Free for every developer, guard included. Paid when a company needs to see and control it.
Verdicts, the guard on your own machine, the config check, public repo scans, benchmarks, the install-time check and the editor extension never cost anything. Pro is for a few developers who want to see everything across their own repos and laptops. Teams pay for the fleet view: every guarded session, the org's own drift baseline, tool-call approvals in Slack, revoke across every machine, policy, and the audit trail. Enterprise adds SIEM, required SSO and short-lived credentials at scale.
- ✓The guard on every MCP server (vet-skills guard install): credentials become placeholders, every host and tool call recorded, flagged versions refuse to launch
- ✓Before you connect an MCP (/connect): what it asks for, where it talks to, what the honeypot saw, what was not tested; no account
- ✓Coverage on every verdict: how far the run got, next to the label
- ✓Config check and public repo scan, no account
- ✓Installer-lure, committed-credential and hosted-endpoint checks on every scan
- ✓Known vulnerabilities (OSV) on every npm and PyPI verdict
- ✓MCP server benchmarks: context cost and handshake time next to the verdict
- ✓vet-skills CLI and hooks for Claude Code, Cursor, Codex, Windsurf and Gemini CLI (blocks lure repos at install; warns the agent when a tool result carries hidden instructions)
- ✓vet-skills try: run any package in the honeypot before it touches your machine
- ✓vet-skills run: deny tools, pin the network, broker API keys and log every call of an MCP server
- ✓Editor extension: verdicts inline in .mcp.json and friends (VS Code, Cursor, Windsurf)
- ✓KillerSkills MCP server for any agent
- ✓Every public verdict and behavior trace
- ✓vet-skills discover on your own machine
- ✓Signed verdicts, vet-skills.lock and offline verify
- ✓Runtime observation in your own sessions
- ✓Watch any skill for changes; README badges
- ✓GitHub Action: fail a PR on a blocked skill
- ✓Personal policy (local file)
- ✓On-demand detonation, 20 / day
- ✓Open source, MIT
- ✓Everything in Developer
- ✓Discovery across your repos (read-only GitHub App) and your laptops
- ✓Private repository scans
- ✓Blast radius per component: credentials, reach, known vulnerabilities
- ✓Drift alerts and runtime observation, kept
- ✓Committed-credential and installer-lure findings with history
- ✓Observe mode only: no enforcement, approvals, remote removal or audit evidence
- ✓Everything in Pro, for the whole organization
- ✓Org policy enforced in every agent and CI, including what a partial-coverage verdict is worth (partial_coverage: as_labelled | caution | approval | block)
- ✓CI runners free, never a seat
- ✓Discovery: every MCP server, skill and hook across GitHub repos and laptops
- ✓Blast radius: credentials and reach for each component
- ✓Find & remove across every machine and repo
- ✓Inventory across all developers and machines
- ✓Approval queue with Slack
- ✓Drift alerts and remote removal
- ✓Runtime: every guarded MCP session across the fleet, the org's own host baseline per version, new-host and exfiltration alerts, tool-call approvals in Slack, one-click revoke that every guard obeys at its next launch
- ✓Signed audit log, CSV / JSONL export
- ✓Access review packs: date-bounded evidence bundles (CSV + manifest + PDF) with deterministic review items, reviewer dispositions and a hash-bound acknowledgment; supports your SOC 2 / ISO 27001 evidence gathering
- ✓SSO (Okta, Google, Entra)
- ✓Unlimited detonation
- ✓Everything in Team
- ✓Runtime at fleet scale: MDM enrollment, required-guard mode, per-team runtime policies, short-lived credential exchange where the vendor supports it
- ✓Private registry: internal skills detonated before publish
- ✓Self-hosted verdict cache / air-gapped mode
- ✓SIEM streaming (Splunk, Datadog, Sentinel)
- ✓Threat feed over TAXII 2.1 (STIX indicators from field signals and the honeypot)
- ✓Custom detonation scenarios for your stack
- ✓Security questionnaire answered in full, DPA, access review packs that support SOC 2 / ISO 27001 evidence gathering
- ✓Named support, 4-hour SLA
Verified Publisher · $2,400 / year per org
Claim your skills, get the badge Team policies trust by default, see verdicts 48 hours before they publish, and get drift alerts on your own releases. Up to 25 skills; $60 / year per additional skill.
What does the agent send to KillerSkills?
Skill name, version, content hash, agent type, and the policy outcome. Never your code, prompts, or file contents. Enterprise can keep verdict lookups entirely on-prem.
Do you charge per machine or per person?
Per person. A developer with three laptops and four agents is one seat. CI runners enrolled with vet-skills join --ci never consume a seat, so the GitHub Action is free at every tier.
What happens if your API is down?
The hook uses its local cache and the policy's "unknown" rule. By default that's allow-with-warning so nobody's blocked by our outage; you can set it to block.
What does the GitHub App read?
Read-only access to repository contents and metadata. It reads only agent configuration files (.mcp.json, .claude/settings.json, skills, CLAUDE.md and similar) and stores what they declare by name: server and skill names, packages, hosts, and the names of the environment variables passed to them. Never code, and never secret values.
Can the free tier be used at a company?
Yes, by any individual. The paid tier starts when you want a policy that applies to other people's agents, or an inventory of them.