Skip to content
SPECIFICTION
Get listed

Endor Labs

endorlabs.com

Free plan WebWindowsmacOSLinuxAPISelf-hosted
Visit endorlabs.com
Spec score 8.9 #2 of 65 in Software Composition Analysis Software

What it is

Endor Labs is an application security platform spanning code, secrets, dependencies, container images and coding agents. AURI for Developers helps scan for vulnerabilities, detect secrets and block malicious dependencies in AI coding workflows. Endor Code provides AI SAST and secrets detection; Endor Open Source adds reachability-based SCA, malicious-package detection, AI model governance, and SBOM and VEX generation. The platform can inventory coding agents, models, MCP servers and skills, then enforce policies on agent actions. Integrations include GitHub, GitLab, Bitbucket, CircleCI, Jenkins, Jira, Slack, Vanta, Cursor, Claude, Gemini and GitHub Copilot. Scans can run through cloud apps, inside CI/CD runners or with Endor Outpost for scheduled monitoring and on-premises deployment. The company says cloud scanning briefly clones code into a container that is destroyed after scanning, while CI/CD scanning keeps code in the runner. The free Developer tier supports local scans and read-only vulnerability data, but has no UI, policies or scan history. Paid plans are seat-based and require contacting sales for pricing.

Spec sheet

What it does
Endor Labs is an application-security platform that analyzes first-party code, open-source dependencies, secrets, containers, and AI-generated software.Read 21 Oct 2026 · endorlabs.com
Product
Endor Labs describes its platform as an application security platform spanning coding agents, code, secrets, dependencies, package firewall, and container images.Read 3 Oct 2026 · endorlabs.com
Deployment
Customers can scan through cloud apps, inside CI/CD runners, or use Endor Outpost for scheduled monitoring scans and on-premises deployment.Read 3 Oct 2026 · endorlabs.com
Integrations
Documented integrations include GitHub, GitLab, Jenkins, Jira, Slack, Microsoft Defender for Cloud, Azure DevOps, Bitbucket, and cloud marketplaces.Read 21 Oct 2026 · endorlabs.com
Support
Endor Labs offers multiple Technical Success tiers tailored to team needs and deployment complexity.Read 3 Oct 2026 · endorlabs.com
Headquarters
Palo Alto, California, United StatesRead 28 Sep 2026 · endorlabs.com
Founded
2021Read 28 Sep 2026 · endorlabs.com
Agent governance
AURI inventories coding agents, models, MCP servers, and skills, then applies policies and records agent actions.Read 21 Oct 2026 · endorlabs.com
Agent Kit licence
The public Endor Labs Agent Kit repository is licensed under MIT; the repository contains recipes, host packages, SDK material, and validation tooling.Read 21 Oct 2026 · github.com
AI SAST
Endor Code provides AI-assisted static analysis for code flaws and vulnerabilities in repositories and pull requests.Read 21 Oct 2026 · endorlabs.com
AURI
AURI for Developers helps scan and fix vulnerabilities, detect secrets, and block malicious dependencies in an AI coding workflow.Read 3 Oct 2026 · endorlabs.com
CLI installation
endorctl can be installed with Homebrew or npm, or downloaded as Linux amd64 and Windows amd64 binaries.Read 21 Oct 2026 · endorlabs.com
Company funding
Endor Labs announced a $93 million Series B led by DFJ Growth on April 23, 2025, with Salesforce Ventures and existing investors participating.Read 21 Oct 2026 · prnewswire.com
Company headquarters and size
LinkedIn lists headquarters in Palo Alto, California, company size of 51–200 employees, and a 2021 founding year.Read 21 Oct 2026 · linkedin.com
Company history
Endor Labs says it was founded in Palo Alto, California, in 2021.Read 3 Oct 2026 · endorlabs.com
Company legal name
Crunchbase lists the legal entity as Endor Labs Inc., an active for-profit company founded by Dimitri Stiliadis and Varun Badhwar.Read 21 Oct 2026 · crunchbase.com
Company milestones
The company says it launched from stealth in 2022, announced a $70 million Series A in 2023, and expanded into a complete AppSec platform in 2024.Read 21 Oct 2026 · endorlabs.com
Container scanning
Endor Open Source scans container images and links image vulnerabilities to application reachability.Read 21 Oct 2026 · endorlabs.com
Developer platforms
The endorctl CLI installation instructions cover macOS through Homebrew, Linux, and Windows, and the product also offers a web UI and REST API for paid plans.Read 3 Oct 2026 · endorlabs.com
Documentation depth
The documentation portal covers deployment, scanning, findings, AI governance, SAST, secrets, policies, integrations, administration, troubleshooting, best practices, APIs, and release notes.Read 21 Oct 2026 · docs.api.endorlabs.com
Endor Scores
Package risk scoring combines security, quality, popularity, and activity signals.Read 21 Oct 2026 · docs.endorlabs.com
Free tier limits
The Developer tier scans locally and provides read-only access to vulnerability data, without a UI, policies, or scan history.Read 3 Oct 2026 · endorlabs.com
Limit: integrations and setup
G2 feedback cites Jira integration issues, unclear setup errors, and missing console controls such as setting a default monitored branch.Read 21 Oct 2026 · g2.com
Limit: interface and API
Reviewers report UI/UX rough edges and say some API capabilities are not exposed conveniently in the interface.Read 21 Oct 2026 · g2.com
Limit: scan performance
A G2 reviewer requests faster scan times for larger repositories.Read 21 Oct 2026 · g2.com
MCP and IDE use
The MCP server connects Endor security checks to coding assistants and IDEs such as Gemini CLI, Claude Code, Cursor, Codex, and VS Code.Read 21 Oct 2026 · docs.endorlabs.com
Notable news: agentic platform
Endor Labs announced in 2025 that it had launched an agentic AI AppSec platform aimed at securing AI-assisted software development.Read 21 Oct 2026 · endorlabs.com
Package Firewall
Package Firewall is designed to block vulnerable or malicious packages before installation on developer machines or in CI.Read 21 Oct 2026 · endorlabs.com
Paid plan limits
Paid plans use annual fair usage quotas based on purchased seats, and the page says users are not blocked from scanning when they exceed those limits.Read 3 Oct 2026 · endorlabs.com
Praise: reachability
G2 reviewers repeatedly praise function-level or transitive reachability for reducing noise and helping engineers prioritize exploitable vulnerabilities.Read 21 Oct 2026 · g2.com
Praise: usability and support
G2 reviewers commonly describe deployment and integration as easy, the interface as intuitive, and customer support as responsive.Read 21 Oct 2026 · g2.com
Pricing model
Pricing is seat-based; for Endor Code and Endor Open Source, a contributing developer is someone who committed to a monitored repository within the last 90 days.Read 3 Oct 2026 · endorlabs.com
Rating on AWS Marketplace
4.8 out of 5 from 9 reviewsRead 21 Oct 2026 · aws.amazon.com
Rating on G2
4.8 out of 5 from 10 reviewsRead 21 Oct 2026 · g2.com
Rating on Gartner Peer Insights
4.7 out of 5 from 4 reviewsRead 21 Oct 2026 · gartner.com
Rating on Software Advice
No reviews yet; pricing is listed as available upon request.Read 21 Oct 2026 · softwareadvice.com
Reachability analysis
Its SCA maps vulnerabilities to the functions and call paths that an application can actually reach, including unused dependencies.Read 21 Oct 2026 · docs.endorlabs.com
REST API
Endor Labs publishes REST API guidance, authentication instructions, a query builder, resource-kind documentation, and downloadable OpenAPI and Swagger specifications.Read 21 Oct 2026 · docs.endorlabs.com
SBOM and VEX
The open-source product can generate and manage SBOM and VEX information for compliance and supply-chain work.Read 21 Oct 2026 · endorlabs.com
Scanning
Endor Code provides AI SAST and secrets detection, while Endor Open Source provides reachability-based SCA, malicious package detection, AI model governance, and SBOM and VEX generation.Read 3 Oct 2026 · endorlabs.com
Secrets detection
The platform detects exposed credentials and API keys before they reach production.Read 21 Oct 2026 · endorlabs.com
Security controls
AURI agents run on the customer's infrastructure, are read-only by default, and ask for approval before mutating actions.Read 3 Oct 2026 · endorlabs.com
Self-hosting
Endor Outpost is offered as an on-premises deployment for eligible customers with strict residency or compliance requirements.Read 21 Oct 2026 · endorlabs.com
Source-code handling
The vendor says cloud scans briefly clone source into a scanning container and destroy it afterward; CI scans can keep code inside the customer runner.Read 21 Oct 2026 · endorlabs.com
Supported languages
The documented SCA matrix includes C#, Go, Java, JavaScript/TypeScript, Kotlin, PHP, Python, Ruby, Rust, Scala, and Swift.Read 21 Oct 2026 · docs.endorlabs.com
System requirements
Documentation provides minimum and recommended resources for local or CI/CD scan runners and notes that large applications may need more capacity.Read 21 Oct 2026 · docs.endorlabs.com
Upgrade impact
Upgrade impact analysis identifies likely breaking changes when a direct dependency is updated.Read 21 Oct 2026 · docs.endorlabs.com

Plans and prices

Developer Free FREE AURI scanning locally · read-only vulnerability data · no UI, policies, or scan history Read 21 Oct 2026 · endorlabs.com
Core Priced on request Get started Reachability · prioritization · policies · deeper scanning and enterprise integrations Read 21 Oct 2026 · endorlabs.com
Pro Priced on request Get started Advanced detection, triage, and remediation across application layers · reporting and workflow features Read 21 Oct 2026 · endorlabs.com

Every Endor Labs plan and price →

Strong points and limits

Strong points

  • Free Developer tier with local scans
  • Supports reachability analysis and SBOM generation
  • Offers cloud, CI/CD and on-premises scanning
  • AURI agents run on customer infrastructure
  • Integrates with coding and CI/CD tools

Limits

  • Developer tier has no UI, policies or scan history
  • Paid plan prices require contacting sales
  • No free trial

Who it suits

Endor Labs suits development teams seeking application security scanning across code, dependencies and AI coding workflows. Its free Developer tier is aimed at individuals who can work with local scans and do not need a UI, policies or scan history.

Verdict

Endor Labs covers several application-security areas and offers multiple deployment approaches. The free tier is limited, so teams needing policy controls or scan history should clarify paid-plan pricing with sales.

Where Specifiction places it

Alternatives to Endor LabsAll alternatives →