GateTest pricing
Six one-time scan tiers billed per run, two subscriptions, and a contact-based Enterprise plan.
| Tier | Price | Billing | Scope | What you get |
|---|---|---|---|---|
| Quick Scan | $29 | one-time · repository | syntax, lint, secrets, codeQuality | 4 modules — syntax, linting, secrets, code quality |
| Full Scan | $99 | one-time · repository | all-applicable | The full engine — every module that applies to a repository: security, supply chain, auth, CI hardening, structure, AI review, and more. (Live-URL and WordPress modules need a deployed site; mutation + chaos ship via the GitHub Action.) Scan-only (no auto-fix — that ships at Scan + Fix $199 and above). |
| Scan + Fix | $199 | one-time · repository | all-applicable+pair-review+architecture | Everything in Full Scan, plus a second-agent pair-review critique on every fix (correctness/completeness/readability/test-coverage rubric) and a separate architecture-annotator report on codebase-shape design observations. Same PR, deeper deliverable. |
| Forensic Scan | $399 | one-time · repository | all-applicable+forensic-stack | Everything in Scan + Fix, PLUS: real AI diagnosis on every finding (no templated snippets), cross-finding attack-chain correlation (textbook session-forgery / supply-chain vectors no per-finding scanner can see), board-ready CISO report (findings mapped to OWASP Top 10 and CIS Controls v8, with a 30/60/90-day remediation plan), and a CTO-readable executive summary report. Mutation testing and chaos / fuzz pass are also available via the GitHub Action (mutation: true / chaos: true) — they need a CI runner so they ship wherever your CI runs. |
| Website Scan — Full Report | $29 | one-time · live site | web-suite | Unlocks every finding on the website scanner: full issue list, plain-English fix instructions, and the complete health-score breakdown for your site. |
| WordPress Health Check — Full Report | $19 | one-time · live site | wp-suite | Unlocks the full WordPress health report: every finding, plugin/theme risk detail, and plain-English fix instructions for your site. |
| Continuous | $49/mo | subscription | subscription-continuous | Scan every push across EVERY repo in your org — one flat $49/mo, no per-seat, no per-repo (org-flat since 2026-07-23). Unlimited deterministic push scans, plus a monthly AI-review allowance shared across the org that escalates pushes to the deeper full-suite scan while budget remains. Fix PRs are a per-scan upsell. Cancel anytime. |
| GateTest MCP | $29/mo | subscription | subscription-mcp | Hosted MCP access — use GateTest from web and mobile AI clients and locked-down machines with no local install, plus hosted scan history. The LOCAL MCP server is free with every tool ungated (2026-07-23) — this tier is for when you can't run npx. API key delivered by email when checkout completes. Cancel anytime. |
| Enterprise | contact | invoiced | same engine | custom scan volume, raised AI-review budget, priority support, invoicing on your terms |
Charged at checkout, no seats, no minimum. The engine is open source and free to run yourself; hosted runs are what is billed.
What happens after the free scan
No card for the free scan, and nothing about it changes later. Here is exactly what stays free, what a paid run adds, and what happens to a free report once it ages out.
Free, no limit on retries
The 4-module quick scan on a URL or a public repo needs no card and no account, and you can run it again any time. The CLI and the local MCP server are free permanently — every tool runs on your own machine and your own API key, not ours.
What a paid run adds
A Full Scan runs the rest of the 122-module engine instead of the free 4. Scan + Fix and Forensic add an auto-fix pull request with a regression test, a second-model review, and (Forensic only) per-finding AI diagnosis and a board-ready report. Charged per run, no seats, no subscription required.
What happens at the limit
A free scan's shareable result link works for 48 hours, then expires — nothing is deleted from your repository or account, because a free scan does not require one. Run it again and it is instant and free again; nothing is rate-limited beyond a few requests per minute, enough for a real visitor and not for a scraper.
Before you decide
Browse all 122 modules
Every check the engine runs, by category — with a page per module.
How GateTest compares
Side by side against SonarQube, Snyk, ESLint, Semgrep, CodeQL and more.
How a scan runs
What happens between checkout and the report landing in your repo.
What we do with your code
Storage, retention and our security posture — including what we are not.
Enterprise
Contact-based plans for large organisations. No fixed price.
Refund policy
What happens when a scan fails or a run does not deliver.
Already subscribed? Manage your subscription.