Skip to content
SPECIFICTION
Get listed

CRACI

craci.com

Free plan Web
Visit craci.com
Spec score 7.8 #13 of 24 in Software Supply Chain Security Software

What it is

CRACI is a web service providing managed continuous-integration runners that capture software dependencies during builds and monitor them for vulnerabilities. It creates build-time SBOMs containing transitive dependencies and declared licenses, with CycloneDX and SPDX export formats. Monitored SBOMs are reevaluated as vulnerabilities emerge, and the service supports triage, fix routing, and VEX. GitHub Actions is the supported CI integration today; other CI systems are roadmap items. CRACI records packages from npm, PyPI, RubyGems, Cargo, Go, Nix, OCI registries, Debian, Ubuntu, Alpine, and Git or other source downloads. Jobs use a prevalidated egress policy that fails closed, and policy gates can stop builds during execution. Managed runners are Linux on x86-64 and ARM64; Windows, macOS, and on-premises runners are planned. CRACI says source code is processed during builds but not stored, while build data is hosted in Europe. Its API returns SBOMs, network traces, and provenance, though the pricing FAQ says reports cannot be exported. Pro has no monthly fee and meters usage at $0.002 /vCPU-minute.

Spec sheet

Product
CRACI provides managed CI runners that record software dependencies during builds and monitor them for vulnerabilities.Read 5 Oct 2026 · craci.com
Intended users
CRACI says it is for companies that build or ship software, including startups, SaaS providers, enterprises, agencies and hardware makers with embedded code.Read 5 Oct 2026 · craci.com
API
The API returns SBOMs, network traces and provenance; the pricing FAQ says there is no report export.Read 5 Oct 2026 · craci.com
Support
The Pro plan includes standard support, while Enterprise includes priority support.Read 5 Oct 2026 · craci.com
Headquarters
Helsinki, FinlandRead 28 Sep 2026 · craci.com
Founded
2025Read 28 Sep 2026 · craci.com
Code and data
CRACI processes source code during builds and says it does not store it; build data is hosted in Europe.Read 5 Oct 2026 · craci.com
Integration
GitHub Actions is the supported CI integration today; other CI systems are on the roadmap.Read 5 Oct 2026 · craci.com
Package sources
CRACI records packages from npm, PyPI, RubyGems, Cargo, Go, Nix and OCI registries, plus Debian, Ubuntu and Alpine repositories and Git or other source downloads.Read 5 Oct 2026 · craci.com
Policy controls
Jobs run under an egress policy validated before startup that fails closed, and policy gates can stop builds in real time.Read 5 Oct 2026 · craci.com
Runners
Available managed runners are Linux on x86-64 and ARM64; Windows, macOS and on-prem runners are listed as roadmap items.Read 5 Oct 2026 · craci.com
SBOMs
It records build-time SBOMs with transitive dependencies and declared licenses, exportable in CycloneDX or SPDX formats.Read 5 Oct 2026 · craci.com
Security certification
CRACI Corporation Oy says its information security management system is certified to ISO/IEC 27001.Read 5 Oct 2026 · craci.com
Vulnerability tracking
CRACI continuously reevaluates monitored SBOMs as new vulnerabilities are published and supports triage, fix routing, and VEX.Read 5 Oct 2026 · craci.com

Plans and prices

Pro Free $0.002 /vCPU-minute; build minutes are metered per second 1–20 users · no monthly fee · no per-SBOM charges · standard support Read 5 Oct 2026 · craci.com
Enterprise Priced on request Custom; annual contract 20+ users · EU data residency · custom data retention · SAML & SSO · ISO 27001 · priority support Read 5 Oct 2026 · craci.com

Every CRACI plan and price →

Strong points and limits

Strong points

  • Captures SBOMs with transitive dependencies and licenses
  • Continuously reevaluates SBOMs for new vulnerabilities
  • Supports triage, fix routing, and VEX
  • Policy gates can halt builds in real time
  • Linux runners support x86-64 and ARM64

Limits

  • GitHub Actions is the only supported CI integration
  • Windows, macOS, and on-prem runners are roadmap items
  • Pricing FAQ says reports cannot be exported
  • Build usage is metered at $0.002 /vCPU-minute

Who it suits

It suits companies that build or ship software, including startups, SaaS providers, enterprises, agencies, and hardware makers with embedded code. Teams using GitHub Actions and needing dependency or provenance controls are the clearest fit.

Verdict

CRACI focuses on dependency visibility, SBOM management, vulnerability response, and build policy enforcement through managed runners. Its current integration and runner choices are limited, and Pro usage is metered even without a monthly fee.

Where Specifiction places it

Alternatives to CRACIAll alternatives →