PurpleTeam
purpleteam-labs.com
What it is
PurpleTeam is a command-line tool and service for dynamic application security testing of web applications and APIs. The maker describes it as language agnostic. Listed targets include authenticated applications, single-page applications, TLS/SSL deployments, server configurations, server-side HTML, GraphQL APIs, and REST APIs; supported API formats include OpenAPI, SOAP, and GraphQL. The CLI runs headlessly in build pipelines, with scans scheduled on commit, push, nightly, or on demand. Results identify defect locations, provide remediation guidance and reproduction instructions, and suggest ways to find similar issues. Attack strength and alert thresholds are adjustable, including thresholds for existing defects that should not fail a run. A CLI process can run without specific integrations. Documentation describes local OWASP and cloud BinaryMist environments, with cloud onboarding by contacting the maker. Community is free, hosted locally, and includes unlimited scans, unlimited targets, and 12 concurrent test sessions. Standard costs $85 a month on annual billing; Pro costs $185 a month on annual billing. Monthly prices shown are $110 and $240. A 14-day trial is available.
Spec sheet
- What it does
- PurpleTeam is a CLI and service that runs dynamic application security testing against web applications and APIs.Read 7 Oct 2026 · purpleteam-labs.com
- Deployment
- The documentation describes local (OWASP) and cloud (BinaryMist) environments, and says cloud onboarding requires contacting the maker.Read 7 Oct 2026 · purpleteam-labs.com
- Integrations
- The maker says PurpleTeam uses a CLI process that runs anywhere and does not require specific integrations.Read 7 Oct 2026 · purpleteam-labs.com
- Support
- The Community plan lists community Slack, GitHub Issues, GitHub Discussions, full documentation, and full source code; the Pro plan lists email support with a 48-hour response.Read 7 Oct 2026 · purpleteam-labs.com
- Founded
- 2013Read 28 Sep 2026 · purpleteam-labs.com
- CI/CD
- The CLI can run in headless mode within build pipelines, and the maker says teams can choose to run it on commit, on push, nightly, or at any time.Read 7 Oct 2026 · purpleteam-labs.com
- Language support
- The maker describes PurpleTeam as language agnostic.Read 7 Oct 2026 · purpleteam-labs.com
- Results and guidance
- PurpleTeam provides defect locations, remediation guidance, test reproduction instructions, and tips for spotting similar issues.Read 7 Oct 2026 · purpleteam-labs.com
- Security reporting
- The maker asks users to report security issues through its contact page with “SECURITY” in the subject line and says it will provide next steps and progress updates.Read 7 Oct 2026 · purpleteam-labs.com
- Testing targets
- The product page lists authenticated applications, single page applications, TLS/SSL deployments, server configurations, server-side HTML, GraphQL APIs, and REST APIs.Read 7 Oct 2026 · purpleteam-labs.com
- Tuning
- Users can adjust tester attack strengths and alert thresholds, including thresholds for existing defects that should not fail a test run.Read 7 Oct 2026 · purpleteam-labs.com
- Who it is for
- The maker describes BinaryMist as a consultancy focused on giving software engineering and development teams security knowledge, guidance, and tooling.Read 7 Oct 2026 · purpleteam-labs.com
Plans and prices
Community Free Hosted locally · Unlimited scans · Unlimited targets · 12 concurrent test sessions Read 7 Oct 2026 · purpleteam-labs.com
Standard $85 a month Annual billing; page also shows $110 USD per month for monthly billing Hosted in cloud · 360 scan minutes per day · Unlimited targets · 4 concurrent test sessions Read 7 Oct 2026 · purpleteam-labs.com
Pro $185 a month Annual billing; page also shows $240 USD per month for monthly billing Hosted in cloud · 480 scan minutes per day · Unlimited targets · 8 concurrent test sessions Read 7 Oct 2026 · purpleteam-labs.com
Enterprise Priced on request Custom pricing · Unlimited scan minutes · Unlimited targets · 12 concurrent test sessions Read 7 Oct 2026 · purpleteam-labs.com
Strong points and limits
Strong points
- Runs headlessly inside build pipelines
- Tests web applications and multiple API types
- Provides reproduction and remediation guidance
- Tunable attack and alert thresholds
- Free Community plan has unlimited scans
Limits
- Cloud onboarding requires contacting the maker
- Community hosting is local only
- Standard and Pro impose daily scan-minute limits
Who it suits
PurpleTeam suits development and security teams integrating dynamic tests into build pipelines or running them locally. Its target list fits web applications, APIs, authenticated systems, and varied deployment configurations.
Verdict
PurpleTeam offers broad dynamic testing targets with pipeline scheduling and actionable findings. The free local plan is extensive, while cloud plans add hosted operation with usage limits and higher pricing.
Where Specifiction places it
- API Security Testing Software#15 of 277.7
Alternatives to PurpleTeamAll alternatives →
APISec Platform From $690/mo · Free plan 9.4 Visit 
ApyGuard API Security Scanner From $129/mo 8.4 Visit 
Beagle Security From $99/mo · Free plan 8.3 Visit 
Bright Security DAST 8.3 Visit