Free
$0 USD · no subscription
Keep an eye on your everyday dependencies.
- 25 watched packages
- Public package and project checks
- Email alerts and weekly digest
- Embeddable README badges
- Supply-chain news feed with a verified account
Pricing: Free, Solo, Pro and Team
Pricing
Less checking. More confidence in your stack.
Track what matters. Get warned when a dependency needs attention.
Solo
$7 USD / month
Or $70/year. Monitoring for an individual developer.
- Planned: 100 unique watched packages
- Email digest and messaging alerts
- 2 API tokens; request allowance to be defined
Price hypothesis; entitlements need implementation and validation.
Pro
$19 USD / month · planned
Or $190/year · two months free.
Planned founding offer: $120 for your first year. $10/month equivalent, billed $120 upfront.
Renews at $190/year.
250 packages. 10× the Free allowance.
- Everything in Free
- 5 private GitHub repositories
- 5 integration sources
- Personal MCP & CI API tokens
- Slack, Discord and private feed alerts
Subscriptions are paused until every included feature has been manually validated. Prices and features are previews; no launch date is set.
Team
$15 USD / seat / month
Billed annually at $180 per seat. Minimum 3 seats: $540/year before tax.
- Planned: Pro monitoring with shared watchlists
- Shared alert channels and admin/member roles
- One invoice; pooled capacity to be defined
Price hypothesis; team access, seat billing and limits need implementation and validation.
Price previews exclude VAT / sales tax; the applicable tax and total will be shown before payment when subscriptions open. Private analysis requires connection setup. AI patch execution is not included in these plans. A future add-on is under consideration.
Free API access and a larger manifest allowance are being evaluated; they are not available yet. Existing subscription terms and legacy allowances are preserved.
Assessments are decision-support information and can be wrong. Verify evidence before acting; paid monitoring does not guarantee security or immediate detection. Read the disclaimer and data policy.
Compare all features and limits
A watched package counts once across your projects. Public checks are subject to normal rate limits. Solo and Team entries are proposals, not active entitlements. Pro subscriptions remain subject to manual release validation.
| Feature | Free | Solo · coming soon | Pro | Team · planned |
|---|---|---|---|---|
| Availability | Available | Coming soon · unavailable | Coming soon · subscriptions paused | Planned · unavailable |
| Standard price · USD | $0 | $7/month or $70/year · proposed | $19/month or $190/year | $180/seat/year · minimum 3 seats ($540/year) · proposed |
| Founding first year | Not applicable | Not offered | $120 upfront, then $190/year · first-time subscribers | Not offered |
| Unique watched packages | 25 | Planned: 100 | 250 | Planned: pooled; limit not set |
| Public checks and README badges | Included | Publicly available | Included | Publicly available |
| Supported package ecosystems | npm, PyPI, Cargo, Go, Maven, NuGet, RubyGems, Terraform providers and modules | Planned: all 8 | All 8; coverage varies | Planned: all 8 |
| MCP & CI package API | Not included; free allowance under evaluation | Planned: 2 tokens; request allowance not set | 5 tokens; 1,000 requests per UTC day | Planned; organisation limits not set |
| Email alerts and weekly digest | Included | Planned | Included | Planned: shared delivery |
| Slack / Discord and private watchlist feed | Not included | Planned: messaging alerts; final channels to validate | Included | Planned: shared channels |
| Private GitHub analysis | Not included | Not included | 5 repositories; root package.json + package-lock.json; App setup required | Planned; pooled limits not set |
| Private GitHub analysis allowance | Not included | Not included | 20 analyses per rolling 24 hours; up to 500 direct dependencies per analysis | Not set |
| Platform integration sources | Not included | Not included | 5 sources, separate from GitHub repositories | Planned; pooled limits not set |
| SBOM formats | Not included | Not included | CycloneDX JSON 1.4–1.6; SPDX JSON 2.2–2.3 | Planned |
| Vendor integrations | Public news where available | Public news where available | Artifactory inventory; Xray findings (read-only); other platforms through supported SBOM exports / CI uploads | Planned |
| Integration inventory limits | Not included | Not included | 2,000 components; 2,000 supplied findings; 2 MiB JSON per source | Not set |
| Integration upload / manual sync allowance | Not included | Not included | 20 actions per rolling 24 hours; hourly scheduled connector refreshes | Not set |
| Private data retention | Not applicable | Not applicable | GitHub reports: 30 days; integration sources and credentials: expire 30 days after creation | Must be defined before launch |
| Shared workspace, roles and seat billing | Not included | Not included | Not included | Planned; not live |
| AI patch execution | Not included | Not included | Not included | Not included |
What should I know before choosing Pro?
Private GitHub analysis currently covers root npm manifests and lockfiles, not full project code or every ecosystem. Connection availability is shown before you authorize GitHub.
Integrations import existing inventory and findings; they do not run a new vendor security scan. Xray requires an eligible vendor subscription and a completed scan. Direct JFrog connectors still need validation with your tenant. Provider scan times and successful sync times are shown separately.
You can manage your subscription from your profile. Private data stays out of the public crawl queue, and you can delete retained private sources after downgrading.
Open plan and billing settings →