The Right Plan for Every Team

Yes. The CLI is MIT licensed and will remain free forever. There are no usage limits, no rate limits, no telemetry, and no account required. You can use it commercially, fork it, and build products on top of it without restriction.

The CLI runs entirely locally. Your contract code never leaves your machine. The AI Copilot can optionally query external LLM APIs (configurable in counterscarp-audit.toml), but this is opt-in and you control which endpoint is used. For air-gapped environments, AI features can be disabled or pointed at a local LLM.

Yes — the Cloud App is live at app.counterscarp.io. Run audits from your browser with no local install required. Purchase and activate your Pro license directly from the app. Pro unlocks up to 21 integrated analyzers including AI Copilot, Attack Graph, and Exploit PoC Generator.

Absolutely. The MIT license explicitly permits commercial use. Audit firms, independent security researchers, and protocol teams use Counterscarp as part of paid engagements. The generated reports are yours to use, share, and include in client deliverables without restriction.

The AI Audit Copilot requires an OpenAI or compatible LLM API key for natural language remediation guidance. You provide your own key — Counterscarp never stores or proxies your API credentials. The RAG knowledge base similarity search works fully offline without any API key.

No — and we're honest about that. Counterscarp dramatically reduces the time and cost of security analysis and catches a wide range of vulnerability classes automatically. But complex business logic bugs, economic attack vectors, and novel exploit patterns still benefit from human expert review. We recommend using Counterscarp as a first pass before a manual audit, and as continuous monitoring after deployment.

Absolutely. The CI/CD Generator feature creates ready-to-use pipeline configurations for GitHub Actions, GitLab CI, and CircleCI. You can configure severity thresholds to automatically block PRs that introduce critical vulnerabilities. SARIF output integrates natively with GitHub Code Scanning.

When you purchase a Pro license, it's automatically linked to your account — no need to copy-paste license keys. Simply create a free account or sign in with Google, then complete your purchase. Your license activates instantly and follows you across devices. You can manage your license anytime from the Settings page.

Developer ($49/mo) adds Solana Analyzer (35 rules), Anchor IDL support, branded HTML reports, SARIF output for GitHub Actions, and 5 web app scans per month — ideal for individual developers who need professional reporting. Pro ($149/mo) builds on that with the full AI stack: AI Audit Copilot (RAG), Attack Graph (D3.js), Exploit PoC Generator, Time-Travel Git Scanner, Protocol Fingerprinting, unlimited scans, and 3 machine activations with priority 24hr support. Pro is designed for professional security researchers and teams running continuous audits.

A machine activation is a registration of the CLI Pro features to a specific device. Community tier includes 0 activations (CLI operates in free mode only). Developer includes 1 activation, Pro includes 3, Team includes 5, and Enterprise has unlimited activations. You can deactivate a machine from your account dashboard at any time and re-activate on a different device. This controls how many simultaneous machines can use your Pro CLI features.