What you buy here@asset <path>Declares a named asset: a component, a service or a data store.@asset in the GuardLink reference
Bravos Free costs nothing and needs no account: the research loop, in one repository. A licence adds the pre-PR gate and autopilot, CI and nightly workflows, scheduled upkeep, multi-repository workspaces, campaigns, SAST and the code graph on your developers’ machines, and GST tax invoices. bravos account activate starts a trial. The trial is the full Team bundle for 30 days. No card.
Buy Bravos Solo for one developer, or Bravos Team per seat from 2 seats, online and billed monthly or annually. Sign in at account.bugb.io to see prices and buy.
Free · no account, no licence
For one person, researching one repository.
npm install -g @bugb-technologies/bravosResearcher
1 seat · billed monthly or annually
For one person who wants the Team bundle.
Everything in Bravos Free, plus
Bought online. No repository limit. Cancel any time from your account.
Teams
Per seat, from 2 seats · billed monthly or annually
For a team sharing one licence and one invoice.
Everything in Bravos Solo, plus
Bought online. From 2 seats, you choose how many. No repository limit.
Contact sales · terms of your own
For procurement, your own terms, or an estate with no internet.
Everything in Bravos Team, plus
No repository limit.
Not sure what a seat is or how a licence renews? How licensing works (opens in a new tab)
From sign-in to a licensed machine@flows <source> -> <target> [via <mechanism>]Documents data moving from one component to another, and what carries it.@flows in the GuardLink reference
Sign in at account.bugb.io with Google, GitHub or an email link. Your first sign-in creates the account. There is no password.
Name your organisation and say who to invoice. Add your GSTIN to your billing details and it appears on your GST tax invoices.
Buy Bravos Solo for one developer, or Bravos Team from 2 seats, by card from the account, billed monthly or annually. For more seats than you can buy online, or an Enterprise contract, we set it up with you.
Your licence is issued as soon as the plan is active. Each developer runs bravos account activate, or imports the licence file, then bravos setup fetches SAST and the code graph. For CI, add the licence as the BRAVOS_LICENCE repository secret. Invite your team from the account.
Runs on your agent's subscription@flows <source> -> <target> [via <mechanism>]Documents data moving from one component to another, and what carries it.@flows in the GuardLink reference
Bugb does not charge per pentest. Bravos runs inside the coding agent you already use, so its AI work counts against that agent's subscription, like the rest of your coding. Replaying tests you already approved uses no AI at all. How much new testing it does depends on the level you choose.
See how much of your plan it uses
| Level | What it does | AI use |
|---|---|---|
| Low | No new tests. Replays the tests you already approved. | No AI use |
| Mediumdefault | Also tests findings that have no test yet, up to 8 per run. It asks first, unless you said yes to continuous pentesting. | Up to 8 findings tested per run |
| High | Up to 32 findings per run, and chains them into multi-step attacks. | Up to 32 findings tested per run, plus chaining |
| Max | Every testable class of exposure. It is approved in advance, so it does not ask. | Grows with the size of your threat model |
Set the level by telling your agent (“pentest at high”), or add the line bravos effort: high to AGENTS.md or CLAUDE.md.
When you want us to do the work: a threat model, a pentest, or the whole loop running in your CI/CD. We discuss your repositories, targets and access before proposing a scope.
Make security context part of your repository, not a document that drifts away from it.
Turn pentest hypotheses into executable tests you can keep, inspect and replay.
Connect the whole round in CI/CD with Bravos. Keep the model, pentests and evidence connected as your code changes.
Focus on an assessment with source-code context to guide hypotheses and testing.
Focus on an assessment from the outside, without requiring source-code access.
Our open-source tools stay free on their own: GuardLink and Cert-X-Gen. Every engagement follows our responsible disclosure pledge.