Pricing

One fair price. All features. Always.

$1 per scan unit — that's it. No tiers, no feature gating, no "enterprise" markup. Everyone pays the same low, usage-based price and gets every capability.

Pay for exactly what you scan

CarbonMantis is usage-based. One credit tests one scan unit — so your bill maps precisely to how much testing you actually do. No seats, no minimums, no annual lock-in.

1 credit = 1 scan unit. A scan unit is one logical operation we test — a REST route today; GraphQL fields and gRPC methods follow on the same model.
Distinct work, not repetition. Testing an operation under multiple roles or with many inputs is still one scan unit — you pay for surface tested, not requests sent.
Know the cost first. Every scan is estimated before it runs, and you can cap it.
No surprises. You spend credits only when a scan runs.

Top-ups

Reload your way

Buy what you need

Top up any time by credit card. Minimum 10 credits.

102550100custom

Auto-reload

Never get blocked mid-pipeline. Set a balance threshold and a top-up amount, and CarbonMantis reloads automatically when you dip below it.

50 free to start

Every new account gets 50 free credits — no credit card. Enough to scan a real application end-to-end and see confidence-rated findings for yourself.

Fair by design

We don't penalize you for growing

Most security tools hide their best capabilities behind an "enterprise" tier with a price that's negotiated, opaque, and inflated. We think that's backwards. CarbonMantis has one price for everyone that aligns exactly with what you consume — no more, no less. Every feature is included for every account, always. No gating, ever.

Our mission is to make it as easy and cost-effective as possible to put automated penetration testing into your build process — where it belongs.

FAQ

Pricing questions, answered

What is a scan unit?

A scan unit is one logical operation CarbonMantis tests — a REST route like GET /users/:id today; GraphQL fields and gRPC methods are counted the same way when those canonicalizers ship. You spend one credit ($1) per scan unit. We count logical operations, not raw requests: testing GET /users/1 and GET /users/2 is one scan unit, and we never charge extra to test it under multiple user roles. A GraphQL API exposing 100 fields is 100 scan units — real, distinct work — but sending 1,000 inputs to one operation is still one.

What is a credit?

Your prepaid balance. One credit = one scan unit = $1. Buy credits up front (or use your 50 free ones); a scan spends one credit per scan unit it tests.

Do I need a credit card to start?

No. Your first 50 credits are free, no card required. You only add a payment method when you choose to top up.

Do credits expire?

Only if an account goes fully dormant. Credits expire after 12 months with no scans; running any scan resets the clock for another 12 months.

Are there feature tiers?

No. There is no Pro/Team/Enterprise gating. Every account gets every feature, always. The only variable is how many scan units you use.

How do I buy more credits?

Top up any time via credit card — a minimum of 10, in preset packs of 10, 25, 50, 100, or a custom amount. Set auto-reload to top up automatically when your balance drops below a threshold you choose.

Will you know the cost before a scan runs?

Yes. CarbonMantis estimates the scan-unit count (and therefore the credit cost) before a scan starts, and you can set a cap.