Kusari
What it is
Kusari is a software supply chain security platform that builds a continuously updated knowledge graph of components across repositories, images, and pipelines. Its Trust Fabric draws on source and build artifacts, adding information at each node. Kusari Score weighs technical severity alongside reachability, exploitability, blast radius, effort to fix, ownership, and license. The platform ingests source and build artifacts, CycloneDX and SPDX SBOMs, VEX, and existing scanner output. Kusari Inspector reviews pull requests in GitHub, GitLab, and the CLI, returning a merge decision and a fix. Its checks include vulnerabilities, transitive dependencies, credentials and secrets, typosquatted packages, licenses, unmaintained components, code weaknesses, and pipeline or image configuration. Each review can cover up to 2,000 total dependency changes, with up to 1,000 high-priority changes examined in depth. Integrations include GitHub, GitLab, Jenkins, Azure DevOps, CircleCI, Jira, ServiceNow, Slack, and Microsoft Teams. Kusari says changed files are not stored, analysis input is deleted after completion, and data is encrypted in transit and at rest; it is SOC 2 Type II compliant. Kusari offers a free plan and a Starter Team plan at $50 a month.
For and against
For
- Ingests SBOMs, VEX, and scanner output
- Reviews pull requests in GitHub, GitLab, and CLI
- Checks dependencies, secrets, licenses, and configurations
- Data is encrypted in transit and at rest
Against
- Pull-request reviews have dependency-change limits
- Self-hosted deployment is not available
- Starter Team costs $50 a month
The verdict
Kusari combines component mapping, risk scoring, and pull-request analysis for software supply chain security. Teams should consider its review limits and plan terms alongside the tools and workflows they need.
Who it suits
Kusari suits developers, DevSecOps teams, and security teams managing software supply chain risk. Its pull-request reviews and integrations may fit teams that want security checks within development workflows.
Plans and prices
Free
Across multiple GitHub organizations · Unlimited public repositories · 1 private repository
Read 30 Sep 2026 · kusari.dev
Starter Team
30-days free · No annual contract needed · Across multiple GitHub organizations · Unlimited public repositories
Read 30 Sep 2026 · kusari.dev
Enterprise
Full platform capabilities · Advanced security and compliance controls · Dedicated support and onboarding
Read 30 Sep 2026 · kusari.dev
On the record
- Inspector coverage
- Inspector checks known vulnerabilities, transitive dependencies, credentials and secrets, typosquatted packages, licenses, unmaintained components, code weaknesses and pipeline or image configuration.kusari.dev · read 30 Sep 2026
- Inspector reviews
- Kusari Inspector reviews pull requests in GitHub, GitLab and the CLI and returns a merge decision and a fix.kusari.dev · read 30 Sep 2026
- Open source
- Kusari co-created and contributes to GUAC and remains an active maintainer supporting its adoption.kusari.dev · read 30 Sep 2026
- Product purpose
- Kusari is a software supply chain security platform that builds a continuously updated knowledge graph of components across repositories, images and pipelines.kusari.dev · read 30 Sep 2026
- Review limits
- Inspector analyzes pull requests with up to 2,000 total dependency changes and examines up to 1,000 high-priority dependency changes in depth.kusari.dev · read 30 Sep 2026
- Risk scoring
- Kusari Score weighs technical severity against reachability, exploitability, blast radius, effort to fix, ownership and license.kusari.dev · read 30 Sep 2026
- SBOM support
- The platform ingests source, build artifacts, CycloneDX and SPDX SBOMs, VEX and existing scanner output.kusari.dev · read 30 Sep 2026
- Security controls
- Inspector says changed files are not stored, analysis input is deleted after completion, data is encrypted in transit and at rest, and Kusari is SOC 2 Type II compliant.kusari.dev · read 30 Sep 2026
- Support
- The Enterprise plan includes dedicated support and onboarding.kusari.dev · read 30 Sep 2026
- Target users
- Kusari describes its customers and users as developers, DevSecOps teams and security teams managing software supply chain risk.kusari.dev · read 30 Sep 2026
- Trust Fabric
- The Kusari Trust Fabric is a continuously updated knowledge graph assembled from source and build artifacts and enriched at every node.kusari.dev · read 30 Sep 2026
- Workflow integrations
- Kusari lists integrations with GitHub, GitLab, Jenkins, Azure DevOps, CircleCI, Jira, ServiceNow, Slack and Microsoft Teams.kusari.dev · read 30 Sep 2026
