CRACI
Helsinki, Finland
What it is
CRACI provides managed CI runners that record software dependencies during builds and monitor those dependencies for vulnerabilities. Its build-time SBOMs include transitive dependencies and declared licenses, with CycloneDX or SPDX export formats. CRACI reevaluates monitored SBOMs as new vulnerabilities are published and supports triage, fix routing, and VEX. GitHub Actions is the supported CI integration today; other CI systems are roadmap items. It records packages from npm, PyPI, RubyGems, Cargo, Go, Nix, OCI registries, Debian, Ubuntu, Alpine, and Git or other source downloads. Jobs use an egress policy checked before startup that fails closed, and policy gates can stop builds in real time. Managed runners are Linux on x86-64 and ARM64; Windows, macOS, and on-prem runners are roadmap items. CRACI says source code is processed during builds but not stored, and build data is hosted in Europe. Its API returns SBOMs, network traces, and provenance, though its pricing FAQ says there is no report export. The Pro plan has no monthly fee and meters build time at $0.002 /vCPU-minute; there is no free plan.
For and against
For
- Build-time SBOMs include transitive dependencies and licenses
- Monitored SBOMs are reevaluated as vulnerabilities are published
- Policy gates can stop builds in real time
- Managed runners support Linux on x86-64 and ARM64
- Build data is hosted in Europe
Against
- No free plan
- GitHub Actions is the only supported CI integration today
- Windows, macOS, and on-prem runners are roadmap items
- Pricing FAQ says report export is unavailable
The verdict
CRACI combines managed Linux runners with dependency records and ongoing vulnerability monitoring. Pro has no monthly fee, but build minutes are metered at $0.002 /vCPU-minute.
Who it suits
CRACI may suit companies that build or ship software, including startups, SaaS providers, enterprises, agencies, and hardware makers with embedded code.
Plans and prices
Pro
1–20 users · no monthly fee · no per-SBOM charges · standard support
Read 5 Oct 2026 · craci.com
Enterprise
20+ users · EU data residency · custom data retention · SAML & SSO
Read 5 Oct 2026 · craci.com
On the record
- API
- The API returns SBOMs, network traces and provenance; the pricing FAQ says there is no report export.craci.com · read 5 Oct 2026
- Code and data
- CRACI processes source code during builds and says it does not store it; build data is hosted in Europe.craci.com · read 5 Oct 2026
- Integration
- GitHub Actions is the supported CI integration today; other CI systems are on the roadmap.craci.com · read 5 Oct 2026
- Intended users
- CRACI says it is for companies that build or ship software, including startups, SaaS providers, enterprises, agencies and hardware makers with embedded code.craci.com · read 5 Oct 2026
- Package sources
- CRACI records packages from npm, PyPI, RubyGems, Cargo, Go, Nix and OCI registries, plus Debian, Ubuntu and Alpine repositories and Git or other source downloads.craci.com · read 5 Oct 2026
- Policy controls
- Jobs run under an egress policy validated before startup that fails closed, and policy gates can stop builds in real time.craci.com · read 5 Oct 2026
- Product
- CRACI provides managed CI runners that record software dependencies during builds and monitor them for vulnerabilities.craci.com · read 5 Oct 2026
- Runners
- Available managed runners are Linux on x86-64 and ARM64; Windows, macOS and on-prem runners are listed as roadmap items.craci.com · read 5 Oct 2026
- SBOMs
- It records build-time SBOMs with transitive dependencies and declared licenses, exportable in CycloneDX or SPDX formats.craci.com · read 5 Oct 2026
- Security certification
- CRACI Corporation Oy says its information security management system is certified to ISO/IEC 27001.craci.com · read 5 Oct 2026
- Support
- The Pro plan includes standard support, while Enterprise includes priority support.craci.com · read 5 Oct 2026
- Vulnerability tracking
- CRACI continuously reevaluates monitored SBOMs as new vulnerabilities are published and supports triage, fix routing, and VEX.craci.com · read 5 Oct 2026
