The Right Plan for Every Team

Yes. The CLI is MIT licensed and will remain free forever. There are no usage limits, no rate limits, no telemetry, and no account required. You can use it commercially, fork it, and build products on top of it without restriction.

The CLI runs entirely locally. Your contract code never leaves your machine. The AI Copilot can optionally query external LLM APIs (configurable in counterscarp-audit.toml), but this is opt-in and you control which endpoint is used. For air-gapped environments, AI features can be disabled or pointed at a local LLM.

Yes — the Cloud App is live at app.counterscarp.io. Run audits from your browser with no local install required. Purchase and activate your Pro license directly from the app. Pro unlocks all 21 analyzers including AI Copilot, Attack Graph, and Exploit PoC Generator.

Absolutely. The MIT license explicitly permits commercial use. Audit firms, independent security researchers, and protocol teams use Counterscarp as part of paid engagements. The generated reports are yours to use, share, and include in client deliverables without restriction.

The AI Audit Copilot requires an OpenAI or compatible LLM API key for natural language remediation guidance. You provide your own key — Counterscarp never stores or proxies your API credentials. The RAG knowledge base similarity search works fully offline without any API key.

No — and we're honest about that. Counterscarp dramatically reduces the time and cost of security analysis and catches a wide range of vulnerability classes automatically. But complex business logic bugs, economic attack vectors, and novel exploit patterns still benefit from human expert review. We recommend using Counterscarp as a first pass before a manual audit, and as continuous monitoring after deployment.

Absolutely. The CI/CD Generator feature creates ready-to-use pipeline configurations for GitHub Actions, GitLab CI, and CircleCI. You can configure severity thresholds to automatically block PRs that introduce critical vulnerabilities. SARIF output integrates natively with GitHub Code Scanning.