Endor Labs

Endor Labs is an application security platform for code, dependencies, secrets, container images, and AI coding agents. AURI for Developers helps scan for vulnerabilities, detect secrets, and block malicious dependencies in AI coding workflows. Endor Code provides AI static application security testing and secrets detection; Endor Open Source adds reachability-based software composition analysis, malicious package detection, AI model governance, and SBOM and VEX generation. Teams can inventory coding agents, models, MCP servers, and skills, then enforce policies on agent actions. Scans can run through cloud apps, inside CI/CD runners, or through Endor Outpost for scheduled monitoring and on-premises deployment. Endor Labs says cloud scans briefly clone code into a container that is destroyed afterward; CI/CD scans keep code in the runner. The free Developer tier offers local scans and read-only vulnerability data, but no UI, policies, or scan history. Paid plans are priced on request. The platform lists Linux, macOS, Windows, web, and API availability; the company says it was founded in Palo Alto in 2021.

Endor Labs combines code and dependency security scanning with controls for AI coding agents and multiple deployment options. The free Developer tier is limited to local scans and read-only data, while paid team pricing is available on request.

Endor Labs suits developers and security teams working with code, open-source dependencies, or AI coding agents. Its free tier is aimed at individual developers who need local scans and read-only vulnerability information.

Endor Labs is an application-security platform for code, open-source components, secrets, containers, and AI coding agents. It suits development and security teams that need reachability analysis and agent controls in a hybrid deployment. The free Developer tier is best for individual local scans; shared governance, history, and web access require a paid plan.

Overview

Founded in Palo Alto in 2021, Endor Labs brings several security layers into one platform. Endor Code provides AI-assisted static analysis and secrets detection, while Endor Open Source analyzes dependencies, identifies malicious packages, governs AI models, and produces SBOM and VEX output. The platform also covers container images and package-firewall controls.

AURI for Developers puts vulnerability scanning, remediation, secret detection, and malicious-dependency blocking into an AI coding workflow. Agent governance can inventory coding agents, models, MCP servers, and skills, then enforce policies on agent actions. That combination is more relevant to organizations standardizing AI-assisted development than to teams seeking only a basic dependency scanner.

Endor Labs says customer source code is not stored. Cloud scanning briefly clones code into a container and destroys it afterward; CI/CD scanning keeps code in the runner. AURI agents run on customer infrastructure, are read-only by default, and request approval before mutating actions.

Key features

• Application and dependency analysis: Reachability-based SCA helps prioritize components that matter to an application rather than treating every finding alike. Malicious-package detection, pull-request scanning, SBOM generation, and VEX generation support both prevention and review workflows.
• AI development security: AURI addresses vulnerabilities, secrets, and dependency threats while developers work with AI coding tools. Endor Code adds AI SAST and secrets detection.
• Agent governance: Inventory and policy enforcement span agents, models, MCP servers, and skills. Approval before changes and read-only defaults reduce the risk of an agent taking an unwanted action.
• Integrations: Connections include GitHub, GitLab, Bitbucket, CircleCI, Jenkins, Jira, Slack, Vanta, Cursor, Claude, Gemini, and GitHub Copilot, giving teams options across source control, CI/CD, workflow, and AI tooling.
• Language coverage: Supported ecosystems include C/C++, Go, Java, JavaScript, Kotlin, .NET (C#), PHP, Python, Ruby, Rust, Scala, Swift, TypeScript, and Bazel.

Pricing

Developer

The Developer plan is free ($$0, billed free) for individual developers. It requires no account and supports local scans through the AURI MCP server. It is deliberately limited: there is no UI, policy management, or scan history, and vulnerability data is read-only. This works for a developer checking code locally, not for a team that needs centralized review.

Core

Core uses custom, seat-based pricing (contact sales). It adds reachability, prioritization, and policies for paid teams. The move from local-only, read-only use to shared controls is the important upgrade for organizations establishing a repeatable security process.

Pro

Pro also uses custom, seat-based pricing (contact sales). It adds advanced vulnerability detection, triage, and remediation across application layers. Paid plans use annual fair-usage quotas tied to purchased seats, but scanning is not blocked when a quota is exceeded. There is no free trial, so teams should evaluate deployment and seat needs before committing.

Platforms

Endor Labs supports API, Linux, macOS, web, and Windows. The endorctl CLI has installation paths for macOS, Linux, and Windows. Paid plans add the web UI and REST API. Deployment is hybrid: use cloud applications, scan inside CI/CD runners, or deploy Endor Outpost for scheduled monitoring and on-premises operation.

Who it's for

Choose Endor Labs when one program must cover source code, dependencies, secrets, AI models, containers, and coding-agent behavior, especially across a hybrid or on-premises environment. Reachability analysis and agent policy controls are strong reasons for larger engineering and security teams to consider it.

It is less suitable for an individual who wants a full dashboard, history, or policy controls without paying, or for a small project that needs a simple, clearly priced scanner. The free tier intentionally omits the shared features that make a security platform operationally useful.

Pros and cons

• Pro: Broad coverage combines code, dependencies, secrets, containers, AI models, and agent governance.
• Pro: Reachability analysis, SBOM/VEX generation, pull-request scanning, and malicious-package detection support practical prioritization.
• Pro: Cloud, CI/CD-runner, and on-premises deployment accommodate different data-handling requirements.
• Con: The free Developer tier has no UI, policies, history, or write access, limiting it to local individual work.
• Con: Core and Pro pricing is custom and seat-based, making budgeting less direct.
• Con: There is no free trial, so teams cannot use a published trial period to validate the paid experience.

Alternatives

For a freemium platform with a free Developer plan covering two users and defined repository, container, domain, cloud-account, and AI-AutoFix limits, consider Aikido CSPM. Sonatype Nexus Repository is the better fit when repository management, CI/CD integration, and a Community Edition matter most. Choose Contrast Security Platform for a free runtime-focused tier with CVE monitoring and runtime SCA. Semgrep Code suits teams wanting a free code-and-supply-chain edition capped at 10 repositories and 10 contributors. Snyk Open Source is a straightforward alternative for SCA, with a free tier capped at five projects. OWASP DefectDojo fits teams seeking an open-source platform and community support. GitLab Duo Code Suggestions is the alternative for teams primarily buying AI code suggestions within GitLab. JFrog Artifactory is the better choice when artifact repository capabilities are the priority. Browse DevSecOps Platforms, Dependency Management Software, Secrets Scanning Software, or Software Composition Analysis Software for broader category comparisons.

Verdict

Endor Labs is a strong choice for organizations that want dependency and code security tied to AI-agent governance, with reachability analysis and flexible hybrid deployment. Its main drawback is the sharp divide between a local, read-only free tier and custom-priced paid plans. Choose it for centralized, policy-driven security across modern AI development; look elsewhere if you need a full free interface or transparent subscription pricing.