Hosted scans run on credits.
The desktop app and local CLI stay permanently free — no Stripe check, ever. The CLI never forces sign-in; the desktop app does, so signing out actually locks local scan data. Credits apply to hosted scans only.
- ✓Autonomous recon + vuln hunting
- ✓PoC-verified findings
- ✓PDF reports + evidence bundles
- ✓Findings dashboard
- ✓Everything in Starter
- ✓Kubernetes attack-path analysis in hosted scans
- ✓Compliance tagging (6 frameworks) in hosted scans
What we commit to. And what we don't, yet.
A guarantee about the service, not about what a scan will find — we withdrew a detection claim in August and aren't making a new one. Everything below is checked against what the code and the team actually do today, not what we'd like to promise.
Every finding a Ryvx agent files has to carry a working proof-of-concept — a script or request that actually reproduces the issue — or create_finding rejects it. That's not a review policy, it's a hard gate in the code: a finding missing its PoC, or any other required field, never becomes a line in your report. This applies to every run, every mode, every target — not a subset.
Ryvx is one person, with no ticketing system and no on-call rotation behind it. We're not publishing a response-time promise, because there's no support infrastructure yet to make one true. A message gets read by a human; it just doesn't come with a guaranteed turnaround.
There's no discount for re-scanning after a fix. Every hosted scan, including a re-run to confirm one, is billed the same way — by measured LLM spend. What's actually free: verifying a fix yourself with ryvx fix-check <before-run> <after-run>, which diffs two runs' findings locally, no account or charge, to show what's fixed, still present, or new. It doesn't run the second scan for you — you still pay for that the normal way if it's hosted, free if it's the CLI.
Metered by what a scan actually spends.
Credits aren't a flat per-scan fee or a price tier keyed to target size. They track real LLM spend, marked up, and capped so a run can never overspend.
This is the pricing for the one hosted job type that exists today: a web-application scan. Reverse engineering, chatbot/LLM red-teaming, hash/IOC lookups, and the GitHub remediation-PR bot don't have a hosted price yet because they don't have a hosted path yet — run them yourself via the free CLI in the meantime, no plan or account required.
A hosted scan tracks the actual LLM cost it runs up as it works — every model call, at 1 credit per $1 measured after a 4× markup. Nothing is debited until the scan finishes; you pay for what it actually spent, not an estimate made before it started.
There's no small/medium/large tier, because there doesn't need to be one. A bigger target means more pages and endpoints to investigate, which means more tokens spent doing it, which means a higher measured cost — and that's what sets the credit total. Token spend is the size metric.
Before a scan starts, it's capped at what you can afford: your credit balance divided by the 4× markup becomes its hard budget for that run. A scan can't run your balance negative.
The first cloud-model run we measured: a standard-mode scan of OWASP Juice Shop came to $4.4723 in LLM spend, which debited as ~17.9 credits when the scan finished. Since then, two quick-mode runs against a second target came to $2.98, then $1.68on the next run — the drop came from a fix that stopped sending the model uncapped page content on every request. We still don't have deep-mode numbers, and this is a small handful of runs, not an average — so we're not publishing a price table until we do.