Skip to content
SPECIFICTION
Get listed

Detonate

detonate.fnsys.pro

From $415.83/mo Free plan WebLinuxAPISelf-hosted
Visit detonate.fnsys.pro
Spec score 9.1 #2 of 27 in Malware Analysis Sandboxes

What it is

Detonate runs software dependencies in isolated micro-virtual machines and monitors their runtime behavior for software supply chain security. It accepts npm and PyPI packages, Maven artifacts, binaries, and Docker images, then records file access, network connections, DNS queries, and process execution. The product assigns benign, suspicious, or policy-violating verdicts and provides an event timeline. Decoy files such as fake SSH keys, cloud credentials, API tokens, and environment files can flag access attempts. A token-authenticated REST API supports artifact submission, status checks, verdicts, and reports for CI/CD deployment gates. The sandbox has no internet connection by default; outbound connections can be logged and optionally blocked. Described controls include Firecracker microVM and KVM hardware isolation, gVisor support, seccomp-BPF profiles, and read-only root filesystems with tmpfs overlays. Detonate supports API and web access, Linux, and self-hosted deployment. The Community plan is free and self-hosted, with 2 concurrent sandboxes and 200 API runs per month. Paid plans start at $4,990 a year; enterprise pricing starts at $14,990 a year.

Spec sheet

What it does
Detonate executes software dependencies in isolated environments and observes runtime behavior before deployment.Read 15 Oct 2026 · detonate.fnsys.pro
Purpose
Detonate runs software dependencies in isolated micro-virtual machines and monitors their runtime behavior for software supply chain security.Read 8 Oct 2026 · detonate.fnsys.pro
Deployment
The recommended installation is a Docker image containing Firecracker, kernel, rootfs images and the monitoring agent.Read 15 Oct 2026 · detonate.fnsys.pro
Support
Community-tier support is provided through GitHub, while SMB adds email support and Enterprise lists a 24-hour premium SLA.Read 15 Oct 2026 · detonate.fnsys.pro
Anti-evasion
Detonate checks long sleeps, VM and CPU fingerprinting, /proc inspection, timing attacks and delayed callbacks.Read 15 Oct 2026 · detonate.fnsys.pro
API endpoints
The listed endpoints are POST /api/v1/submit, GET /api/v1/status/:id, GET /api/v1/verdict/:id and GET /api/v1/report/:id.Read 15 Oct 2026 · detonate.fnsys.pro
Bare-metal installation
The manual describes cloning a Gitea repository, installing Bun, building the project and running the generated Node application.Read 15 Oct 2026 · detonate.fnsys.pro
Behavior monitoring
It captures and classifies artifact file access, network connections, DNS queries, and process execution.Read 8 Oct 2026 · detonate.fnsys.pro
CI/CD integration
A token-authenticated REST interface supports submission, status polling, verdict retrieval and report downloads.Read 15 Oct 2026 · detonate.fnsys.pro
Community support
The Community plan lists support through GitHub.Read 8 Oct 2026 · detonate.fnsys.pro
Custom runtimes
Administrators can build custom rootfs images from Docker images for runtimes not included by default.Read 15 Oct 2026 · detonate.fnsys.pro
Database support
SQLite is the default database and PostgreSQL 14 or newer is supported through DATABASE_URL.Read 15 Oct 2026 · detonate.fnsys.pro
Deception honeypots
Nine built-in deception packs plant fake credentials and configuration files whose access triggers alerts.Read 15 Oct 2026 · detonate.fnsys.pro
Dependency API
Firecracker provides a REST control API for configuring CPUs, starting machines and applying resource rate limits.Read 15 Oct 2026 · firecracker-microvm.github.io
Dependency hardware
Firecracker supports 64-bit Intel, AMD and Arm processors with hardware virtualization.Read 15 Oct 2026 · firecracker-microvm.github.io
Dependency isolation
Firecracker uses KVM isolation and a companion jailer as an additional defense layer.Read 15 Oct 2026 · firecracker-microvm.github.io
Dependency licence
Firecracker, the microVM component used by Detonate, is an open-source project under Apache License 2.0.Read 15 Oct 2026 · firecracker-microvm.github.io
Dependency performance
Firecracker documentation describes microVM startup below 125 milliseconds and memory overhead below 5 MiB.Read 15 Oct 2026 · firecracker-microvm.github.io
Deployment requirements
The manual requires a Linux x86_64 host with KVM support and Docker 24 or newer for containerized deployment.Read 8 Oct 2026 · detonate.fnsys.pro
Documentation
The manual covers installation, environment variables, databases, artifact submission, policies, reports, tokens, CI examples and architecture.Read 15 Oct 2026 · detonate.fnsys.pro
Enterprise options
The Enterprise plan lists SSO, LDAP/Active Directory, audit logging, air-gapped deployment, and a premium support SLA with a 24-hour response.Read 8 Oct 2026 · detonate.fnsys.pro
File monitoring
Kernel telemetry records file reads, writes, searches and directory traversal, with sensitive-path flagging.Read 15 Oct 2026 · detonate.fnsys.pro
Honeypots
The product plants decoy files such as fake SSH keys, cloud credentials, API tokens, and environment files to flag access attempts.Read 8 Oct 2026 · detonate.fnsys.pro
Licence status
The Detonate pages do not state a licence for the product source, so its open-source status is not established.Read 15 Oct 2026 · detonate.fnsys.pro
Maker identity
The corporate site identifies the maker as Finsys and provides [email protected] as its contact address.Read 15 Oct 2026 · fnsys.pro
Maker product portfolio
Finsys presents Detonate as its behavioral supply-chain sandbox alongside Dockhand and a forthcoming Git-security product.Read 15 Oct 2026 · fnsys.pro
Network isolation
The sandbox network has no internet by default, and outbound connections can be logged and optionally blocked.Read 8 Oct 2026 · detonate.fnsys.pro
Network monitoring
Outbound connections, DNS requests and HTTP activity are logged, with domain, IP and CIDR controls.Read 15 Oct 2026 · detonate.fnsys.pro
Notifications
The SMB plan lists Slack, webhook, and email notifications.Read 8 Oct 2026 · detonate.fnsys.pro
Process monitoring
The product reconstructs process trees and records exec, fork, clone, command-line and exit details.Read 15 Oct 2026 · detonate.fnsys.pro
Quarantine
Quarantine periods can be configured from 10 minutes through seven days and extended while running.Read 15 Oct 2026 · detonate.fnsys.pro
Report formats
Reports are downloadable as JSON, CSV or plain text and include events, verdict reasons and deception hits.Read 15 Oct 2026 · detonate.fnsys.pro
Runtime architecture
The controller is described as SvelteKit and Node.js, while the in-VM monitoring agent is a Go binary.Read 15 Oct 2026 · detonate.fnsys.pro
Security controls
The site describes Firecracker microVM isolation, KVM hardware isolation, gVisor support, seccomp-BPF profiles, and read-only root filesystems with tmpfs overlays.Read 8 Oct 2026 · detonate.fnsys.pro
Security isolation
The architecture combines Firecracker microVMs, KVM, gVisor, seccomp-BPF, read-only root filesystems and resource caps.Read 15 Oct 2026 · detonate.fnsys.pro
Supported artifacts
The documented inputs are npm packages, PyPI packages, Maven artifacts, binaries and Docker images.Read 15 Oct 2026 · detonate.fnsys.pro
System requirements
Container deployment requires a Linux x86_64 host with KVM, Intel VT-x or AMD-V, Docker 24+, at least 4GB RAM and about 2GB disk.Read 15 Oct 2026 · detonate.fnsys.pro
Token controls
API tokens are created in the UI with submit, read or admin permissions and are displayed only once.Read 15 Oct 2026 · detonate.fnsys.pro
Verdicts
Runs are classified as benign, suspicious or policy-violating, with configurable whitelist policies.Read 15 Oct 2026 · detonate.fnsys.pro

Plans and prices

Community Free forever, self-hosted all artifact types · 2 concurrent sandboxes · 200 API runs/month · unlimited manual UI · 7-day event retention · 1 admin user · 9 deception packs · gVisor & runc · JSON/CSV/text reports Read 15 Oct 2026 · detonate.fnsys.pro
SMB $4,990 a year billed annually 10 users · 10 concurrent sandboxes · 5,000 runs/month · 30-day event retention · unlimited API tokens · baseline profiles · scheduled re-analysis · SBOM/signature/CVE provenance · Slack/webhook/email notifications · signed PDF reports Read 15 Oct 2026 · detonate.fnsys.pro
Enterprise $14,990 a year starting; custom pricing available unlimited users · unlimited sandboxes · unlimited runs · configurable 1-year retention · SSO/SAML/OIDC · LDAP/Active Directory · fine-grained RBAC · audit-log export · approval workflows · MITRE ATT&CK mapping · custom deception/detection rules · air-gapped deployment · high availability · 24-hour SLA Read 15 Oct 2026 · detonate.fnsys.pro

Every Detonate plan and price →

Strong points and limits

Strong points

  • Monitors five artifact types and four behavior categories.
  • API can support CI/CD deployment gates.
  • Sandbox network has no internet by default.
  • Free self-hosted Community plan is available.
  • Enterprise lists air-gapped deployment and audit logging.

Limits

  • Community allows 2 concurrent sandboxes.
  • Community allows 200 API runs per month.
  • Self-hosting requires Linux x86_64, KVM, and Docker 24 or newer.
  • Paid plans start at $4,990 a year.

Who it suits

Detonate suits teams that need to inspect dependency behavior or gate deployment workflows using API verdicts. Self-hosting requires a Linux x86_64 host with KVM support and Docker 24 or newer for containerized deployment.

Verdict

Detonate provides runtime observation and verdicts for a range of dependency artifacts, with API support for deployment gates. Review the Community limits and Linux host requirements, or the listed annual prices for paid tiers.

Where Specifiction places it

Alternatives to DetonateAll alternatives →