During the 14-day trial
Dodo Payments collects a card for self-service checkout. Trial access follows the selected product plan; downloading a launcher alone does not create engine access.
Code Security pricing
Every scanner in every plan.
Priced per developer; dashboard-only members are free. Every plan includes every scanner, and Team and Business start with a 14-day free trial.
US dollars per developer, a member with CLI access. Yearly billing saves up to 16%; taxes, where they apply, are shown at checkout.
Team
Every scanner, the findings workflow and a CLI licence for each developer, for teams of up to 20.
$39per developer / month
Or $399 a year, saving 15%.
Included
- Code, dependency, secret and configuration scanning in every supported language
- SBOM, CBOM and separate AIBOM generation
- Dashboard triage, comparison with the previous scan and pull-request comments
- Reports and exports: CSV, JSON, SARIF, XML and HTML
- Optional AI review with your own model
- Sign in with Google, GitHub or email, with two-step verification
- Up to 20 developers and 3 CI tokens; dashboard-only members are free
Business
For organisations
Risk management, the software inventory and audit for the whole organisation.
$99per developer / month
Or $999 a year, saving 16%.
Everything in Team, plus
- Risk register, risk acceptance, SLA policy, campaigns and a governance report
- Software inventory across every repository
- Audit log, trends and scheduled organisation reports
- Signed webhooks and custom policies on every upload
- Unlimited developers and CI tokens
Enterprise
Single sign-on, air-gapped licences your admins issue, and terms agreed in a written contract.
Custom
Priced in a written agreement
Everything in Business, plus
- SAML single sign-on on DNS-verified domains, optionally required
- Air-gapped CLI licences issued by your own admins, within your seats
- Seat count and terms set in the agreement
- Invoiced billing under contract
- Plan activated by MAGDOX with an Enterprise key
Choose by the organisation's workflow
Start with scanning. Add the controls your team needs.
Scanning capabilities are included across plans. Choose the plan according to how the organisation reviews, coordinates and governs the uploaded results.
Count people who need CLI access, including open invitations for that access. Dashboard-only members are free. Team supports up to 20 developers; Business and Enterprise accommodate the broader organisation.
| Plan | A useful fit when | What to evaluate |
|---|---|---|
| Team | A development team wants local scanning, shared triage and repeatable pipeline checks | Supported repository coverage, review output and your CI workflow |
| Business | Several teams need application risk, cross-repository inventory and organisation governance | Application ownership, SLA policy, inventory freshness and integration requirements |
| Enterprise | Single sign-on, air-gapped licensing, procurement or deployment requirements need a written agreement | Seats, operating model, licence provisioning and the agreed support scope |
Worked example · Team
5 developers and 10 dashboard-only reviewers
5 × $39 = $195/month, before tax. The 10 dashboard-only reviewers add no developer charges.
At the annual rate, those 5 developers cost $1,995 per year, billed annually. An annual total is a yearly payment, not a monthly invoice.
Worked example · Business
The same 5 developers with organisation controls
5 × $99 = $495/month, before tax, with Business risk, inventory and governance features.
The annual total is $4,995 for 5 developers. These examples use the published catalogue and exclude any separately agreed services or third-party model costs.
Before the first charge
Review the selected developer count and billing period. Cancel before the trial ends if you do not want the subscription to convert.
For an offline requirement
Discuss the licence and provisioning process before disconnecting. An offline allowance does not remove expiry or automatically install private components.
Compare plans
What each plan includes.
Scanning coverage is the same in every plan. Plans differ in what the organisation runs on top of the findings: risk decisions, the inventory across repositories, how people sign in and the controls an organisation needs, from the audit log to webhooks.
| Feature | Team | Business | Enterprise |
|---|---|---|---|
| Scanning | |||
| Source-code security (SAST) | Included in Team | Included in Business | Included in Enterprise |
| Dependency advisory matching with available EPSS and KEV | Included in Team | Included in Business | Included in Enterprise |
| Secrets in code and configuration | Included in Team | Included in Business | Included in Enterprise |
| Infrastructure as code and repository configuration | Included in Team | Included in Business | Included in Enterprise |
| Malicious package and typosquatting review | Included in Team | Included in Business | Included in Enterprise |
| Authentication and business-logic checks | Included in Team | Included in Business | Included in Enterprise |
| SBOM, CBOM and separate AIBOM generation | Included in Team | Included in Business | Included in Enterprise |
| Every supported language and configuration family | Included in Team | Included in Business | Included in Enterprise |
| Findings workflow | |||
| One dashboard across repositories | Included in Team | Included in Business | Included in Enterprise |
| Dispositions, assignment, comments and saved views | Included in Team | Included in Business | Included in Enterprise |
| Comparison with the previous scan | Included in Team | Included in Business | Included in Enterprise |
| Pull-request comments and the CLI quality gate (--fail-on) | Included in Team | Included in Business | Included in Enterprise |
| Instant new-finding emails and your own daily digest | Included in Team | Included in Business | Included in Enterprise |
| Reports and exports: CSV, JSON, SARIF, XML, HTML | Included in Team | Included in Business | Included in Enterprise |
| Organisation controls | |||
| Audit log | Not included in Team | Included in Business | Included in Enterprise |
| Trends and history | Not included in Team | Included in Business | Included in Enterprise |
| Scheduled organisation reports | Not included in Team | Included in Business | Included in Enterprise |
| Signed webhooks | Not included in Team | Included in Business | Included in Enterprise |
| Custom policies evaluated on every upload | Not included in Team | Included in Business | Included in Enterprise |
| CLI and assistants | |||
| A CLI licence for every developer | Included in Team | Included in Business | Included in Enterprise |
| Offline use of an expiring licence | Up to 7 days | Up to 30 days | Up to 90 days |
| Air-gapped licences issued by your own admins | Not included in Team | Not included in Business | Included in Enterprise |
| Optional AI review with your own model | Included in Team | Included in Business | Included in Enterprise |
| Coding assistant integration (MCP and plugin) | Included in Team | Included in Business | Included in Enterprise |
| Risk management | |||
| Risk register by repository and application | Not included in Team | Included in Business | Included in Enterprise |
| Applications: repositories grouped into the services you ship | Not included in Team | Included in Business | Included in Enterprise |
| Risk acceptance with approval and expiry | Not included in Team | Included in Business | Included in Enterprise |
| Remediation SLA policy and breach tracking | Not included in Team | Included in Business | Included in Enterprise |
| Remediation campaigns, queue and reminders | Not included in Team | Included in Business | Included in Enterprise |
| Risk movement over time and governance report | Not included in Team | Included in Business | Included in Enterprise |
| Software inventory | |||
| Package versions across every repository | Not included in Team | Included in Business | Included in Enterprise |
| Inventory connected to the applications it supports | Not included in Team | Included in Business | Included in Enterprise |
| Identity and access | |||
| Sign in with Google, GitHub or email | Included in Team | Included in Business | Included in Enterprise |
| Two-step verification: authenticator app, email codes, recovery codes | Included in Team | Included in Business | Included in Enterprise |
| Organisation roles and separate product access | Included in Team | Included in Business | Included in Enterprise |
| SAML single sign-on, for example Okta, Microsoft Entra ID, Google Workspace or JumpCloud | Not included in Team | Not included in Business | Included in Enterprise |
| Domain verification by DNS record | Not included in Team | Not included in Business | Included in Enterprise |
| Require single sign-on for verified domains | Not included in Team | Not included in Business | Included in Enterprise |
| Sign-in from your identity provider's app portal | Not included in Team | Not included in Business | Included in Enterprise |
| Seats and CI tokens | |||
| Developers (members with CLI access) | Up to 20 | Unlimited | By agreement |
| CI tokens | Up to 3 | Unlimited | Unlimited |
Questions
Plans and billing.
Something not covered here? Our team can help you choose a plan or arrange an Enterprise agreement.
Talk to our teamHow is a plan priced?
Team and Business are priced per developer, billed monthly or yearly. A developer is a member with CLI access, plus any open invitation for that access; dashboard-only members, such as viewers and triagers, are free. You choose the number of developers when you subscribe and can change it later under Settings, Plans. Team covers up to 20 developers; Business has no limit. Enterprise seats and terms are set in a written agreement.
Does every plan scan everything?
Yes. Every plan includes every supported language, configuration family and scanning surface, with no per-language or per-scan charges and no premium export formats. Plans differ in organisation features: risk management, the software inventory, the audit log, trends, scheduled reports, webhooks and custom policies start at Business; single sign-on and air-gapped licences are part of Enterprise.
How do we pay?
Team and Business are paid online through our payment provider, Dodo Payments. Taxes, where they apply, are shown at checkout, and invoices are available under Settings, Plans. Enterprise is invoiced under its agreement.
Can we cancel or change plans?
Yes. Owners can change plan, billing period or developer count under Settings, Plans. Cancelling stops the next renewal; access continues until the end of the period already paid for. Cancelling during the free trial means you are not charged, and access ends when the trial does. Moving from Business to Team keeps your data and configuration, but Business features stop: webhooks and scheduled reports stop sending, custom policies stop being evaluated, and risk management, the inventory, the audit log and trends stay locked until you upgrade again.
Is there a free trial?
Yes. Team and Business start with a 14-day free trial. A payment card is required at checkout, through Dodo Payments; the first charge is taken when the 14 days end unless you cancel before then. Each organisation gets one trial. During the trial you have everything in the plan you chose, though CLI offline leases do not run past the trial end. For a larger organisation, talk to our team about an Enterprise evaluation.
Can the CLI run offline or air-gapped?
Analysis always runs on your machine or CI runner. A licence keeps working offline for up to 7 days on Team, 30 days on Business and 90 days on Enterprise, within its expiry and never past what is paid for. Air-gapped licences are part of Enterprise: your admins issue them in the console for computers that never connect, up to your agreed seats, and each one ends with your contract. If a plan lapses, the CLI stops loading rules when its current lease ends.
Is self-hosting available?
Not as a packaged product today. The dashboard and API are hosted by MAGDOX in India, and analysis always runs in the CLI on your own machines or CI runners. Enterprise can run the CLI air-gapped. If you need a self-hosted dashboard, tell our team your requirements.
Does this include FDIE?
No. FDIE is Magdox's second product, with separate self-service and Enterprise plans at magdox.io/pricing/fdie/. These Code Security plans do not include an FDIE subscription.
Enterprise
Single sign-on, offline licences and terms, agreed with you.
For organisations that sign in through their own identity provider, run the CLI on air-gapped computers or need a written contract. Tell us how many people need access and where your work runs.