CRACI
CRACI provides managed CI runners that capture software dependencies during builds and monitor them for vulnerabilities.
What CRACI is
CRACI provides managed CI runners that capture software dependencies during builds and monitor them for vulnerabilities. Its build-time software bills of materials (SBOMs) include transitive dependencies and declared licenses, with exports in CycloneDX or SPDX formats. CRACI reevaluates monitored SBOMs as new vulnerabilities are published, and supports triage, fix routing, and VEX.
GitHub Actions is the supported CI integration today; other CI systems are roadmap items. The service records packages from npm, PyPI, RubyGems, Cargo, Go, Nix, OCI registries, Debian, Ubuntu, Alpine, and Git or other source downloads. Jobs use an egress policy checked before startup that fails closed, while policy gates can stop builds in real time. Managed runners are Linux on x86-64 and ARM64; Windows, macOS, and on-prem runners are roadmap items. CRACI says it processes source code during builds without storing it, and that build data is hosted in Europe. Its API returns SBOMs, network traces, and provenance, though its pricing FAQ says reports cannot be exported. The Pro plan has no monthly fee but meters build time at $0.002 /vCPU-minute; there is no free plan.
Good
- Creates SBOMs with transitive dependencies and declared licenses.
- Exports SBOMs in CycloneDX or SPDX formats.
- Reevaluates monitored SBOMs as vulnerabilities are published.
- Policy gates can stop builds in real time.
- Build data is hosted in Europe.
Watch out
- GitHub Actions is the only supported CI integration today.
- Windows, macOS, and on-prem runners are roadmap items.
- No free plan; build time is metered at $0.002 /vCPU-minute.
- Pricing FAQ says report export is unavailable.
Who it suits
CRACI suits companies that build or ship software, including startups, SaaS providers, enterprises, agencies, and hardware makers with embedded code. It is relevant to teams using GitHub Actions and Linux runners.
Verdict
CRACI combines managed Linux runners with dependency capture and ongoing vulnerability monitoring. Teams should account for its limited current CI integration and metered build charges.
Plans and prices
From CRACI's own pricing page, checked 5 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Pro | Free | 1–20 users · no monthly fee · no per-SBOM charges · standard support · $0.002 /vCPU-minute; build minutes are metered per second |
| Enterprise | Priced on request | 20+ users · EU data residency · custom data retention · SAML & SSO · ISO 27001 · priority support · Custom; annual contract |
The facts
Each one read from CRACI's own pages, with the date it was checked.
What it does
- API
- The API returns SBOMs, network traces and provenance; the pricing FAQ says there is no report export.checked 5 Oct 2026
- Code and data
- CRACI processes source code during builds and says it does not store it; build data is hosted in Europe.checked 5 Oct 2026
- Integration
- GitHub Actions is the supported CI integration today; other CI systems are on the roadmap.checked 5 Oct 2026
- Intended users
- CRACI says it is for companies that build or ship software, including startups, SaaS providers, enterprises, agencies and hardware makers with embedded code.checked 5 Oct 2026
- Package sources
- CRACI records packages from npm, PyPI, RubyGems, Cargo, Go, Nix and OCI registries, plus Debian, Ubuntu and Alpine repositories and Git or other source downloads.checked 5 Oct 2026
- Policy controls
- Jobs run under an egress policy validated before startup that fails closed, and policy gates can stop builds in real time.checked 5 Oct 2026
- Product
- CRACI provides managed CI runners that record software dependencies during builds and monitor them for vulnerabilities.checked 5 Oct 2026
- Runners
- Available managed runners are Linux on x86-64 and ARM64; Windows, macOS and on-prem runners are listed as roadmap items.checked 5 Oct 2026
- SBOMs
- It records build-time SBOMs with transitive dependencies and declared licenses, exportable in CycloneDX or SPDX formats.checked 5 Oct 2026
- Security certification
- CRACI Corporation Oy says its information security management system is certified to ISO/IEC 27001.checked 5 Oct 2026
- Support
- The Pro plan includes standard support, while Enterprise includes priority support.checked 5 Oct 2026
- Vulnerability tracking
- CRACI continuously reevaluates monitored SBOMs as new vulnerabilities are published and supports triage, fix routing, and VEX.checked 5 Oct 2026
The company
- Founded
- 2025checked 28 Sep 2026
- Headquarters
- Helsinki, Finlandchecked 28 Sep 2026
Alternatives to CRACI
- 1
Sigstore
Free planOpen sourceWebAPILinuxmacOS7.6Free plan - 2
GUAC
Free planOpen sourceWebAPILinuxmacOS7.5Free plan - 3
OX Security
Free planWebAPIExtensionLinux7.4Free plan - 4
ActiveState Platform
Free planWebAPILinuxmacOS7.2Free plan - 5
JFrog Artifactory
WebAPILinuxSelf-hosted7.1From $50 a month - 6
Wisec
Free planWebAPILinuxmacOS7.1From €990 a year