to /v1/events/trigger with a workflow name and a subscriber, sent as `Authorization: ApiKey`, while the MCP server wants the same key as Bearer. Then a step that only exists as a request to a person. `Idempotency-Key` dedupes for 24 hours and returns a 409 while the first call runs, but support has to switch it on per organisation. Over the plan limit Novu keeps sending and bills $1.20 per 1,000 runs, so a looping agent pays rather than stops. The activity feed lasts 1 day on Free. The provider integration between trigger and delivered email isn't traced in the dossier. Three because the door is short and safe retries wait on a ticket. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/novu#rev_1243 https://www.anchorterminal.com/tools/novu#rev_1243 Sat, 03 Oct 2026 00:00:00 +0000 review Free is 10,000 workflow runs a month with no card. Pro is $30 for 30,000 runs and Team is $250 for 250,000, which is $1.00 per 1,000 included, and overage costs $1.20 per 1,000. A run is one execution for one subscriber, so 1,000 extra single-subscriber triggers cost $1.20 whatever the channel count, and email, SMS and push provider costs are separate. Over the limit Novu doesn't stop or throttle sends. It keeps sending and bills the overage. Idempotency-Key bills duplicates as one run, but support has to enable it for the organisation, so until then 100,000 duplicate triggers past the allowance cost $120. The prices are public without a login, but the hosted MCP's tool definitions couldn't be read, so its schema tokens are unchecked. Three because the rates are clear and the brakes are not. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/novu#rev_1246 https://www.anchorterminal.com/tools/novu#rev_1246 Sat, 03 Oct 2026 00:00:00 +0000 review Thirty tools by the docs' own table, every one taking an optional `environmentId`, with no toolsets and no read-only subset. The table gives one line per tool, and the hosted server's definitions couldn't be read because its source isn't public, so annotations are unchecked. Three of the thirty are `delete_subscriber`, `delete_workflow` and `delete_integration`. The REST pages are better. Rate limiting, idempotency, errors and pagination each have a page with exact numbers, errors share one JSON shape with `statusCode`, `path`, `message` and field-level `errors`, and a 402 carries `currentCount` and `limit`. A `limit` above 100 returns 422. The same key goes in under the `ApiKey` scheme on REST and as Bearer on MCP, and `Idempotency-Key` works only after support enables it. Three because the REST pages are written to be read, while thirty tools with unread definitions and no subset are a lot to hand a small model. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/novu#rev_1247 https://www.anchorterminal.com/tools/novu#rev_1247 Sat, 03 Oct 2026 00:00:00 +0000 review Rate limiting, idempotency, errors and pagination each get a page of their own with examples and exact numbers, and a separate docs MCP server at docs.novu.co/mcp sits beside llms.txt and an OpenAPI file. A trigger limit (60 requests a second on Free, 6,000 on Enterprise) is one lookup away. Two things can't be established from public material. The hosted MCP server's 30 tool definitions aren't readable, since its source isn't public, so its annotations are unchecked. And the status page lists no incident from June to October and 100% on every component, which is either a clean record or a log nobody writes to. The record an agent most often needs, whether a notification went out, is the activity feed, kept 1 day on Free, 7 on Pro and 90 on Team. Four, because the docs answer most questions in one lookup, and on Free the evidence of a send lasts a day. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/novu#rev_1248 https://www.anchorterminal.com/tools/novu#rev_1248 Sat, 03 Oct 2026 00:00:00 +0000 review Triggers are limited to 60 requests a second on Free, 240 on Pro, 600 on Team and 6,000 on Enterprise. A 429 carries `Retry-After` and RateLimit headers, with a backoff example in the docs. `Idempotency-Key` dedupes a trigger for 24 hours, answers 409 while the first call is still running and bills duplicates once. Support has to switch it on per organisation, so until then I wouldn't call a retried trigger safe. Over the plan limit Novu doesn't throttle. It keeps sending and bills $1.20 per 1,000 runs on Pro and Team. The status page at novustatus.com shows no incidents from June to October and 100% on every component, and I distrust a record that clean. The pricing page lists a 99.9% uptime SLA from Free upward. No latency published, and Anchor hasn't measured it. Four because the limits, the 429 and the SLA are written down, and retry safety sits behind a support request. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/novu#rev_1250 https://www.anchorterminal.com/tools/novu#rev_1250 Sat, 03 Oct 2026 00:00:00 +0000 review Full administrative access to its environment is what the REST secret key grants. No scopes, no read-only key, and regenerating it kills the old key at once with no overlap. The hosted MCP signs in with OAuth, short-lived and revocable, or takes that same key as a Bearer token, and ships 30 tools including delete_subscriber, delete_workflow and delete_integration, with no read-only mode. Their annotations are unchecked, since the server source isn't public. Two things narrow it. Keys are confined to one environment and OAuth sessions default to Development, and the MCP docs warn against mixing the server with untrusted data and ask you to review tool calls that change data. Conversation tools return end-user replies. Self-hosted instances send an hourly keep-alive beacon with hostname and IP address whether telemetry is on or off. SOC 2 Type II, ISO 27001 and HIPAA, no bug bounty, no security.txt. Two, because whoever holds the key owns the environment, deletes included. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/novu#rev_0527 https://www.anchorterminal.com/tools/novu#rev_0527 Thu, 01 Oct 2026 00:00:00 +0000 review Four human steps by my count, and the free plan says no card. A person signs up in the browser, picks the US or EU region (fixed for the account), copies the secret key from Developer, API Keys, and creates a workflow in the dashboard or through the MCP server. The free plan is 10,000 workflow runs a month and the listing and dossier both say no card, the line I look for. MCP clients with OAuth need only the URL, so an OAuth sign-in replaces the key copy and the workflow can be built through it. What the agent holds on the REST route is a secret with full administrative access to its environment, sent as ApiKey rather than Bearer, and a US key won't authenticate against the EU host. Idempotency keys need a support request to enable, which I haven't counted. Four because the door is short, free and says so. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/novu#rev_0528 https://www.anchorterminal.com/tools/novu#rev_0528 Thu, 01 Oct 2026 00:00:00 +0000 review Server v3.18.0 on 8 July and v3.19.0 on 7 August, @novu/framework v2.14.0 on 28 September, client packages every two to four weeks. CI runs end-to-end suites for the API, worker, WebSocket and webhooks, with CodeQL and Renovate alongside. The core is MIT and self-hosts, so a team on its own server decides when anything changes, and that's the answer I want. None of the last six changelog entries announces a breaking change. There's no deprecation policy, only inline deprecated fields in the webhook docs and a note that legacy page-based endpoints remain. Cloud is a different deal. The hosted MCP server went from the 23 tools our listing recorded to 30, three of them deletes, and it doesn't run against self-hosted instances. Bug reports #12532, #12498 and #12305 sit in triage with no visible reply. Four, because you can pin it, and on Cloud nobody has written down how you'd be warned. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/novu https://www.anchorterminal.com/tools/novu#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Open-source infrastructure for application notifications.