Free
€0
5,000 credits a month
- For personal accounts
- New accounts start with 10,000 credits
- Topped up once a month to 5,000 when below it
- Every check, every integration
Pay for what you check.
Prepaid credits, no subscription. One credit for each package a scan checks. Buy a pack when you need one; nothing renews.
25k
€19
25,000 credits
- About 80 scans of a 300-package project
- One payment, VAT included
100k
€79
100,000 credits
- About 330 scans of a 300-package project
- One payment, VAT included
500k
€299
500,000 credits
- About 1,660 scans of a 300-package project
- One payment, VAT included
Prices in euros, VAT included. Credits are bought from the dashboard, under Settings → Credits, by an account owner, and are shared by everyone in the account. Credit packs are not on sale yet. Until they are, accounts run on their free credits.
WHAT A CREDIT IS
One credit, one package checked.
The cost of a scan is the number of packages in the dependency set it checks. Nothing else is metered.
Every package, every scan
PkgFire checks the whole resolved dependency tree each time, not only what changed, because an unchanged lockfile can already pin a malicious version. A project with 300 packages costs 300 credits a scan, whether it changed one package or none.
Cached results cost the same
A package analysed before is answered from the cache, and is still charged one credit: the policy is applied to it again, against today's advisories. It keeps the price of a scan the same whether or not it ran fast, and known before it runs.
Pull requests: the whole tree
A pull request check is charged for every package in the lockfile at the head of the pull request, not only the packages it changes, because every one of them is checked.
Installs and lookups
pkgfire npm install and the other wrapped commands are charged for the tree as it would be after the change. Checking one package version costs one credit.
Scheduled re-checks
When an account turns them on, each daily re-check of a project is charged for the packages it re-checks: the project's last dependency set. The earlier versions it analyses to compare against are not charged.
Up to 5,000 per scan
A scan holds at most 5,000 packages, so no single scan costs more than 5,000 credits.
FREE
What costs nothing.
- A scan that fails or is cancelled. Its credits are reserved when it is queued and given back.
- Coverage re-checks. When a scan runs out of time before analysing everything, the rest is analysed in the background and the project re-checked, free: the scan was already charged for every package in it.
- Pre-analysis. Popular packages and new releases of packages in use are analysed ahead of time, so your scans start complete. Nobody is charged for it.
- Reading results. The dashboard, scan history, findings, alerts and the API's reads cost nothing.
IN CONTROL
No surprise bills.
Prepaid
You can only spend credits you have. When an account runs out, checks stop being accepted until more are added; nothing is charged on account.
Quoted first
The CLI asks what a scan can cost before it submits it. PKGFIRE_MAX_CREDITS in a CI job refuses any scan that would cost more.
Limits for automatic checks
Pull request checks and scheduled re-checks stay within the account's limits, by default 1,000 credits per check and 5,000 a day (UTC). Owners change them under Settings → Policy.
Never a silent pass
A check that cannot reserve its credits does not run, and is never reported as passing: the CLI exits with an error and a pull request check asks for attention.
QUESTIONS
Asked before.
What counts as a package?
Each package version in the dependency set a scan checks: direct and transitive, development dependencies included, as your lockfile lists them. pkgfire scan prints how many it is checking before it starts.
Why are cached results charged?
Because a cached package is still a checked package: its stored analysis is judged again by your policy, against the advisories published since. Charging every package the same keeps a scan's price known before it runs, and the same on a cold cache as on a warm one.
How much will my project cost?
Packages in the project, times scans. A 300-package project scanned five times a working day uses about 30,000 credits a month. The dashboard's Settings → Credits page shows what each project actually spent over the last 30 days, and estimates a scan of any size.
Is there a subscription?
No. Packs are one-time payments, and nothing renews.
Who gets the free credits?
Personal accounts. Once a month, a personal account with fewer than 5,000 credits is topped up to 5,000; unused free credits do not pile up. Organisations run on the credits they buy, so creating more of them does not multiply the free allowance. A team on the free tier can work in an owner's personal account.
What happens when I run out?
New checks are refused until credits are added, with a message saying so. An install through the wrapper does not run, and a pull request check asks for attention instead of passing. Results you already have stay readable.
Can I get a refund?
If you are a consumer in the EU, you can withdraw from a purchase within 14 days, and the credits from it you have not used are refunded. Write to me@caioricciuti.com. If a fault on our side charged you for a check that did not happen, the credits are restored.
Do you offer invoices?
Write to me@caioricciuti.com with the account and the purchase, and the business details to put on it.
Know what’s coming with it.
Sign-up is by invitation for now. Join the waitlist with your email and you will hear from us when there is room. Personal accounts get 5,000 free credits every month.
Join the waitlist