Try it free. Scale when your team does.

Full access for 30 days. Then $10/seat/month for scanning, trust intelligence, centralized policy, and team visibility.

Free Trial

$0
Full access for 30 days. No credit card required.
Everything Truvant offers — scanning, trust intelligence, dashboard, policies — free for 30 days.
Start free trial
Install the CLI, run mcpctl login, and you're in.
  • MCP server security scanning (SAST, SCA, secrets)
  • Local policy enforcement with configurable thresholds
  • Continuous monitoring agent (launchd / systemd)
  • Command-level shim enforcement for AI agents
  • Trust Intelligence — AI-scored risk for remote endpoints
  • Dashboard with org-wide inventory

Enterprise

Custom
Volume pricing and annual billing available.
Enterprise-grade controls, your identity provider, and a support team that picks up the phone.
Talk to us
 
  • Everything in Team, plus:
  • SSO with your identity provider (Okta, Azure AD / Entra ID, Keycloak, any OIDC)
  • Audit logging for policy decisions and agent activity
  • Role-based access control with admin and member roles
  • Dedicated support with named contact and SLA
  • Custom deployment, onboarding, and integration assistance
$ curl -fsSL https://truvant.ai/install.sh | sh

Linux (macOS coming soon). One command, no dependencies.

Feature Comparison

Feature Trial / Team Enterprise
MCP security scanning (SAST, SCA, secrets, schema validation)
Local policy enforcement
Continuous monitoring agent
Command shim enforcement
Trust Intelligence Service (AI-scored remote endpoints)
Dashboard and org-wide inventory
Centralized policy management
Alert integrations (S3 / SIEM)
SSO / bring your own identity provider
Audit logging
Role-based access control
Dedicated support and SLA

Frequently asked questions

What do I get during the 30-day trial?
Everything. The trial gives you full access to all Team features — scanning, trust intelligence, dashboard, centralized policies, alert integrations. No features are held back. No credit card required to start.
What counts as a “seat”?
A seat is a named user in your Truvant organization — each person who authenticates via mcpctl login consumes one seat. Seats are identified by email address from your identity provider. The monitoring agent running on a machine uses the seat of the person who installed it, not an additional seat.
What happens when my 30-day trial ends?
Your access to the platform is paused until you subscribe. Your data (policies, scan history, trust scores) is retained for 30 days, giving you time to subscribe or export. No credit card is charged during the trial.
Do you gate scan quality by plan?
No. Scanning quality is identical across all plans. Every user gets the same SAST, SCA, secrets detection, and MCP schema validation. The Enterprise tier adds SSO, audit logging, RBAC, and dedicated support — not better scanning.
Does my source code leave my machine?
No. All scanning runs locally via the Truvant CLI. Source code, file contents, and repository data are never transmitted to our servers — on any tier. The Team and Enterprise tiers sync scan metadata (package names, versions, risk scores, finding summaries) to the dashboard for centralized visibility, but the actual code stays on your machine.
Can I try it by myself before adding my team?
Yes. Start a free trial with just your account. You get full access to the dashboard, trust intelligence, and centralized policies. When you're ready, invite your team — each person who authenticates gets their own seat. There is no minimum seat count.
Can I use Truvant in CI/CD?
Yes. The CLI outputs SARIF v2.1.0, which plugs directly into GitHub Code Scanning, GitLab SAST, and Azure DevOps. To have CI/CD scan results appear in the Team dashboard, the pipeline runner needs to authenticate against your organization.
What identity providers does the Team tier support?
Team tier supports Google and Microsoft social login — sign in with your Google Workspace or Microsoft account. Enterprise tier lets you bring your own OIDC identity provider: Okta, Azure AD / Entra ID, Keycloak, Auth0, OneLogin, or any OIDC-compliant provider.