OSS
Apache-2.0 source, runs anywhere
Free forever
Pricing
Pick the smallest tier that fits — every tier ships the same OWASP-mapped scanner engine. Cloud adds premium rules, dashboards, and compliance reports.
GitHub
Free
Signed binary, one machine
Free
Cloud
Hosted console, whole fleet
Paid (Q3 2026)
Capability comparison
| Feature | OSS | Free | Cloud |
|---|---|---|---|
| Price | Free forever | Free | Paid (Q3 2026) |
| Interface | CLI only | CLI + local dashboard | CLI + web console |
| Limits & retention | |||
| Max devices | 1 | 1 | Unlimited |
| Max MCP servers | — | ≤ 5 | Unlimited |
| Scan-history retention | None — stateless | 7 days | 365 days (longer retention planned as an add-on) |
| Integrations | — | — | ● |
| Seats | 1 | 1 | Multi-seat |
| Scanning & detection | |||
| MCP scan (tools/prompts/resources) | ● | ● | ● |
| Reachability + capability graph | ● | ● | ● |
| Threat taxonomy + 9 framework mappings | ● | ● | ● |
| 14-client auto-discovery | ● | ● | ● |
| SARIF / GitHub Action / CI mode | ● | ● | ● |
| Vulnerable-dependency scan (bundled offline OSV corpus) | ● | ● | ● |
| Live OSV.dev advisory sync (daily-maintained corpus) | — | — | ● |
| Runtime shim (claim-drift + secret detection) | — | ● | ● |
| Detection rules | Taxonomy + author-your-own SDK | Core pack (signed, bundled) | Premium (live channel) |
| Purple-team detection-coverage campaigns | — | — | ● |
| Reports & visibility | |||
| Console / JSON / Markdown output | ● | ● | ● |
| Local dashboard | — | ● | ● |
| Signed compliance PDF | — | — | ● |
| Cross-fleet correlation + trend dashboards | — | — | ● |
| Integrations (Cloud-only) | |||
| GHAS / SARIF import | — | — | ● |
| Server reputation API | — | — | ● |
| Webhook fan-out (SIEM/SOAR-ready) | — | — | ● |
| OCSF enrichment envelope + signed reverse deep-link | — | — | ● |
| Slack notifications | — | — | ● |
| Operations & trust | |||
| Signed binaries (5 platforms) | — | ● | ● |
| Auto-update channel (Ed25519) | — | ● | ● |
| Multi-seat console + RBAC + SSO/SCIM | — | — | ● |
| Air-gapped install bundle | — | — | ● |
| Phones home | Never (CI-enforced) | Opt-in only | Under contract |
| Support | Community | Email (NBD) | Priority + SLA |
MSSP & custom needs
Managed-service-partner (MSSP) overlay, air-gapped deployments, custom rule sets, design-partner access — we can scope these directly. Email hello@grantlock.ai or use the form below — usually answered within one business day.
Talk to us about pricing
Email hello@grantlock.ai or send a note below — usually answered within one business day.