Free, Team, Enterprise

What each edition gives you

One binary for every tier. Free is the complete local scanner and session-history surface, under a free license anyone can register for; Team adds the org controls and keeps detection current; Enterprise adds fleet-scale reporting and rolls findings up across the whole fleet.

Tiers are cumulative: Team includes Free, Enterprise includes Team. Findings are redacted - the console rolls up masked secrets and metadata, not raw credentials. Every edition runs locally on your own machines.

The free/paid boundary, published

The boundary is not a marketing decision revisited each quarter; it is published, capability by capability, with the reason. skarn check refuses with exit 7 when no license is installed and points you at the free registration; a paid flag without a covering license refuses fail-closed with exit 5 before any scan runs. Licenses are Ed25519-signed tokens verified locally against a key embedded in the binary - no activation, no callback, no kill switch.

Free

Team

Enterprise

The three editions

Start free on your own machine; subscribe for the org controls; add Enterprise for fleet-scale reporting and fleet-wide governance.

Why the boundary sits where it does

What barely decays is free; what decays fast, and what centralizes an org, is what you pay for.

Provider key formats - AWS AKIA, GitHub ghp_, Stripe, and the rest - have been stable for years, so the bundled ruleset stays useful on its own: that is why the full local scanner stays in the free tier. What moves fast is the AI-attack surface: the prompt-injection and exfiltration techniques still being discovered, and the detection rules that catch them. Keeping those current between releases is the maintained feed you subscribe to - and on a fleet, the policy, baselines, audit evidence, and enforcement that turn one person's scan into a control a security team can run. (New assistant session formats ship in the binary at each release, for every tier alike - that currency is not a paid line.)

Air-gapped licensing

A license is a signed file, not a network or runtime service dependency - so an air-gapped network runs the same product a connected one does.

Skarn licenses by named seat, not by machine: each artifact is issued to one developer and is not bound to a specific device fingerprint, so it is not "node-locked" in the technical sense - your policy for how that developer's own laptop and any air-gapped machine they use stays in sync is yours to run, not something the binary enforces offline. A Team or Enterprise license is an Ed25519-signed, term-length artifact, verified locally against a key embedded in the binary. Fetch it once on any connected machine - yours, a laptop at the edge of the network, whatever you already use to bring approved software in - and carry it across the air gap by whatever means your policy allows: removable media, a one-way transfer station, a change-controlled deployment pipeline. The binary never attempts a connection to check it; see the telemetry statement for the complete, source-verified list of the two commands that ever call out, neither of which is required to run skarn check.

Renewal at contract renewal works the same way: a new artifact, carried in the same way the first one was, with no request/response protocol and nothing to provision on your side. There is no floating-seat server in the deployment today, and no per-device concurrent-use check happens offline - seat compliance in an air-gapped environment is a contractual and process control (the same named-seat accounting the portal uses for connected customers), not a machine lock. A license server for floating air-gapped seats, for environments that need that enforced rather than assumed, is on our roadmap for when a customer's environment demands it.

This is a deployment property of the format (WS-A/WS-E), not a separate SKU: it applies to Team and Enterprise licenses alike. Talk to us if your procurement process needs the term-length artifact described in writing.

Questions, answered

Is there a free version of Skarn?

Yes. The free tier is the full local product under a license anyone can register for, an individual or an organization alike - not a trial. The entire detection engine, all session search and analytics, the localhost web UI, every output format including SARIF and NDJSON, redaction, CI gating, a personal baseline file, custom rules, and the guard in audit mode. skarn check needs the free license, issued at getskarn.com/free after a one-time email confirmation and verified offline; skarn assess and the recall commands need none. Paid tiers add the org capabilities, and a lapsed paid license degrades back to the registered free tier - it keeps scanning. Install it with brew install skarn-security/tap/skarn, or download a single binary.

What do the paid tiers add?

Org capabilities. Team adds the controls an organization needs: policy-as-code, org-distributed baselines, a tamper-evident audit log, the signed maintained feed of detection-rule and AI-attack updates, and real-time guard enforcement. Enterprise adds the enterprise output profile and the self-hosted fleet console with SSO, RBAC, and audit on the roadmap.

How is Skarn licensed?

skarn check needs a free license, and skarn assess and the recall commands need none; the paid tiers are licensed per developer, as a subscription. A license is an Ed25519-signed token verified locally against a key embedded in the binary - no activation, no callback, no kill switch. skarn check refuses with exit 7 when no license is installed and points you at the free registration; a paid flag without a covering license refuses fail-closed with exit 5 before any scan runs. When a paid license lapses, the binary degrades to the registered free tier - it keeps scanning and your editor keeps working.

How does the maintained feed reach my machine?

As a signed, versioned feed verified locally against a key embedded in the binary, then layered over the bundled rules. The verification happens on your machine.