Pricing

Transparent pricing. No surprises.

Free forever: the first 10 scans need no signup — run npx -y safeweave-mcp. A free account unlocks 7 scanners locally, unlimited local scans and one connected repo; DAST and full website results are on Cloud.

MonthlyYearlyYearly — save 40% 🎉

Pricing plans comparison
	Free $0 First 10 scans need no signup. Unlimited local scans with a free account.	Cloud $29/mo	Cloud PlusRecommended $59/mo Up to 5 people · 15 repos · unlimited scans
Instant trial (10 scans, no signup)	✓	—	—
Secrets (Gitleaks default ruleset)	✓	✓	✓
Dependency scanning	✓	✓	✓
SAST (curated bundled rules)	✓	✓	✓
All 8 scannersThe 10-scan trial runs SAST, secrets and dependencies. A free account (no card) unlocks IaC, container, license and posture locally, unlimited — 7 of 8. DAST runs on Cloud.	7 of 8	✓	✓
DAST on your running app	—	✓	✓
Website security scan + monitoringHeaders, TLS, DNS and email security plus an active DAST pass against your live site. Free sees the counts and strengths; Cloud sees every finding with its fix and can monitor daily or weekly.	Scan only	✓	✓
Runs locally via npx	✓	✓	✓
SAST (full upstream rule registry)	—	✓	✓
Vibe-stack rules + live app checks59 rules for Supabase, Firebase, Next.js, Vite, Express, Stripe, AI features, Python, MCP servers and secrets, run on every cloud scan, plus 37 read-only live checks of your deployed app: readable tables and storage, keys in the bundle, API routes and AI routes open without sign-in, CORS, exposed .git, backups and debug pages, open redirects and more. Free's hosted repo shows the counts.	—	✓	✓
Compliance profiles (7 frameworks)OWASP Top 10, SOC 2, PCI-DSS, HIPAA, GDPR, ISO 27001, and NIST 800-53 — 254 original rules that map findings to compliance controls.	—	✓	✓
Hosted scanning on every pushSafeWeave runs scans on our infrastructure on every push to a connected repo — no local setup or CI config needed. Free runs SAST, secrets and dependencies on its one repo; Cloud and Cloud Plus run every entitled scanner.	1 repo	✓	✓
GitHub Check Runs on pull requestsEvery pull request gets a Check Run with inline annotations on the exact file and line before merge.	1 repo	✓	✓
Dashboard & reportingWeb-based dashboard to track trends, view findings history, and monitor security posture.	✓	✓	✓
Cloud scans (push, pull request, Scan now)Pushes, pull requests and Scan now count toward a monthly limit per repository: 5 on Free, 15 on Cloud, unlimited on Cloud Plus. The daily scan doesn't count. The count starts again on the 1st (UTC).	5 / month (1 repo)	15 per repo / month	Unlimited
Connected repositoriesFree includes one connected repo with managed cloud scanning — locked to that repo (no swap). Cloud and Cloud Plus add repos you can connect and disconnect freely.	1	5	15
Teammates (you included)The owner invites and removes people from Settings; each person gets their own key on Cloud Plus.	—	—	Up to 5
	Create a free account — unlimited local scans	Start 14-day free trial✓ 14-day free trial · card required · cancel anytime	Upgrade to Cloud Plus✓ 14-day money-back guarantee · cancel anytime

Free

First 10 scans need no signup. Unlimited local scans with a free account.

✓Instant trial (10 scans, no signup)
✓Secrets (Gitleaks default ruleset)
✓Dependency scanning
✓SAST (curated bundled rules)
7 of 8All 8 scanners
—DAST on your running app
Scan onlyWebsite security scan + monitoring
✓Runs locally via npx
—SAST (full upstream rule registry)
—Vibe-stack rules + live app checks
—Compliance profiles (7 frameworks)
1 repoHosted scanning on every push
1 repoGitHub Check Runs on pull requests
✓Dashboard & reporting
5 / month (1 repo)Cloud scans (push, pull request, Scan now)
1Connected repositories
—Teammates (you included)

Create a free account — unlimited local scans

Cloud

$29/mo

—Instant trial (10 scans, no signup)
✓Secrets (Gitleaks default ruleset)
✓Dependency scanning
✓SAST (curated bundled rules)
✓All 8 scanners
✓DAST on your running app
✓Website security scan + monitoring
✓Runs locally via npx
✓SAST (full upstream rule registry)
✓Vibe-stack rules + live app checks
✓Compliance profiles (7 frameworks)
✓Hosted scanning on every push
✓GitHub Check Runs on pull requests
✓Dashboard & reporting
15 per repo / monthCloud scans (push, pull request, Scan now)
5Connected repositories
—Teammates (you included)

Start 14-day free trial✓ 14-day free trial · card required · cancel anytime

Cloud Plus

Recommended

$59/mo

Up to 5 people · 15 repos · unlimited scans

—Instant trial (10 scans, no signup)
✓Secrets (Gitleaks default ruleset)
✓Dependency scanning
✓SAST (curated bundled rules)
✓All 8 scanners
✓DAST on your running app
✓Website security scan + monitoring
✓Runs locally via npx
✓SAST (full upstream rule registry)
✓Vibe-stack rules + live app checks
✓Compliance profiles (7 frameworks)
✓Hosted scanning on every push
✓GitHub Check Runs on pull requests
✓Dashboard & reporting
UnlimitedCloud scans (push, pull request, Scan now)
15Connected repositories
Up to 5Teammates (you included)

Upgrade to Cloud Plus✓ 14-day money-back guarantee · cancel anytime

Custom — need more repos or seats? Contact us

FAQ

Frequently asked questions

Do I need to sign up before my first scan?

No. Run npx -y safeweave-mcp, point your AI editor at it, and you get 10 free scans with no account. After that, register for free (still no card) for unlimited local scans with 7 scanners.

Does SafeWeave transmit my source code?

On Free, the scanners run locally on your machine, so your source code stays local — the only network calls are downloading the scanner binaries, a license check and, with a license key, severity counts for your dashboard (no findings or file paths; turn it off with SAFEWEAVE_NO_REPORT=1). The Cloud plan is different and opt-in: when you connect a repo, file contents are sent over HTTPS to api.safeweave.dev to be scanned (secret-bearing files like .env are withheld).

How is this different from Snyk, Semgrep, or GitHub?

All of them are good, and Snyk (Snyk Studio) and Semgrep (Guardian) both have official Cursor/Claude Code MCP now, so “MCP-native” isn’t unique. SafeWeave’s angle: 7 scanners free and local, a first scan over npx before you ever create an account, and PR security checks for a solo developer at $29/mo — something the Teams-only products don’t sell.

Is there a CI gate?

Two ways. Free: run `npx -y safeweave-mcp scan . --format sarif --fail-on high` in any CI (or use the SafeWeave GitHub Action) — it exits non-zero on findings, so the check fails, and it can upload SARIF to GitHub code scanning. Cloud plan: connect a GitHub repo and every push and pull request gets a managed scan that posts a GitHub Check Run with inline annotations on the exact file and line.

Does it need internet access?

On Free, scanning is local — internet is needed only to download scanner binaries on first run and to verify your license. On Cloud, file contents are sent to api.safeweave.dev to be scanned.

What do I get free vs paid?

Free: 7 scanners (SAST, secrets, dependencies, IaC, container, license, posture) running locally with a free account; the first 10 scans need no account. Cloud ($29/mo, 14-day trial) adds DAST, website scans and monitoring, hosted scans on every push for 5 repos (15 scans per repo a month), GitHub Check Runs on PRs, the full SAST rule registry, compliance profiles, dashboard and history; Cloud Plus ($59/mo) adds 15 repos, unlimited scans and up to 5 people, each with their own key.