- Home
- API Security Testing Software
- PurpleTeam
PurpleTeam
What it is
PurpleTeam is a CLI and service for dynamic application security testing against web applications and APIs. The maker describes it as language agnostic. Listed targets include authenticated applications, single-page applications, TLS/SSL deployments, server configurations, server-side HTML, GraphQL APIs, and REST APIs; its API formats include OpenAPI, SOAP, and GraphQL.
The CLI runs headlessly in build pipelines, with scans possible on commit, on push, nightly, or at another time. Findings include defect locations, remediation guidance, reproduction instructions, and tips for spotting similar issues. Users can adjust attack strengths and alert thresholds, including settings for existing defects that should not fail a test run. The Community plan is free, runs locally, and includes unlimited scans and targets with 12 concurrent test sessions. Cloud-hosted Standard costs $85 a month with annual billing or $110 USD per month with monthly billing. Pro costs $185 a month annually or $240 USD per month monthly. A 14-day trial is listed. Cloud onboarding requires contacting the maker.
For and against
For
- Can run headlessly in build pipelines
- Scans can be scheduled at several stages
- Provides remediation and reproduction guidance
- Community plan includes unlimited scans and targets
Against
- Cloud onboarding requires contacting the maker
- Cloud plan scan minutes are limited
- Pro plan lists eight concurrent test sessions
The verdict
PurpleTeam offers local and cloud deployment options, along with adjustable scan settings and guidance for findings. Its free Community plan differs from the daily scan-minute limits and concurrency allowances listed for paid cloud plans.
Who it suits
PurpleTeam may suit software engineering and development teams seeking security testing within build pipelines. Its free local plan may also suit teams that prefer to run scans locally.
Plans and prices
Community
Hosted locally · Unlimited scans · Unlimited targets · 12 concurrent test sessions
Read 7 Oct 2026 · purpleteam-labs.com
Standard
Hosted in cloud · 360 scan minutes per day · Unlimited targets · 4 concurrent test sessions
Read 7 Oct 2026 · purpleteam-labs.com
Pro
Hosted in cloud · 480 scan minutes per day · Unlimited targets · 8 concurrent test sessions
Read 7 Oct 2026 · purpleteam-labs.com
Enterprise
Custom pricing · Unlimited scan minutes · Unlimited targets · 12 concurrent test sessions
Read 7 Oct 2026 · purpleteam-labs.com
On the record
- CI/CD
- The CLI can run in headless mode within build pipelines, and the maker says teams can choose to run it on commit, on push, nightly, or at any time.purpleteam-labs.com · read 7 Oct 2026
- Deployment
- The documentation describes local (OWASP) and cloud (BinaryMist) environments, and says cloud onboarding requires contacting the maker.purpleteam-labs.com · read 7 Oct 2026
- Integrations
- The maker says PurpleTeam uses a CLI process that runs anywhere and does not require specific integrations.purpleteam-labs.com · read 7 Oct 2026
- Language support
- The maker describes PurpleTeam as language agnostic.purpleteam-labs.com · read 7 Oct 2026
- Results and guidance
- PurpleTeam provides defect locations, remediation guidance, test reproduction instructions, and tips for spotting similar issues.purpleteam-labs.com · read 7 Oct 2026
- Security reporting
- The maker asks users to report security issues through its contact page with “SECURITY” in the subject line and says it will provide next steps and progress updates.purpleteam-labs.com · read 7 Oct 2026
- Support
- The Community plan lists community Slack, GitHub Issues, GitHub Discussions, full documentation, and full source code; the Pro plan lists email support with a 48-hour response.purpleteam-labs.com · read 7 Oct 2026
- Testing targets
- The product page lists authenticated applications, single page applications, TLS/SSL deployments, server configurations, server-side HTML, GraphQL APIs, and REST APIs.purpleteam-labs.com · read 7 Oct 2026
- Tuning
- Users can adjust tester attack strengths and alert thresholds, including thresholds for existing defects that should not fail a test run.purpleteam-labs.com · read 7 Oct 2026
- What it does
- PurpleTeam is a CLI and service that runs dynamic application security testing against web applications and APIs.purpleteam-labs.com · read 7 Oct 2026
- Who it is for
- The maker describes BinaryMist as a consultancy focused on giving software engineering and development teams security knowledge, guidance, and tooling.purpleteam-labs.com · read 7 Oct 2026
