The CLI is free.
Nothing else is for sale.
A licence tool that gates its own verdict behind a paywall would be a joke the internet would make for years. So the scanner is free, under the Functional Source License (FSL-1.1-ALv2) — source-available, not open source.
There is no paid tier to buy. No accounts, no seats, no hosted API, no checkout. The free column below is the whole of it.
| Capability | Price |
|---|---|
| Local scan + verdict | ✓ |
| Code licence layer | ✓ |
| Weights + platform-ToS layer | ✓ |
| Corpus bundle (signed, verified on load) | ✓ |
| CI gate, SARIF and markdown output | ✓ |
| Price | €0 |
Not built, not scheduled, not for sale
The pages on this site that show a console, a hosted policy store, a signed PDF statement or a vetting API are interface sketches. None of them exists. None of them can be bought, and none has a date. They are listed here so the line between the sketch and the product is written down.
Accounts, connected repositories, stored scans and retention policies. Nothing is hosted.
A shared policy store with an audit trail. The local config file does the same job for one repository, for free, today.
Throughput, a hosted corpus and a signed response. No endpoint exists; nothing answers a request.
An artefact with an accountable issuer. Only the Ed25519 corpus signature exists; no statement is signed or issued.
Hosted infrastructure. There is no server to authenticate against.
No support contract, no response time, no SLA. There is no community forum either; issues go to the public tracker.
Why the CLI is free forever
This is a strategy decision, not generosity. Six reasons, and each one is a reason a paid CLI would fail.
The install must be one command and zero friction. Every step between a developer and a verdict loses most of them.
If there is ever revenue, it comes from a hosted service, not from the binary. Charging at the top of the funnel means never reaching the bottom of it.
In this category specifically, charging for the answer destroys the only thing being sold.
A free CLI with a paid service does not. The moat would be the signature and the freshness, which a fork cannot reproduce.
Freshness, scale, accountability and a signature. None of those are features. All of them would be services.
If a self-hoster can already do it, it is not for sale. That is the line, and it is written down.
Where the paid boundary would be drawn
At the service, not the feature. Three rules, applied consistently. These are the rules any future paid work would have to obey; no such work is on sale.
The CLI is source-available under the Functional Source License, with the ALv2 future grant named in the same licence — free to run, free to read, and not open source. A licence checker that mislabelled its own licence would be the one joke this category could not survive.
The corpus wants to be quoted, cited and mirrored, so it is data under CC-BY-4.0. The code is a product, so it is source-available under FSL-1.1-ALv2. Different objects, different licences.
Pay only for what a hosted service can uniquely do: freshness, scale, accountability, a signature.
| Would be paywalled | Why it is a service and not a feature |
|---|---|
| Org policies at scale | A hosted policy store with an audit trail. The local config does the same thing for one repo — for free, today. |
| The vetting API | Throughput, a hosted corpus, and a signed response. The engine would be identical; the scale would not be. |
| Clearance statements | A signed artefact with an accountable issuer. You can render the markdown yourself; you could not sign as us. |
| SSO / RBAC | Hosted infrastructure. Nothing to do with licence knowledge. |
| Audit retention | Storage, and the liability of holding it. |
| Support / SLA | Human time. The one thing a solo founder genuinely cannot give away. |
Three channels that are planned, not open
Including the one that is deliberately capped, because a service business that drifts into consulting stops being a product. None of these can be bought, booked or subscribed to today.
Registries must vet at scale. Usage-priced, so the revenue would grow with the customer's catalogue rather than with a seat count. No endpoint exists.
A human-verified statement for a launch or a diligence process. Genuinely valuable, and genuinely a distraction — so the intent is to cap it at four per year. Nothing is bookable.
A vetted-vendor badge, low effort and modest revenue. It exists because vendors already ask for it, not because anything depends on it. There is no programme to join.
Start with the free one.
The CLI answers the question. If it turns out the answer is worth attaching to a contract, you will know by then — and so will we.