// Save hours every week
ʻAtāmai
$9
$6/māhina
Billed $72/yr
- 1 project
- 50 scans / month
- 1 API key
- 250+ passive checks per scan
- 100+ active¹ checks per scan
- MCP & API access
- 1 webhook endpoint
- Ngaahi AI fix prompt
- PDF export
// totongi / 2026
Kumi ʻa e ngaahi palopalema kimuʻa pea kumi ia ʻe hoʻo kau ngāue.
Ngaahi sivi DAST + BaaS fakatuʻutāmaki ʻoku hokohoko, kuo fakaʻīkihi ki he ngaahi fakaʻaongaʻanga ʻo e ʻinitaneti naʻe fakatupu ʻe he AI.
// Ship fast, stay secure
Pro — most popular plan
$25
$12/māhina
Billed $144/yr
Renews at $216/yr
52% off — launch promo
Offer ends in 13d 11h 30m 57s
Offer ends in 13 days, 11 hours.
- 5 projects
- 200 scans / month
- 5 API keys
- 250+ passive checks per scan
- 100+ active¹ checks per scan
- 50+ GitHub repo² checks per scan
- MCP & API access
- 5 webhook endpoints
- Ngaahi AI fix prompt
- Scheduled re-scans (≥3h cadence)
- PDF export
- Priority support
// Security at scale
Unlimited
$89
$62/māhina
Billed $744/yr
- 20 projects³
- Unlimited scans³
- 20 API keys
- 250+ passive checks per scan
- 100+ active¹ checks per scan
- 50+ GitHub repo² checks per scan
- MCP & API access
- 20 webhook endpoints
- Ngaahi AI fix prompt
- Scheduled re-scans (≥6h cadence)
- Live threat detection mo'ui
- Live threat notification (email)
- PDF export
- Dedicated support
// launch notes
Frequently Asked Questions
- Is there a Free plan?
- Yes. New accounts start on Free with 3 passive scans per month, 1 project, 7-day retention, and preview-level findings. Upgrade when you need active probes, full evidence, API/MCP access, repo scans, webhooks, or longer retention.
- Are outbound webhooks live?
- Yes. Paid plans can send signed outbound events for completed scans, failed scans, high-severity findings, monitor alerts, and queued scheduled runs.
- Can API or MCP start active scans?
- Yes, for verified domains you explicitly authorize from Dashboard → Domains. Passive scans can always start from REST or MCP; active scans require a paid plan, verified domain ownership, durable domain authorization, and can be revoked any time. Automated active scans use the authorized safety level for that domain.