Pricing
Attestari Price Book — revision 4 · list prices
Who pays, and for what.
“No publisher can pay for a rating, a better rating, or the removal of a finding.” §17
“The verdict is public so anyone can check it. What you pay for is having it enforced, delivered, and signed.”
Paid for by the people deciding whether to install · Never by a publisher
Rules
Apply to every line
The rules, before any price.
- Lines 1, 2, 3 and 9 are published prices. Lines 4 through 7 are quoted.
- No publisher can pay for a rating, a better rating, or the removal of a finding.
- There are no free tiers. A trial is 14 days with a card on file and converts on day 15 unless cancelled. The public result page, badge and fix paths are public evidence, not a tier.
- Nothing is ever billed by finding, severity, or grade.
- Existing customers are grandfathered twelve months on any increase.
- A publisher tool never affects a public grade. The pre-publish check (line 9) shares an engine with the rating and nothing else. The public grade is computed only from the registry artifact, only by the scheduled pass, only under the methodology in force. §17
- Every programmatic call for more than the public summary carries a key. Without a key the lookup API answers
/v1/health, its OpenAPI document (/v1/openapi.json), its docs (/v1/docs), and a verdict's public summary (what the result page shows), rate-limited by address; nothing else.
Line 1 · published, per month
Web app: see and protect
The web app (app.attestari.ai) and a small hook in each agent. Shows every server each agent is set up to run, with its grade and the "A · no confirmed findings" seal; the hook blocks what your policy blocks before it starts, on every tier.
Personal
$9 / month, up to 5 devices
Fence: Your own machines. See, protect, weekly change email
Small business
$19 / seat / month, 5-seat minimum
Fence: One dashboard for other people's machines; policy set by an owner ("no grade below B", "no unexamined packages"); exceptions with expiry and owner; private registry; audit log; 2,000 pooled API/MCP lookups a month
Enterprise
$39 / seat / month, quoted above 100 seats
Fence: SSO/SAML, policy as code in the repo, CI gate, deny-at-resolve on the lockfile, unlimited history, audit export, 25,000 pooled lookups a month, path to attestation (line 5)
Terms: monthly or annual (annual = 2 months free). 14-day trial, card on file. Seats added mid-term prorate; no reductions mid-term. Lookups past the pooled allowance are never blocked and never billed; warnings at 100% and 150%. Phone app (version 2) is included in every tier when it ships.
Line 2 · published, per key
Lookup API and MCP server
One key, two doors: GET /v1/verdict/... over HTTPS, and the same answers through attestari-mcp, a remote MCP server the customer's agent calls before it installs anything. Billed per lookup returned, never per analysis performed. The MCP server sends the package name and version and nothing else; its own description is examined and graded like any other package, and that page is public.
Developer
$19 / month
Included: 2,000 lookups, then $0.05 each
Terms: Card on file, no SLA, one key
Growth
$1,000 / month committed
Included: ≈33k at $0.030
Terms: Annual credits roll 12 months, 99.5% target
Scale
$6,000 / month committed
Included: ≈300k at $0.020
Terms: 99.9% SLA, webhooks on grade change
Platform
from $0.012, annual contract
Included: Bulk and webhook delivery, named contact, and the attested-manifest endpoint
GET /v1/manifest/{ecosystem}/{name}/{version}— the canonical hash of every tool's name, description bytes and schema per version, for gateways to pin toTerms: Quoted
Endpoints: GET /v1/verdict/{ecosystem}/{name}/{version} and GET /v1/verdict/{ecosystem}/{name} (all tiers), GET /v1/manifest/... (Platform), GET /v1/health (no key). Ecosystems: npm, pypi. An unexamined package returns 404 not_examined, never a grade. Overage: never blocked; warnings at 100% and 150%. Developer: $0.05 a lookup past the 2,000 included. Growth and Scale: set in the contract. The pooled lookups of Small business and Enterprise (line 1) are not billed past their allowance. Contract clause: no redistribution of verdicts to third parties; the grade may be displayed in the customer's own product with "Rated by Attestari" and the link back.
The attested manifest is defined in the methodology §7; not attested is an outcome, not an omission.
Line 3 · published, per package watched
Change monitoring, self-serve
Default watch source is the customer's lockfile; packages are added by pointing at a repo.
Solo
$29 / month
Packages: 50
Checks: Daily
Delivery: Email + webhook, 1 seat
Team
$199 / month
Packages: 500
Checks: 6-hourly
Delivery: Slack, webhook, full diff, 5 seats
Fleet
$999 / month
Packages: 5,000
Checks: Continuous
Delivery: API, SSO, 12-month history, unlimited seats
Terms: monthly, card at signup, no call. Annual = 2 months free. Personal (line 1) already watches the packages installed on the customer's own devices; line 3 is for watching a codebase. Over the limit: warn at 100%, keep working to 120%, then refuse new packages — never stop checking ones already watched.
Line 9 · published
Pre-publish check: a linter for publishers, never a rating
Maintainer
$99 / yr
What it covers: Unlimited runs on packages whose registry record carries an OSI licence, one publisher account
Per run
$49
What it covers: One artifact, one report, no account needed
Team
$19 / seat / month
What it covers: Unlimited runs on private artifacts, a CI step that fails the build on a HIGH finding or an unexaminable surface, 90-day report history
Rule 6 applies, with a test. The badge on a README links to the public grade, never to a pre-publish result. Pre-publish results live in a separate store with separate keys.
“Its output is never published, never stored where the scheduled pass can read it, and never affects a grade.” §17
Quoted
No list price without a conversation
Four lines we price by conversation.
Line 4 · quoted, engagement plus per package
Private audits
| Component | Price | Detail |
|---|---|---|
| Baseline engagement | $6,000 | Up to 15 packages, one report each in the published format, 15 business days |
| Packages 16–100 | $250 each | Same depth |
| Packages 101+ | $150 each | Volume band |
| Rush, 7 business days | +50% | |
| Annual re-audit | 40% of original | |
| Reference program | 50% off, 3 slots | Named testimonial, reference call, right to cite findings anonymized |
Line 5 · quoted, per portfolio per year
Attestation of inspection, the compliance line
Unchanged from revision 2.
| Band | Price | Portfolio |
|---|---|---|
| Band A | $18,000 / yr | Up to 25 attested packages |
| Band B | $32,000 / yr | Up to 100 |
| Band C | $52,000 / yr | Up to 400 |
| Enterprise | from $85,000 / yr | 400+, multiple legal entities, auditor seats, custom control mapping |
| Add-on | Price |
|---|---|
| Out-of-cycle attestation | $2,000 |
| Auditor walkthrough call | $3,000 |
| Additional legal entity | $8,000 / yr |
Every band includes: quarterly re-attestation; a signed record per package version citing the methodology version and its document hash, published to a public transparency log (Sigstore Rekor); the capability inventory per package; control mapping to SOC 2 CC6/CC7, DORA Article 28, CRA Annex I and NIST SSDF; read-only access for the customer's own auditor; a register of packages that could not be examined; a letter written to be filed.
Terms: annual in advance. Three years at 12% off with a price lock.
Line 6 · quoted, per rights grant per year
Population dataset licensing
| Licence | Price | Rights granted |
|---|---|---|
| Academic | $500 / yr | Citation required, no redistribution, one-year term, one institution |
| Analyst seat | $6,000 / yr | Report and table, internal use, one named seat |
| Enterprise internal | $18,000 / yr | Unlimited internal seats, quarterly refresh, API access to the table |
| Modeling and redistribution | $35,000–75,000 / yr | Use in underwriting models, quotes, or a derived product. Attribution required |
The quarterly population report is published as a one-page public summary (the headline numbers, the methodology version); the full report and table are the analyst seat. Never sold perpetual.
Line 7 · quoted, platform fee plus metered
Registry white-label
| Registry size | Platform fee | Per lookup |
|---|---|---|
| Under 500 listings | $1,000 / mo | $0.010 |
| 500–5,000 listings | $2,500 / mo | $0.008 |
| 5,000+ listings | $5,000 / mo | $0.005 |
| Launch partner, one only | 50% off the platform fee for 6 months | Metered at the band rate |
Non-negotiable: "Rated by Attestari" attribution and the link back. 12-month minimum. Exclusivity never longer than 12 months.
Line 8
Wider artifact types: agent skills first, then IDE and browser extensions
No price card. Same cards, larger portfolios. Skills are examined under the same methodology; package counts rise inside lines 3 and 5.
Public by design
Evidence, not a tier
What is public, and why.
The verdict is public so anyone can check it. What you pay for is having it enforced, delivered, and signed.
- Result page per package. Where a verdict lives and its evidence is checked; a grade nobody can check is not a grade
- Embeddable badge. Links to the result page; "Not examined" is a badge too
- Fix path per reason code. Turns not-gradeable into a to-do list for maintainers, which grows the index
- Methodology and its version history. The published contract every grade cites
These are rate-limited and cached like any public page. They carry no key and no account. The lookup API answers a verdict asked without a key with the same public summary, rate-limited by address (rule 7); a program that wants the full report, or more than the address limit allows, uses line 2. Scraping at volume gets a 429 and a link to the Developer tier.
What the result page shows, and what it does not (decision 2026-09-18)
The public page is the grade and a brief summary. The full report is the product. The methodology stays fully public so the rules are always checkable; the evidence per package is what is sold.
| Shown on the public page | In the full report (paid) |
|---|---|
| Package, version, grade, date examined | Every finding with its reason code |
| Methodology version and its document hash | Every cited span with file and line |
| Number of findings, highest severity, the class names (exfiltrate, override, conceal) | The capability inventory — network, filesystem, process, credentials |
| "Full report with cited evidence: Developer tier and above" | Version history and the diff between versions |
| "Claim this package" for the publisher of record | The attested manifest hash per version (Platform) |
| Not-examined and could-not-examine states with the reason category | Programmatic access: API, MCP, webhook |
| Lookup count: how many times this package was checked through the API and MCP (decision 2026-09-20) |
Where the full report is delivered: the web app (line 1), the API and MCP server (line 2), and per package at the Developer tier (line 2, $19 / month), which is the cheapest way to see one report.
The publisher of record gets the full report for their own package by claiming it (registry ownership check). That is the dispute process, not a tier: an F with no evidence shown is an accusation the accused cannot answer. Claiming is also the on-ramp to line 9.
The badge carries only the grade and links to the public summary. Site-wide and free: the methodology in full (the contract every grade cites), disclosures after the 30-day clock (the one place evidence appears free, on the Attestari engineers' schedule), a quarterly one-page summary (headline numbers; the table is line 6), and search by package name returning the grade line ("not examined — request it" is a lead).
The test for anything free: it makes a reader want the report; it never lets them reconstruct it. Disclosure posts (after the 30-day clock) are the one place a package's evidence appears in public, on our schedule.
What the buyer is paying for, by line: enforcement (line 1 — a page tells you, the hook in each agent and the CI gate stop you; policy set by an owner, exceptions with expiry, a record of every block), coverage (lines 2 and 3 — the same verdict arriving where the decision is made, for every package, without anyone remembering to check; billed per moment covered), a signature (line 5 — our word on this package, at this version, under this methodology, signed to a transparency log in a form an auditor accepts), and what is never public (lines 4 and 6 — private packages and the aggregate table).
Independence is the product. Read how subjects are chosen §4, how and when a result is disclosed §19, and what we do not examine §15, or the whole methodology.
Discounts
What a discount has to buy
Every concession is priced in advance.
| Concession | Discount |
|---|---|
| Annual prepay instead of monthly | 2 months free |
| Three-year term with a price lock | 12% |
| Named case study and logo rights | 10%, one term |
| Standing availability for reference calls | 5% |
| Launch partner, registries, first one only | 50% of the platform fee, 6 months |
| Reference program, private audits, three slots | 50%, once |
| Asking for a discount | 0% |