Pricing
The CLI is free and runs on your machine. Paid plans meter the managed gate and the MCP server.
Free
live- Unlimited local CLI verifications
- All three gates: syntax, imports, your real test suite
- SAFE, UNSAFE and UNPROVEN verdicts
- Isolated shadow tree
- Community support
Pro
early access- Everything in Free
- Managed GitHub Action, verdict posted as a check
- Signed verdicts, provable to an auditorsoon
- Verdict history
- Unlimited members
- Email support
Scale
early access- Everything in Pro
- Priority verification queue
- Self-hosted runners
- Dedicated Slack channel
Enterprise
early access- Everything in Scale
- SSO
- Guaranteed response times
- Invoicing and procurement
One diff, one verdict
A verification is one verdict on one diff. Whether it came from the CLI, from an agent over MCP, or from a pull request, a run that answers SAFE, UNSAFE or UNPROVEN counts once.
Runs on your own machine are not metered, and that is a fact about how the engine works rather than an offer. The CLI reads your repo and your suite locally, with no upload and no account, so there is nothing on our side to count.
What gets metered is the managed surfaces: the Action that posts a verdict onto your pull request, and the MCP server your agent calls. Those run on our infrastructure.
The gate
| Free | Pro | Scale | Enterprise | |
|---|---|---|---|---|
| Runs your real test suiteNot your CI's summary of it | ||||
| Isolated shadow treeThe diff is applied to a throwaway copy | ||||
| Coverage preflightDid a test that ran actually execute the changed lines | ||||
| Changed-line coverage proofA TypeScript diff runs every gate and caps at UNPROVEN | Python | Python | Python | Python |
| Flaky-awareNew failures are rerun once on a fresh tree |
Where it runs
| Free | Pro | Scale | Enterprise | |
|---|---|---|---|---|
| CLI | ||||
| Local, with no account | ||||
| GitHub Action, as a required check | ||||
| MCP server, for your agent | ||||
| Included verifications / moAn MCP call and a managed Action run each spend one | 500 | 10,000 | 100,000 | Custom |
| Self-hosted runners |
Evidence
| Free | Pro | Scale | Enterprise | |
|---|---|---|---|---|
| Every gate in the reportSyntax, imports and tests, each recorded separately | ||||
| Engine version on the verdictA SAFE from a year ago tells you which rules judged it | ||||
| Narrowed test command flagged | ||||
| Verdict history | ||||
| Signed verdictsNot shipped. The engine does not sign a report today | Planned | Planned | Planned |
Team and support
| Free | Pro | Scale | Enterprise | |
|---|---|---|---|---|
| Members | 1 | Unlimited | Unlimited | Unlimited |
| Community support | ||||
| Guaranteed response times | ||||
| SSO | ||||
| Invoicing |
Frequently asked questions
One verdict on one diff. A pull request checked by the Action spends one, and so does an agent calling verify_change over MCP. An MCP call and a verification are the same thing counted once.
Nothing breaks mid-month. We get in touch about moving you up a tier rather than failing your pull requests, because a gate that stops answering is worse than no gate.
No, and this is not a promotion we can withdraw. The CLI reads your repo and your suite on your machine, with no upload and no account. There is nothing on our side to count.
No. The CLI is free and stays free, with no cap on local runs. Paid plans are for the managed surfaces, the ones that run on our infrastructure rather than yours.
Pro features at no cost while the managed surfaces are in early access, and a direct line into what gets built. In exchange we ask what is actually breaking in your workflow.
Not yet. A report today records the verdict, all three gates, the coverage behind it and the engine version that produced it, but nothing cryptographic: you cannot hand it to an auditor and prove it came from us unmodified. Signing is what we are building next, and it is why Pro exists. We would rather say that than imply the record is already attestable.
No, and no plan changes that. Refactron reports whether your tests exercised the change and whether they passed. A false SAFE is possible when a test runs the changed lines without asserting on the behaviour that matters. That is why UNPROVEN exists.