Kusari
Kusari is a software supply chain security platform that builds an updated knowledge graph of components across repositories, images, and pipelines.
What Kusari is
Kusari is a software supply chain security platform that builds an updated knowledge graph of components across repositories, images, and pipelines. Its Trust Fabric draws on source and build artifacts, while Kusari Score weighs technical severity alongside reachability, exploitability, blast radius, effort to fix, ownership, and license. The platform ingests source and build artifacts, CycloneDX and SPDX SBOMs, VEX, and existing scanner output. Kusari Inspector reviews pull requests in GitHub, GitLab, and the CLI, returning a merge decision and a fix. Checks cover vulnerabilities, dependencies, secrets, typosquatted packages, licenses, unmaintained components, code weaknesses, and pipeline or image configuration. A review can include up to 2,000 dependency changes, with up to 1,000 high-priority changes examined in depth. Integrations include GitHub, GitLab, Jenkins, Azure DevOps, CircleCI, Jira, ServiceNow, Slack, and Microsoft Teams. Kusari says changed files are not stored, analysis input is deleted after completion, and data is encrypted in transit and at rest.
Good
- Ingests CycloneDX and SPDX SBOMs, VEX, and scanner output
- Inspector checks pull requests in GitHub, GitLab, and CLI
- Checks cover vulnerabilities, secrets, licenses, and configuration
- Free plan available
- SOC 2 Type II compliant
Watch out
- Inspector reviews up to 2,000 dependency changes per pull request
- In-depth review covers up to 1,000 high-priority changes
- Self-hosted deployment is not available
Who it suits
Kusari is intended for developers, DevSecOps teams, and security teams managing software supply chain risk. It suits teams that want pull-request reviews and component visibility across repositories, images, and pipelines.
Verdict
Kusari combines component mapping with pull-request checks and integrations for development, tracking, and communication tools. Its review limits and lack of self-hosted deployment are worth considering when evaluating fit.
Plans and prices
From Kusari's own pricing page, checked 30 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Free | Free | Across multiple GitHub organizations · Unlimited public repositories · 1 private repository · per developer |
| Starter Team | $50 a month | 30-days free · No annual contract needed · Across multiple GitHub organizations · Unlimited public repositories · Unlimited private repositories · per team |
| Enterprise | Priced on request | Full platform capabilities · Advanced security and compliance controls · Dedicated support and onboarding |
The facts
Each one read from Kusari's own pages, with the date it was checked.
The company
- Founded
- 2022checked 28 Sep 2026
What it does
- Inspector coverage
- Inspector checks known vulnerabilities, transitive dependencies, credentials and secrets, typosquatted packages, licenses, unmaintained components, code weaknesses and pipeline or image configuration.checked 30 Sep 2026
- Inspector reviews
- Kusari Inspector reviews pull requests in GitHub, GitLab and the CLI and returns a merge decision and a fix.checked 30 Sep 2026
- Open source
- Kusari co-created and contributes to GUAC and remains an active maintainer supporting its adoption.checked 30 Sep 2026
- Product purpose
- Kusari is a software supply chain security platform that builds a continuously updated knowledge graph of components across repositories, images and pipelines.checked 30 Sep 2026
- Review limits
- Inspector analyzes pull requests with up to 2,000 total dependency changes and examines up to 1,000 high-priority dependency changes in depth.checked 30 Sep 2026
- Risk scoring
- Kusari Score weighs technical severity against reachability, exploitability, blast radius, effort to fix, ownership and license.checked 30 Sep 2026
- SBOM support
- The platform ingests source, build artifacts, CycloneDX and SPDX SBOMs, VEX and existing scanner output.checked 30 Sep 2026
- Security controls
- Inspector says changed files are not stored, analysis input is deleted after completion, data is encrypted in transit and at rest, and Kusari is SOC 2 Type II compliant.checked 30 Sep 2026
- Support
- The Enterprise plan includes dedicated support and onboarding.checked 30 Sep 2026
- Target users
- Kusari describes its customers and users as developers, DevSecOps teams and security teams managing software supply chain risk.checked 30 Sep 2026
- Trust Fabric
- The Kusari Trust Fabric is a continuously updated knowledge graph assembled from source and build artifacts and enriched at every node.checked 30 Sep 2026
- Workflow integrations
- Kusari lists integrations with GitHub, GitLab, Jenkins, Azure DevOps, CircleCI, Jira, ServiceNow, Slack and Microsoft Teams.checked 30 Sep 2026
Alternatives to Kusari
- 1
Renovate
Free planOpen sourceWebAPISelf-hosted7.8From $250 a year - 2
GitHub CodeQL
Free planWebExtensionLinuxmacOS7.5From $30 a month - 3
Endor Labs
Free planWebAPIExtensionLinux7.4Free plan - 4
Snyk Open Source
Free planWebAPILinuxmacOS7.3From $25 a month - 5
ActiveState Platform
Free planWebAPILinuxmacOS7.2Free plan - 6
Socket
Free planWebAPIExtensionLinux7.2From $25 a month