Free, Pro, Team, Enterprise

What each edition gives you

One binary for every tier. Free is the complete local scanner and session-history surface, under a free license anyone can register for; Pro adds the paid controls and keeps detection current for one developer; Team adds seats and an organization for a team; Enterprise adds fleet-scale reporting and rolls findings up across the whole fleet.

Tiers are cumulative: Pro includes Free; Team includes Pro; Enterprise includes Team. Findings are redacted - the console rolls up masked secrets and metadata, not raw credentials. Every edition runs locally on your own machines.

The free/paid boundary, published

The boundary is not a marketing decision revisited each quarter; it is published, capability by capability, with the reason. skarn check refuses with exit 7 when no license is installed and points you at the free registration; a paid flag without a covering license refuses fail-closed with exit 5 before any scan runs. Licenses are Ed25519-signed tokens verified locally against a key embedded in the binary - no activation, no callback, no kill switch.

Free

Pro

Team

Team unlocks nothing more in the binary: every developer on a Team seat gets every Pro capability above, and Team adds the organization around them.

Enterprise

The editions

Start free on your own machine; subscribe to Pro for one developer or Team for a team; add Enterprise for fleet-scale reporting and fleet-wide governance.

Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns.

Prices exclude VAT and sales tax, which Paddle adds at checkout.

Why the boundary sits where it does

What barely decays is free; what decays fast, and what centralizes an org, is what you pay for.

Provider key formats - AWS AKIA, GitHub ghp_, Stripe, and the rest - have been stable for years, so the bundled ruleset stays useful on its own: that is why the full local scanner stays in the free tier. What moves fast is the AI-attack surface: the prompt-injection and exfiltration techniques still being discovered, and the detection rules that catch them. Keeping those current between releases is the maintained feed you subscribe to - and on a fleet, the policy, baselines, audit evidence, and enforcement that turn one person's scan into a control a security team can run. (New assistant session formats ship in the binary at each release, for every tier alike - that currency is not a paid line.)

Air-gapped licensing

A license is a signed file, not a network or runtime service dependency - so an air-gapped network runs the same product a connected one does.

Skarn licenses by named seat, not by machine: each artifact is issued to one developer and is not bound to a specific device fingerprint, so it is not "node-locked" in the technical sense - your policy for how that developer's own laptop and any air-gapped machine they use stays in sync is yours to run, not something the binary enforces offline. A Pro, Team, or Enterprise license is an Ed25519-signed, term-length artifact, verified locally against a key embedded in the binary. Fetch it once on any connected machine - yours, a laptop at the edge of the network, whatever you already use to bring approved software in - and carry it across the air gap by whatever means your policy allows: removable media, a one-way transfer station, a change-controlled deployment pipeline. The binary never attempts a connection to check it; see the telemetry statement for the complete, source-verified list of the two commands that ever call out, neither of which is required to run skarn check.

Renewal at contract renewal works the same way: a new artifact, carried in the same way the first one was, with no request/response protocol and nothing to provision on your side. There is no floating-seat server in the deployment today, and no per-device concurrent-use check happens offline - seat compliance in an air-gapped environment is a contractual and process control (the same named-seat accounting the portal uses for connected customers), not a machine lock. A license server for floating air-gapped seats, for environments that need that enforced rather than assumed, is on our roadmap for when a customer's environment demands it.

This is a deployment property of the format, not a separate SKU: it applies to Pro, Team, and Enterprise licenses alike. Talk to us if your procurement process needs the term-length artifact described in writing.

Questions, answered

Is there a free version of Skarn?

Yes. The free tier is the full local product under a license anyone can register for, an individual or an organization alike - not a trial. The entire detection engine, all session search and analytics, the localhost web UI, every output format including SARIF and NDJSON, redaction, CI gating, a personal baseline file, custom rules, and the guard in audit mode. skarn check needs the free license, issued at getskarn.com/free after a one-time email confirmation and verified offline; skarn assess and the recall commands need none. Pro adds the paid controls and Team the organization around them; a lapsed paid license degrades back to the registered free tier - it keeps scanning. Install it with brew install skarn-security/tap/skarn, or download a single binary.

What do the paid tiers add?

The paid controls, and then the organization around them. Pro gives one developer policy-as-code, baselines with per-entry provenance, a tamper-evident audit log, evidence packs, the signed maintained feed of detection-rule and AI-attack updates, and real-time guard enforcement. Team adds the organization for 2 to 24 developers: seats, invitations, and a verified company domain. Enterprise adds the enterprise output profile and the self-hosted fleet console with SSO, RBAC, and audit on the roadmap.

How is Skarn licensed?

skarn check needs a free license, and skarn assess and the recall commands need none; the paid tiers are licensed per developer, as a subscription. A license is an Ed25519-signed token verified locally against a key embedded in the binary - no activation, no callback, no kill switch. skarn check refuses with exit 7 when no license is installed and points you at the free registration; a paid flag without a covering license refuses fail-closed with exit 5 before any scan runs. When a paid license lapses, the binary degrades to the registered free tier - it keeps scanning and your editor keeps working.

How does the maintained feed reach my machine?

As a signed, versioned feed verified locally against a key embedded in the binary, then layered over the bundled rules. The verification happens on your machine.