cordon
GitHubSign in

The scanner is free. The whole scanner.

Teams pay for the workflow: the dashboard, alerts, policy and evidence.

Open source, free foreverThe whole scanner, for everyone.Every rule, every ecosystem, offline if you want it. For individuals and open-source projects.

Team

From 5 developers
$19 per developer per month
By invitation during early access
  • Organisation dashboard and trends
  • GitHub, GitLab and Bitbucket
  • Coverage of every repository
  • Slack and Teams alerts, routed by owner
  • Retroactive advisory alerts
  • Pull-request comments and fix pull requests
  • The hosted agent judge
  • 100 assistant credits a month
Most teams

Business

Security and platform teams
$39 per developer per month
By invitation during early access
  • Everything in Team, plus:
  • SSO, SCIM and roles
  • Organisation policy and approvals
  • Jira, Linear, GitHub and GitLab Issues, closed when fixed
  • PagerDuty, Opsgenie, Splunk and Sentinel
  • Audit trail and export
  • Package firewall for seven ecosystems
  • Sandbox detonation of suspicious releases
  • 300 assistant credits a month

Enterprise

From 25 developers, annual
$83 per developer per month
By invitation during early access
  • Everything in Business, plus:
  • Cordon Runner in your network
  • Deploy gate for your clusters
  • CRA evidence and incident drafts
  • Third-party SBOM intake
  • AI-BOM per release
  • Unlimited assistant credits
  • Support SLA and onboarding

Cordon Cloud is for companies: one organisation per company, from 5 developers. A developer is someone who committed to a covered repository in the last 90 days.

Compare plansOpen sourceTeamBusinessEnterprise
Scanning
Every rule and detector
28 package ecosystems
Agent and MCP checks, 815 Agent Threat Rules
Container images, machines and vendor SBOMs
Dependency review on pull requests
Signed intel feed, minutes old
Agent judgeYour own modelHostedHostedHosted
SBOM, VEX and AI-BOM files
Pre-commit guard and CI templates
VS Code extension
Works offline
Cordon Cloud
DevelopersYou5 or more5 or more25 or more
Organisation dashboard
Code-host app: GitHub, GitLab, Bitbucket
Coverage and gaps
Retroactive advisory alerts
Pull-request comments
Fix pull requests
Package verdict lookups
Repository posture
Sandbox detonation
Ask @cordon credits a month100300Unlimited
Cordon Runner in your network
Alerts and tickets
Slack and Microsoft TeamsFrom the CLI
Jira, Linear, GitHub and GitLab Issues
Azure Boards, Asana and ClickUp
PagerDuty and Opsgenie
Splunk and Microsoft Sentinel
Signed webhooks
Security and control
SSO and SCIM
Roles and approvals
Organisation policy
Audit trail and export
Package firewall, seven ecosystems
Deploy gate
Evidence
Sealed, signed release evidence
CRA incident drafts, 24 and 72 hours
Auditor access
Third-party SBOM intake
Support SLA
Free, today

Try it on your own repository.

134x38
cordonzsh payments-apiintel bundle, 5drulepack b44fbcabexecuted 0

Questions

Is anything held back from the free scanner?

No. Every rule and detector is open source. Paid plans add the team workflow: the dashboard, alerts, policy and evidence.

Does our source code go to Cordon?

No. Scans run in your CI, on your laptops or in a Cordon Runner inside your network, and only signed results reach Cordon. No copy of your code is ever kept.

What does Cordon Cloud store?

Findings and each repository's package names and versions, so a new advisory reaches you without a rescan. Stored per organisation, encrypted, never shared or sold.

Is there a Cloud plan for one person?

No. Cordon Cloud gives each company its own isolated organisation, so it starts at a team of 5. One person gets everything the scanner finds, free, from the open-source CLI.

Can we run it with no network?

The open-source scanner works fully offline with --offline.

What is out of scope?

SAST, DAST, CSPM and runtime protection. Cordon covers what can run in your build or your agent.