CRACI vs StepSecurity
CRACI
craci.comStepSecurity
stepsecurity.ioSide by side
| Figure | CRACI | StepSecurity |
|---|---|---|
| Price from | Free | $8/mo |
| Free plan | Yes | Yes |
| Free trial | — | Yes |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | — | Yes |
| Self-hosted | — | Yes |
| Plans published | 2 | 3 |
| Spec score · Software Supply Chain Security Software | 7.8 (#13) | 7.9 (#12) |
| Intended users | CRACI says it is for companies that build or ship software, including startups, SaaS providers, enterprises, agencies and hardware makers with embedded code. | StepSecurity describes its full platform as serving contributing developers and offers Dev Machine Guard for employees who use development tools but do not contribute code. |
| Product | CRACI provides managed CI runners that record software dependencies during builds and monitor them for vulnerabilities. | StepSecurity detects, prevents, and responds to software supply chain attacks across developer environments, code repositories, and CI/CD pipelines. |
| Support | The Pro plan includes standard support, while Enterprise includes priority support. | The Community plan includes community support, while Enterprise and Dev Machine Guard list priority support. |
Plans
In their own words
CRACI
CRACI is a web service providing managed continuous-integration runners that capture software dependencies during builds and monitor them for vulnerabilities. It creates build-time SBOMs containing transitive dependencies and declared licenses, with CycloneDX and SPDX export formats. Monitored SBOMs are reevaluated as vulnerabilities emerge, and the service supports triage, fix routing, and VEX. GitHub Actions is the supported CI integration today; other CI systems are roadmap items. CRACI records packages from npm, PyPI, RubyGems, Cargo, Go, Nix, OCI registries, Debian, Ubuntu, Alpine, and Git or other source downloads. Jobs use a prevalidated egress policy that fails closed, and policy gates can stop builds during execution. Managed runners are Linux on x86-64 and ARM64; Windows, macOS, and on-premises runners are planned. CRACI says source code is processed during builds but not stored, while build data is hosted in Europe. Its API returns SBOMs, network traces, and provenance, though the pricing FAQ says reports cannot be exported. Pro has no monthly fee and meters usage at $0.002 /vCPU-minute.
StepSecurity
StepSecurity is a software supply chain security platform spanning developer environments, code repositories, and CI/CD pipelines. Harden-Runner uses eBPF to monitor network calls, file writes, and process executions, then relates activity to workflow steps. Dev Machine Guard inventories AI coding agents, MCP servers, IDE extensions, and local packages on developer machines. Secure Registry provides package cooldowns, blocks compromised versions, and offers typosquat protection and blocklists. Code Repo Security screens pull requests and can open remediation pull requests according to policies. Security alerts can go to email, Slack, or Microsoft Teams. Dev Machine Guard can be deployed without an agent through Intune, SCCM, or Jamf on macOS, Windows, and Linux. The Community plan is free for unlimited public repositories and lists GitHub-hosted runners on GitHub Cloud; private repositories are included in the 14-day trial. Dev Machine Guard costs $8 a month per device, while Enterprise costs $16 a month per contributing developer. The Trust Center lists SOC 2 Type 2 and ISO 27001:2022 compliance.