Chainloop vs CRACI

Chainloop centralizes software delivery artifacts and evidence to support security, compliance and visibility across the delivery process. Its evidence store can hold metadata for SBOMs, QA reports, vulnerability scans and legal reviews. It connects metadata and artifacts in a graph, providing provenance and context for control gates, quality checks and compliance dashboards. The CLI and integrations capture evidence from CI/CD pipelines, including Git commit details and pipeline configuration. Documentation describes signing metadata with SLSA, in-toto, Sigstore or customer PKI such as AWS KMS or Keyfactor. Deployment options include cloud and self-managed setups, including on-premises and airgapped environments. The paid platform adds curated policies and frameworks such as SLSA, SSDF, CRA, DORA and NIS2. Community Edition costs nothing, is free and open source, and is self-hosted with community support; it has no UI or curated policy library. The enterprise Chainloop Platform has pricing available by contacting the maker and lists dedicated support.

CRACI is a web service providing managed continuous-integration runners that capture software dependencies during builds and monitor them for vulnerabilities. It creates build-time SBOMs containing transitive dependencies and declared licenses, with CycloneDX and SPDX export formats. Monitored SBOMs are reevaluated as vulnerabilities emerge, and the service supports triage, fix routing, and VEX. GitHub Actions is the supported CI integration today; other CI systems are roadmap items. CRACI records packages from npm, PyPI, RubyGems, Cargo, Go, Nix, OCI registries, Debian, Ubuntu, Alpine, and Git or other source downloads. Jobs use a prevalidated egress policy that fails closed, and policy gates can stop builds during execution. Managed runners are Linux on x86-64 and ARM64; Windows, macOS, and on-premises runners are planned. CRACI says source code is processed during builds but not stored, while build data is hosted in Europe. Its API returns SBOMs, network traces, and provenance, though the pricing FAQ says reports cannot be exported. Pro has no monthly fee and meters usage at $0.002 /vCPU-minute.