Taste — 10 PR scans + 1 review
Try it on a project from the homepage, then Pro for that project. No credit card for the taste. No GitHub token paste.
Talk to usInternal draft · not public
Pricing research — do not publish
Pricing is “talk to us” while we onboard early teams — tell us about your project and we’ll get you set up.
Pro
$99 / project / mo
Pick, scan, merge — one team’s AI app
- ✓ Model Garden, compare, basic benchmarks
- ✓ All GitHub repos in this project (not per-repo)
- ✓ Static scan (48+ rules)
- ✓ GitHub App PR comments + Check Runs
- ✓ SDK, IDE plugins,
belfry verify - ✓ Evidence timeline, policy audit
Pro+
$299 / project / mo
Pro + always-on runtime for that project
- ✓ Everything in Pro
- ✓ Runtime allow / warn / block / redact / HITL
- ✓ Firewall, DLP, fail-closed gateway
- ✓ Red team + all ~79 evals
- ✓ EU AI Act / NIST / 42001 scorecards of your system
Enterprise
Custom
Org-wide — many projects, SSO, on-prem
- ✓ Everything in Pro+
- ✓ Live Assessor pen-test (human confirms RoE)
- ✓ DeepScan, SBOM/AIBOM, architecture review
- ✓ SSO, custom RBAC, SIEM, on-prem / hybrid
- ✓ Model expiry + golden-set degradation alerts
Not billed per repository or per GitHub seat.
What’s a project?
One team, one AI application. All repos in that project are included.
Not per repo, not per seat
Attach as many GitHub repos as that app uses. A second product team buys a second project. Enterprise covers the org.
Keep your gateway
If you already route tokens through a proxy, keep it. Pro+ adds fail-closed runtime, DLP, and scorecards around that traffic. We don’t markup provider tokens.
Add-ons
Same platform. Extra checks. The SKUs stand alone.
SMB Security Assessment pack
static-scan + live-pentest + security-review + compliance. A fixed-scope engagement for a single product team. A human confirms the RoE; software runs probes and builds the report.
One-off Security & Architecture Review
Shareable review for creators. No live pen-test, no on-site. First one is complimentary; more are à-la-carte or included in Enterprise.
Modules can also be bought à la carte: runtime-protection, red-team, cost-optimization, compliance, sbom, lifecycle-governance, live-pentest.