PurpleTeam
PurpleTeam is a command-line tool and service for dynamic application security testing of web applications and APIs.
What PurpleTeam is
PurpleTeam is a command-line tool and service for dynamic application security testing of web applications and APIs. The maker describes it as language agnostic. Listed targets include authenticated applications, single-page applications, TLS/SSL deployments, server configurations, server-side HTML, GraphQL APIs and REST APIs; API formats include OpenAPI, SOAP and GraphQL.
The CLI can run headlessly in build pipelines, with teams able to scan on commit, on push, nightly or at another time. Results include defect locations, remediation guidance, reproduction instructions and advice for finding similar issues. Users can adjust tester attack strengths and alert thresholds, including thresholds for known defects that should not fail a run. The maker says its CLI process can run anywhere without requiring specific integrations. The Community plan is free and hosted locally, with unlimited scans and targets and 12 concurrent test sessions. Standard and Pro are cloud-hosted; annual billing is $85 a month and $185 a month, respectively. Monthly billing is shown at $110 USD and $240 USD per month. A 14-day trial is available. Cloud onboarding requires contacting the maker.
Good
- Free Community plan with unlimited scans
- Tests web applications and APIs
- Can run headlessly in build pipelines
- Findings include remediation and reproduction guidance
- 14-day trial available
Watch out
- Cloud onboarding requires contacting the maker
- Standard and Pro have daily scan-minute limits
- Community plan is hosted locally
Who it suits
It suits software engineering and development teams that need application and API security testing in build pipelines. Teams can choose local Community hosting or contact the maker about cloud onboarding.
Verdict
PurpleTeam supports configurable testing and actionable findings across a broad set of web and API targets. The free Community plan runs locally; cloud hosting requires a paid plan, and cloud onboarding requires contacting the maker.
Plans and prices
From PurpleTeam's own pricing page, checked 7 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Community | Free | Hosted locally · Unlimited scans · Unlimited targets · 12 concurrent test sessions |
| Standard | $85 a month | Hosted in cloud · 360 scan minutes per day · Unlimited targets · 4 concurrent test sessions · Annual billing; page also shows $110 USD per month for monthly billing |
| Pro | $185 a month | Hosted in cloud · 480 scan minutes per day · Unlimited targets · 8 concurrent test sessions · Annual billing; page also shows $240 USD per month for monthly billing |
| Enterprise | Priced on request | Custom pricing · Unlimited scan minutes · Unlimited targets · 12 concurrent test sessions |
The facts
Each one read from PurpleTeam's own pages, with the date it was checked.
What it does
- CI/CD
- The CLI can run in headless mode within build pipelines, and the maker says teams can choose to run it on commit, on push, nightly, or at any time.checked 7 Oct 2026
- Deployment
- The documentation describes local (OWASP) and cloud (BinaryMist) environments, and says cloud onboarding requires contacting the maker.checked 7 Oct 2026
- Integrations
- The maker says PurpleTeam uses a CLI process that runs anywhere and does not require specific integrations.checked 7 Oct 2026
- Language support
- The maker describes PurpleTeam as language agnostic.checked 7 Oct 2026
- Results and guidance
- PurpleTeam provides defect locations, remediation guidance, test reproduction instructions, and tips for spotting similar issues.checked 7 Oct 2026
- Security reporting
- The maker asks users to report security issues through its contact page with “SECURITY” in the subject line and says it will provide next steps and progress updates.checked 7 Oct 2026
- Support
- The Community plan lists community Slack, GitHub Issues, GitHub Discussions, full documentation, and full source code; the Pro plan lists email support with a 48-hour response.checked 7 Oct 2026
- Testing targets
- The product page lists authenticated applications, single page applications, TLS/SSL deployments, server configurations, server-side HTML, GraphQL APIs, and REST APIs.checked 7 Oct 2026
- Tuning
- Users can adjust tester attack strengths and alert thresholds, including thresholds for existing defects that should not fail a test run.checked 7 Oct 2026
- What it does
- PurpleTeam is a CLI and service that runs dynamic application security testing against web applications and APIs.checked 7 Oct 2026
- Who it is for
- The maker describes BinaryMist as a consultancy focused on giving software engineering and development teams security knowledge, guidance, and tooling.checked 7 Oct 2026
The company
- Founded
- 2013checked 28 Sep 2026
Alternatives to PurpleTeam
- 1
42Crunch API Security Platform
Free planWebAPIExtensionLinux7.9From $9 a month - 2
APISec Platform
Free planWebAPIExtensionLinux7.5From $690 a month - 3
WuppieFuzz
Free planOpen sourceAPILinuxmacOSSelf-hosted7.3Free plan - 4
Beagle Security
Free planWebAPI6.9From $99 a month - 5
StackHawk HawkScan
WebAPILinuxmacOS6.8From $10 a month - 6
AquilaX API Security Scanner
Free planWebAPIExtensionSelf-hosted6.7From $19 a month