[ Pricing ]
Free on your laptop. Paid when your team needs a control plane.
The scanner, the runtime enforcer and attestations are open source and always will be. The PR bot is free for public repos. You pay for private-repo scale, merge gates, fleet control and compliance evidence.
Free
$0forever
For individual developers and open-source projects.
· CLI & V8 runtime enforcer, all 12 RWXi capabilities + GHunter gadget guards· Local capwall wrap & capwall mcp scan for Claude Code, Cursor & MCP servers· in-toto + DSSE local attestations & CycloneDX Security-Enhanced SBOM export· PR capability-diff bot: unlimited public repos + 3 private repos (50 PR checks/mo)
TeamPopular
$39per active developer / month
For teams merging dependency changes every week.
· Everything in Free + Unlimited private repos & PR checks· Blocking PR merge gates + signed security-owner approval· Org-wide MCP schema pinning & Agent Evidential Contract PR checks· Cloud dashboard with interactive dependency capability graph· Live audit/enforce telemetry alerts (Slack, PagerDuty, Webhooks)· 1-Click remote policy hot-patch across up to 25 production nodes (zero redeploy)
Enterprise & compliance
$2k+per month
For regulated teams that need audit-ready evidence.
· Everything in Team· Signed in-toto SBOM & Runtime BOM (RBOM) retention + zkSBOM proofs· Automated SOC 2, ISO 27001 & PCI DSS 4.0 (Req. 6.4.3 / 11.6.1) evidence packs· Immutable Base L2 cryptographic timestamp registry & HSM key custody· Unlimited nodes, Kubernetes admission controller & SAML SSO
[ Compare plans ]
Everything, side by side.
| Feature | Free | Team | Enterprise |
|---|---|---|---|
| Enforcement | |||
| CLI: scan, init, allow, deny, run | ✓ | ✓ | ✓ |
| Runtime enforcer, all 11 capabilities | ✓ | ✓ | ✓ |
| in-toto + DSSE attestations | ✓ | ✓ | ✓ |
| Team automation | |||
| PR capability-diff bot · public repos | ✓ | ✓ | ✓ |
| PR capability-diff bot · private repos | 3 repos · 50 PRs/mo | Unlimited | Unlimited |
| Blocking merge gates + signed approvals | · | ✓ | ✓ |
| Dashboard and capability graph | · | ✓ | ✓ |
| Live alerts: Slack, PagerDuty, webhooks | · | ✓ | ✓ |
| Remote policy hot-patch | · | 25 nodes | Unlimited |
| Compliance & scale | |||
| Signed SBOM + runtime BOM evidence | · | · | ✓ |
| SOC 2, ISO 27001, PCI DSS 4.0 reports | · | · | ✓ |
| Kubernetes admission control | · | · | ✓ |
| SSO / SAML | · | · | ✓ |
| Dedicated threat-feed sync | · | · | ✓ |
[ FAQ ]
Questions, answered straight.
Yes. The scanner, CLI, runtime enforcer and attestations are Apache-2.0. Use them commercially, with no account and no telemetry unless you turn it on.