{"schemaVersion":1,"company":"Offense Security","product":"Offense","currency":"usd","authentication":"One Offense API key for hosted security tools; basic dependency advisory checks are free.","tools":[{"id":"dependency-audit","name":"Dependency advisory intelligence","availability":"available","priceMicros":0,"inputType":"sanitized-lockfiles","endpoint":"/api/offense/audit","mcpTool":"offense.audit_dependencies"},{"id":"opengrep","name":"Source code security","inputType":"source-files","coverage":"Operator-maintained JavaScript, TypeScript and Python patterns and within-file taint rules; no exploit confirmation","availability":"available","unit":"first_mib_plus_additional_started_mib","basePriceMicros":50000,"additionalMiBPriceMicros":10000},{"id":"trivy-vuln","name":"Dependency vulnerabilities","inputType":"source-files","coverage":"Supported dependency manifests and lockfiles","availability":"available","unit":"first_mib_plus_additional_started_mib","basePriceMicros":50000,"additionalMiBPriceMicros":10000},{"id":"gitleaks","name":"Exposed secrets","inputType":"source-files","coverage":"Uploaded file contents; Git history is excluded","availability":"available","unit":"first_mib_plus_additional_started_mib","basePriceMicros":50000,"additionalMiBPriceMicros":10000},{"id":"trivy-config","name":"Infrastructure configuration","inputType":"source-files","coverage":"Supported infrastructure-as-code files","availability":"available","unit":"first_mib_plus_additional_started_mib","basePriceMicros":50000,"additionalMiBPriceMicros":10000},{"id":"trivy-sbom","name":"SBOM vulnerabilities","inputType":"sbom-json","coverage":"One CycloneDX or SPDX JSON file","availability":"available","unit":"first_mib_plus_additional_started_mib","basePriceMicros":50000,"additionalMiBPriceMicros":10000},{"id":"trivy-image","name":"Container image vulnerabilities","inputType":"image-tar","coverage":"One uploaded, digest-checked Docker image archive, up to 80 MiB","availability":"available","unit":"first_mib_plus_additional_started_mib","basePriceMicros":100000,"additionalMiBPriceMicros":10000},{"id":"gitleaks-history","name":"Git history secrets","inputType":"git-bundle","coverage":"One bounded Git bundle; redacted findings from prior commits","availability":"available","unit":"first_mib_plus_additional_started_mib","basePriceMicros":100000,"additionalMiBPriceMicros":10000},{"id":"guarddog-npm","name":"npm package risk","inputType":"package-archive","coverage":"One uploaded npm package archive; suspicious package behavior signals","availability":"available","unit":"first_mib_plus_additional_started_mib","basePriceMicros":100000,"additionalMiBPriceMicros":10000},{"id":"guarddog-pypi","name":"PyPI package risk","inputType":"package-archive","coverage":"One uploaded PyPI package archive; suspicious package behavior signals","availability":"available","unit":"first_mib_plus_additional_started_mib","basePriceMicros":100000,"additionalMiBPriceMicros":10000},{"id":"spectral-owasp","name":"OpenAPI security policy","inputType":"openapi-text","coverage":"One uploaded OpenAPI JSON or YAML document; specification checks only","availability":"available","unit":"first_mib_plus_additional_started_mib","basePriceMicros":50000,"additionalMiBPriceMicros":10000},{"id":"cosign-image","name":"Container image provenance","inputType":"cosign-save","coverage":"One offline Cosign image bundle, expected signer and OCI digest","availability":"available","unit":"first_mib_plus_additional_started_mib","basePriceMicros":100000,"additionalMiBPriceMicros":10000},{"id":"zap-passive-har","name":"Passive web response checks","inputType":"web-har","coverage":"One uploaded HAR with at most 200 captured responses; no live crawl or active requests","availability":"available","unit":"first_mib_plus_additional_started_mib","basePriceMicros":250000,"additionalMiBPriceMicros":50000},{"id":"zizmor","name":"GitHub Actions security","inputType":"source-files","coverage":"Supplied workflow and action YAML; offline trust-boundary, injection and permission checks","availability":"available","unit":"first_mib_plus_additional_started_mib","basePriceMicros":50000,"additionalMiBPriceMicros":10000},{"id":"osv-scanner","name":"Dependency remediation intelligence","inputType":"source-files","coverage":"Offline OSV advisory matches and advisory-listed fixed versions for supported supplied lockfiles; no dependency installation, automatic fix or exploit confirmation","availability":"available","unit":"first_mib_plus_additional_started_mib","basePriceMicros":50000,"additionalMiBPriceMicros":10000},{"id":"semgrep","name":"Semgrep source code security","inputType":"source-files","coverage":"Additional operator-reviewed JavaScript, TypeScript and Python rules using Semgrep Community Edition; no remote registry rules, cross-file reachability or exploit confirmation","availability":"available","unit":"first_mib_plus_additional_started_mib","basePriceMicros":50000,"additionalMiBPriceMicros":10000},{"id":"nuclei","name":"Deployment exposure checks","inputType":"verified-target","image":"assessment-network","license":"MIT","coverage":"Four fixed checks for exposed Git configuration, dotenv, actuator environment and directory listings; no general CVE coverage","billingUnit":"bounded_assessment","budgetSeconds":120,"maxRequests":200,"maxConnections":200,"availability":"available","unit":"bounded_assessment","basePriceMicros":500000,"additionalMiBPriceMicros":0},{"id":"prowler-cloudflare","name":"Cloudflare account security","inputType":"cloud-account","image":"assessment-network","license":"Apache-2.0","coverage":"Read-only Prowler checks in one explicitly selected Cloudflare account","billingUnit":"bounded_assessment","budgetSeconds":120,"maxRequests":200,"maxConnections":200,"availability":"available","unit":"bounded_assessment","basePriceMicros":500000,"additionalMiBPriceMicros":0},{"id":"schemathesis","name":"API fuzz testing","inputType":"verified-api","image":"assessment-network","license":"MIT","coverage":"Bounded schema-generated requests; failures require application-specific review","billingUnit":"bounded_assessment","budgetSeconds":120,"maxRequests":200,"maxConnections":200,"availability":"available","unit":"bounded_assessment","basePriceMicros":500000,"additionalMiBPriceMicros":0},{"id":"zap-api","name":"Active API security","inputType":"verified-api","image":"assessment-network","license":"Apache-2.0","coverage":"SQL injection, path traversal and CRLF injection checks plus passive response checks on one verified staging API","billingUnit":"bounded_assessment","budgetSeconds":120,"maxRequests":200,"maxConnections":200,"availability":"available","unit":"bounded_assessment","basePriceMicros":1000000,"additionalMiBPriceMicros":0},{"id":"sslyze","name":"TLS configuration","inputType":"verified-target","image":"assessment-network","license":"AGPL-3.0","coverage":"Certificate validation, Heartbleed and OpenSSL CCS injection on one verified HTTPS hostname; no full protocol or cipher enumeration","billingUnit":"bounded_assessment","budgetSeconds":120,"maxRequests":200,"maxConnections":200,"availability":"available","unit":"bounded_assessment","basePriceMicros":100000,"additionalMiBPriceMicros":0},{"id":"katana","name":"Web and API endpoint discovery","inputType":"verified-target","image":"assessment-network","license":"MIT","coverage":"GET-only discovery on one verified HTTPS origin, at most 50 pages and two link levels; no browser, forms, authenticated sessions or exploit confirmation","maxRequests":50,"maxConnections":50,"billingUnit":"bounded_assessment","budgetSeconds":120,"availability":"available","unit":"bounded_assessment","basePriceMicros":100000,"additionalMiBPriceMicros":0},{"id":"httpx","name":"Live service reconnaissance","inputType":"verified-target","image":"assessment-network","license":"MIT","coverage":"One HTTPS root response: service status, content type, size and detected technologies; no port scan, redirect following or vulnerability confirmation","maxRequests":1,"maxConnections":1,"billingUnit":"bounded_assessment","budgetSeconds":120,"availability":"available","unit":"bounded_assessment","basePriceMicros":50000,"additionalMiBPriceMicros":0},{"id":"openssf-scorecard","name":"Supply-chain trust assessment","inputType":"public-repository","image":"assessment-network","license":"CDLA-Permissive-2.0","coverage":"Published OpenSSF Scorecard snapshot for a public GitHub repository, with assessed commit, date and check scores; no fresh scan or private repository access","maxRequests":1,"maxConnections":1,"billingUnit":"bounded_assessment","budgetSeconds":120,"availability":"available","unit":"bounded_assessment","basePriceMicros":100000,"additionalMiBPriceMicros":0},{"id":"checkov","name":"Infrastructure graph review","inputType":"source-files","image":"assessment-offline","license":"Apache-2.0","coverage":"Offline infrastructure policy checks; no cloud account access","billingUnit":"bounded_assessment","budgetSeconds":120,"maxRequests":200,"maxConnections":200,"availability":"available","unit":"bounded_assessment","basePriceMicros":100000,"additionalMiBPriceMicros":0},{"id":"trufflehog-verified","name":"Live secret verification","inputType":"source-files","image":"assessment-network","license":"AGPL-3.0","coverage":"Uploaded files and a curated set of live credential verifiers; no Git history","billingUnit":"bounded_assessment","budgetSeconds":120,"maxRequests":200,"maxConnections":200,"availability":"available","unit":"bounded_assessment","basePriceMicros":250000,"additionalMiBPriceMicros":0},{"id":"mobsf-static","name":"Mobile release security","inputType":"mobile-app","image":"assessment-mobile","license":"GPL-3.0","coverage":"Static APK or IPA analysis; no emulator or dynamic execution","billingUnit":"bounded_assessment","budgetSeconds":480,"maxRequests":200,"maxConnections":200,"availability":"available","unit":"bounded_assessment","basePriceMicros":1000000,"additionalMiBPriceMicros":0}],"billing":{"enabled":true,"configured":true,"currency":"usd","unit":"per_tool"},"accountUrl":"https://offense.sh/account"}