Skip to content
SPECIFICTION
Get listed

Kusari

kusari.dev

From $50/mo Free plan WebAPI
Visit kusari.dev
Spec score 8.0 #10 of 24 in Software Supply Chain Security Software

What it is

Kusari is a software supply chain security platform that maps components across repositories, images, and pipelines in an evolving knowledge graph called the Trust Fabric. It builds that graph from source and build artifacts and enriches each node. Its Kusari Score weighs technical severity alongside reachability, exploitability, blast radius, effort to fix, ownership, and license. The platform accepts source and build artifacts, CycloneDX and SPDX SBOMs, VEX, and existing scanner output. Inspector reviews pull requests through GitHub, GitLab, or the CLI, returning a merge decision and a fix. Its checks cover vulnerabilities, transitive dependencies, secrets, typosquatted packages, licensing, unmaintained components, code weaknesses, and pipeline or image configuration. Reviews can include up to 2,000 dependency changes, with up to 1,000 high-priority changes examined in depth. Kusari lists integrations including GitHub, Jenkins, Jira, ServiceNow, Slack, and Microsoft Teams. The free plan includes unlimited public repositories and one private repository; Starter Team is $50 a month, with a 30-day free period.

Spec sheet

Support
The Enterprise plan includes dedicated support and onboarding.Read 30 Sep 2026 · kusari.dev
Founded
2022Read 28 Sep 2026 · kusari.dev
Inspector coverage
Inspector checks known vulnerabilities, transitive dependencies, credentials and secrets, typosquatted packages, licenses, unmaintained components, code weaknesses and pipeline or image configuration.Read 30 Sep 2026 · kusari.dev
Inspector reviews
Kusari Inspector reviews pull requests in GitHub, GitLab and the CLI and returns a merge decision and a fix.Read 30 Sep 2026 · kusari.dev
Open source
Kusari co-created and contributes to GUAC and remains an active maintainer supporting its adoption.Read 30 Sep 2026 · kusari.dev
Product purpose
Kusari is a software supply chain security platform that builds a continuously updated knowledge graph of components across repositories, images and pipelines.Read 30 Sep 2026 · kusari.dev
Review limits
Inspector analyzes pull requests with up to 2,000 total dependency changes and examines up to 1,000 high-priority dependency changes in depth.Read 30 Sep 2026 · kusari.dev
Risk scoring
Kusari Score weighs technical severity against reachability, exploitability, blast radius, effort to fix, ownership and license.Read 30 Sep 2026 · kusari.dev
SBOM support
The platform ingests source, build artifacts, CycloneDX and SPDX SBOMs, VEX and existing scanner output.Read 30 Sep 2026 · kusari.dev
Security controls
Inspector says changed files are not stored, analysis input is deleted after completion, data is encrypted in transit and at rest, and Kusari is SOC 2 Type II compliant.Read 30 Sep 2026 · kusari.dev
Target users
Kusari describes its customers and users as developers, DevSecOps teams and security teams managing software supply chain risk.Read 30 Sep 2026 · kusari.dev
Trust Fabric
The Kusari Trust Fabric is a continuously updated knowledge graph assembled from source and build artifacts and enriched at every node.Read 30 Sep 2026 · kusari.dev
Workflow integrations
Kusari lists integrations with GitHub, GitLab, Jenkins, Azure DevOps, CircleCI, Jira, ServiceNow, Slack and Microsoft Teams.Read 30 Sep 2026 · kusari.dev

Plans and prices

Free Free per developer Across multiple GitHub organizations · Unlimited public repositories · 1 private repository Read 30 Sep 2026 · kusari.dev
Starter Team $50 a month per team 30-days free · No annual contract needed · Across multiple GitHub organizations · Unlimited public repositories · Unlimited private repositories Read 30 Sep 2026 · kusari.dev
Enterprise Priced on request Full platform capabilities · Advanced security and compliance controls · Dedicated support and onboarding Read 30 Sep 2026 · kusari.dev

Every Kusari plan and price →

Strong points and limits

Strong points

  • Ingests CycloneDX and SPDX SBOMs, VEX, and scanner output.
  • Inspector returns a merge decision and a fix.
  • Integrates with development, ticketing, and communication tools.
  • Free plan includes unlimited public repositories.
  • SOC 2 Type II compliant, according to Kusari.

Limits

  • Free plan includes only one private repository.
  • Inspector reviews up to 2,000 dependency changes per pull request.
  • Self-hosted deployment is not available.

Who it suits

Kusari targets developers, DevSecOps teams, and security teams managing software supply chain risk. Its repository, pipeline, and image coverage may suit teams that need to review dependencies and related security issues.

Verdict

Kusari combines component mapping, risk scoring, and pull-request reviews with a broad set of listed integrations. Check the private-repository allowance and Inspector review limits against your workflow; Enterprise pricing requires a request.

Where Specifiction places it

Alternatives to KusariAll alternatives →