SCAN→FIX→MONITOR→COMPLY
Four pillars. Every digital business needs them. A founder can run all four solo. A security officer can run them across ten clients. Unlock each one as you grow.
AI-powered analysis of your entire codebase — auth flaws, injection, secrets, AI-specific risks, and real CVEs in your dependencies.
Auto-bump vulnerable dependencies. Generate paste-ready AI fix prompts for Cursor and Copilot. Open PRs directly against your repo.
Autopilot monthly scans on your repos. Diff scans catch only what changed. Email security reports. Security badge for your README.
Full GRC mapping across SOC 2, HIPAA, PCI DSS, ISO 27001, and EU AI Act. Evidence snapshots. Investor readiness reports. Audit-ready exports.
THE WAY STARTUPS
DO SECURITY.
Every digital business needs security. Most can't afford a CISO. Custodia is the platform that closes that gap — a founder can set it up in minutes and run it solo, a security officer can use the same platform to manage ten client portfolios. No dedicated team required.
Scan your codebase, fix vulnerabilities, monitor every repo on autopilot, and generate compliance evidence for SOC 2, ISO 27001, and investor due diligence — all from one platform that grows with your startup from first commit to enterprise deal.
ONE PLATFORM. EVERY STAGE.
Upgrade when your startup does. More repos, more compliance, more data — Custodia scales with you, not against you.
Scan your codebase before you ship. OWASP Top 10, secrets, dep CVEs, AI risks. Get your security baseline. Badge for your README. No card, ever.
Start free →Ship to real users without shipping your vulnerabilities. Auto-fix deps, open PRs against your repo, monthly autopilot scans, inline PR security review, and a CyberSec officer session every month.
Get Launch →Win enterprise deals and pass security reviews. SOC 2, HIPAA, ISO 27001, EU AI Act — full GRC gap report, questionnaire autofill, cyber insurance PDF, evidence snapshots. Up to 10 repos on autopilot.
Get Scale →Show investors and enterprise clients you take security seriously — with the receipts. 30 repos, portfolio score history, white-label PDFs, priority CyberSec officer access, and Series A investor readiness reports.
Get Raise →FOUR COMMANDS.
CYBERSECURITY ON AUTOPILOT.
Install once. The loop runs itself — scans, fixes, and emails you every month. No dashboards to maintain. No meetings with a security team. Just results in your inbox.
custodia scan .
custodia ai-scan
custodia fix
custodia schedule owner/repo
No credit card · 3 free scan credits / month · Under 5 minutes to first scan
HOW MODERN
CYBERSECURITY IS DONE.
Security isn't a one-time event. It's a repeating cycle — each phase feeding the next, closing the gap between what attackers know and what you know.
YOU'RE MOVING FAST.
STAY AHEAD OF WHAT'S COMING.
Your code gets more valuable — and more targeted — as your business grows. Automated bots, AI-powered attack tools, and dependency exploits don't wait until you feel ready. Here's what every startup is up against, and exactly what Custodia protects you from at each stage.
FROM INSTALL TO
AUDIT-READY IN MINUTES.
Every paid plan includes SOC 2, HIPAA, and PCI DSS compliance scanning — one flag, done. Run custodia scan . --framework soc2 and get a gap report mapped to specific controls, ready to hand to an auditor.
# Install globally npm install -g @custodia/cli # Launch interactive mode (guided menus — no flags needed) custodia # Authenticate with your API key (from dashboard) custodia auth --key YOUR_API_KEY # Full security scan — OWASP Top 10, CWE, secrets, deps custodia scan . # AI code review — OWASP LLM Top 10, prompt injection, agency custodia ai-scan # Auto-fix vulnerable deps (add --pr to open a GitHub PR) custodia fix custodia fix --pr # Monthly auto-scan — registers repo for 30-day email reports custodia schedule owner/repo # Diff mode — only changed files (fast, quota-efficient) custodia scan . --diff # Scan any GitHub repo without cloning custodia scan --repo owner/repo # ── Compliance scans — included in all paid plans ───────── # Gap report mapped to specific controls · findings tagged with IDs custodia scan . --framework soc2 # SOC 2 Type II — CC1–CC9, A1 custodia scan . --framework hipaa # HIPAA §164.308 / 310 / 312 custodia scan . --framework pci # PCI DSS v4.0 Req 1–12 # [OK] Report saved to .custodia-reports/ # [OK] Score: 87/100 — READY FOR PRODUCTION
custodia scan . --framework soc2- →Maps to CC1–CC9 + A1 Trust Services Criteria
- →Gap report: pass / partial / fail per control
- →Evidence bundle for Type II audit prep
- →Findings tagged with CC control IDs
custodia scan . --framework hipaa- →§164.308 Administrative Safeguards
- →§164.310 Physical · §164.312 Technical
- →Gap report per safeguard category
- →Supports HIPAA risk analysis documentation
custodia scan . --framework pci- →Requirements 1–12: MFA, encryption, access controls
- →Gap report identifying non-compliant controls
- →Evidence for QSA self-assessment questionnaire
- →Findings tagged with Requirement numbers
Included in all paid plans · Pro $39/mo · Team $129/mo · Business $249/mo
DASHBOARD. CLI. MCP.
ONE SECURITY STACK.
Three ways to scan — pick what fits your workflow. Dashboard for point-and-click, CLI for terminal and CI/CD, and MCP to scan directly inside Claude.ai or Cursor in plain English. Same pipeline, same findings, same quota across all three.
Connect GitHub with one OAuth click. Pick any repo, choose Full or Diff scan, and review your findings inline — all from your browser. Schedule monthly auto-scans, manage API keys, and book expert sessions without touching a terminal.
- →Connect GitHub — one OAuth click
- →Pick any repo & scan in one click
- →Review findings inline in the browser
- →Schedule autopilot & manage keys
- →Book cybersec expert sessions
Install once, run anywhere. custodia launches interactive mode with guided menus — no flags required. Or go direct with custodia scan . Integrates with GitHub Actions, Cursor, Copilot, and Claude Code out of the box.
# Interactive mode custodia # Or go direct custodia scan . custodia fix custodia schedule owner/repoSee All Commands ↓
Connect Custodia to Claude.ai, Claude Desktop, or Cursor — then scan any GitHub repo and discuss findings in natural language. No context-switching. Security in conversation.
- →Ask Claude to scan any public or private repo
- →Findings land directly in the chat context
- →Ask follow-ups, request fix code, brief stakeholders
- →Works in claude.ai browser, Claude Desktop, Cursor
- →Same quota as CLI — nothing extra to buy
YOUR SECURITY POSTURE
IN YOUR INBOX.
EVERY MONTH.
Register a repo with custodia schedule and every 30 days Custodia runs the full scan pipeline and emails you. No login required. No dashboard to check. Security awareness delivered to where you actually look.
- [OK]Security score this month + delta vs last month
- [OK]New findings since last scan
- [OK]Resolved / fixed findings
- [OK]Top critical & high severity issues
- [OK]Direct link to full report + custodia fix CTA
- [OK]Posture trend over time
ONE COMMAND.
AUTOMATED FOREVER.
Register any GitHub repo for monthly automated security scanning. No login required after setup. No dashboard to manage. Every 30 days: full scan runs, email report arrives. Your security posture on autopilot.
custodia schedule owner/repo
[ ⏱ cron: 09:00 UTC daily ]
noreply@custodia.dev
Pass a GitHub personal access token when scheduling. It's encrypted with AES-256-GCM before storage — Custodia never stores it in plaintext. The cron decrypts it only at run time to fetch files.
custodia schedule org/private-repo \
--token ghp_xxxxxxxxxxxx
- →Full 5-stage security pipeline
- →OWASP Top 10 + LLM Top 10
- →Dependency CVE scan (OSV.dev)
- →Compliance mapping (Pro+)
- →Score delta vs prior month
- →PDF export (Pro+)
Pro from $39/mo · no per-seat pricing · cancel anytime
Every Attack Surface. One Tool.
Traditional security, AI-specific risks, dependency CVEs, and compliance frameworks — covered in a single scan. No separate tools, no extra config.
- →OWASP Top 10 (SQLi, XSS, CSRF)
- →Authentication & session security
- →Hardcoded secrets & API keys
- →Input validation & injection
- →Logging & monitoring gaps
- →Dependency CVE scanning (OSV.dev)
- →OWASP LLM Top 10
- →Prompt injection detection
- →Insecure AI output handling
- →AI-generated code auditing
- →Excessive agency patterns
- →Training data / PII leaks
- →NIST AI RMF (GOVERN, MAP, MEASURE)
- →EU AI Act (Art. 9, 13, 14, 52)
- →ISO 42001 AI management
- →SOC 2 TSC controls
- →CWE cross-references
- →GRC gap report
NEVER PUSH
VULNERABLE CODE AGAIN.
One YAML file. Every push and pull request automatically triggers a diff scan — only the files you changed get checked, so it's fast and doesn't burn your quota. Catch vulnerabilities before they ever reach production.
name: Custodia Security Scan
on:
push:
branches: ["main", "master"]
pull_request:
jobs:
custodia:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: contactdavidpersonal-code/custodia-scan-action@v1
with:
api-key: ${{ secrets.CUSTODIA_API_KEY }}SCAN FROM CLAUDE.
THEN TALK ABOUT IT.
Connect Custodia as an MCP server to Claude.ai, Claude Desktop, or Cursor. Ask Claude to scan any repo in plain English — findings land in the conversation so you can dig in, ask follow-up questions, and generate fixes without ever leaving your AI tool.
Dashboard → API Keys → Copy
URL: https://custodia.dev/api/mcp Auth: Bearer sfp_...
"Scan github.com/my-org/backend"
scan_repoScan any GitHub repo — public or privateget_fix_guideGenerate fix guide for findings (Pro+)check_quotaCheck remaining scan creditsClaude.ai · Claude Desktop · Cursor · VS Code Copilot · Any MCP client
LEGACY TOOLS WERE BUILT
FOR A DIFFERENT ERA.
Snyk, Semgrep, and SonarCloud were built for a different era. They match known CVEs and syntax patterns — but can't reason about your application logic, emerging vulnerability classes, or the full attack surface that matters today. Custodia covers all of it — and starts free.
| Capability | Custodia | Snyk | Semgrep | SonarCloud | GitHub GHAS |
|---|---|---|---|---|---|
| OWASP Top 10 / CVE scanning | ✓ | ✓ | ✓ | ✓ | ✓ |
| Dependency CVE scanning | ✓ | ✓ | ✓ | ~ | ✓ |
| OWASP LLM Top 10 | ✓ | ✗ | ✗ | ✗ | ✗ |
| Prompt injection detection | ✓ | ✗ | ✗ | ✗ | ✗ |
| Deep code review (behavioral patterns) | ✓ | ✗ | ✗ | ✗ | ✗ |
| EU AI Act / NIST AI RMF | ✓ | ✗ | ✗ | ✗ | ✗ |
| Monthly email security report | ✓ | ✗ | ✗ | ~ | ✗ |
| IDE agent prompt (Cursor / Copilot) | ✓ | ~ | ✗ | ✗ | ~ |
| MCP — scan from Claude.ai / Claude Desktop / Cursor | ✓ | ✗ | ✗ | ✗ | ✗ |
| Fix guide (dep bumps + AI-ready fix doc) | ✓ | ~ | ✗ | ✗ | ✗ |
| No per-seat pricing | ✓ | ✗ | ✗ | ✗ | ✗ |
| Starting price | Free | $25/dev/mo | $40/dev/mo | $10/mo | $49/dev/mo |
✓ = full support · ~ = partial/plugin · ✗ = not supported · Pricing as of April 2026. Per-seat tools priced for a team of 3.
A REAL CYBERSECURITY
EXPERT BEHIND
EVERY ACCOUNT.
Custodia is a cybersecurity firm, not just a scanner. Every paid plan includes a direct line to a credentialed cybersecurity professional — monthly video call, unlimited email support, and an expert who actually knows your stack.
Cancel anytime — your session rolls back.
YOUR AUDIT TRAIL
BUILDS ITSELF.
Hand It to Your Broker.
Every scan on a paid plan is permanently stored with a SHA-256 cryptographic fingerprint, a timestamp, and your full findings. That's a provable record that on this date, this exact codebasewas assessed against OWASP, CWE, and NIST. Cyber insurance underwriters call this “evidence of ongoing security testing.” You build it automatically just by scanning.
Point-in-time.
No ongoing trail.
Expires in 12 months.
Permanent audit trail.
OWASP + CWE + NIST.
Insurance PDF on demand.
CYBERSECURITY
THAT KEEPS UP.
FREE TO START. FOREVER.
Install the CLI. Run your first scan free. When you're ready for fix guides, monthly autopilot, and compliance reporting — upgrade in your dashboard.
Free plan is free forever · Upgrade or cancel anytime in dashboard · Compliance mapping (SOC 2, OWASP, ISO 27001, EU AI Act) included from Pro tier