Pricing
The CLI is free forever. Pay when you want it to keep watching.
A target is one MCP server URL or one stdio package you have verified. Prices in GBP, billed monthly, cancel any time. VAT added where it applies.
Free
For your own server, now and then
£0forever
Install the CLI- Open-source CLI, unlimited local scans, all passive checks
- 1 hosted target, 3 scans a month
- Public badge and report page
- SARIF and JSON output
- Not included: No scheduled re-scans, no private reports
Team
Ship weekly without reopening old holes
£49per month
Start Team- 5 targets, unlimited scans
- Weekly scheduled re-scans with change alerts
- Active checks with scope control, as they ship (coming soon)
- GitHub Action with fail-on severity gate
- Private reports, 5 seats, email alerts
Business
For teams answering security questionnaires
£199per month
Start Business- 20 targets, daily re-scans
- Evidence export mapped to OWASP items and questionnaire controls
- Hosted stdio package sandbox runs (coming soon)
- 15 seats, priority on new checks, Slack alerts
Enterprise
For larger estates and procurement
Customannual
Contact us- Targets and seats sized to your estate
- Annual invoicing and volume pricing
- Data processing agreement and help with security questionnaires
- Custom checks and integrations, scoped with you
Compare plans
| What you get | Free | Team | Business | Enterprise |
|---|---|---|---|---|
| Verified targets | 1 | 5 | 20 | Custom |
| Hosted scans | 3 / month | Unlimited, weekly schedule | Unlimited, daily schedule | Unlimited, schedule you choose |
| Passive checks (16) | Included | Included | Included | Included |
| Active checks (8, coming soon) | CLI only | With scope control | With scope control | With scope control |
| Stdio package sandbox (coming soon) | Local | Local | Hosted | Hosted |
| Reports | Public | Private | Private + evidence export | Private + evidence export |
| Evidence retention | 30 days | 12 months | 24 months | Agreed in contract |
| Seats | 1 | 5 | 15 | Custom |
Questions before you pay
Do I need to prove I own the server?
Yes, on every plan including Free. A DNS TXT record you publish at _mcpprobe.<host>, or local verification for stdio servers you run yourself. Scans stop if verification lapses.
What counts as a target?
One MCP endpoint URL or one stdio package. Staging and production are two targets.
Do you send my tool descriptions to a third-party model?
Not by default. Passive checks are rule-based. The optional LLM judge for tool-description poisoning is off unless you turn it on, and the scanning policy names the provider when you do.
Where is my data processed and for how long?
London (AWS eu-west-2). Evidence is kept for the retention period of your plan, then deleted. Authorisation records are kept for six years as a legal record.
We need more than 20 targets, SSO or annual invoicing.
That is the Enterprise plan. Write to hello@mcpprobe.tech with your team size and the number of servers, and we will price it with you.
Can I cancel?
Any time from Billing. Your targets drop to the Free limits at the end of the period; nothing is deleted for 30 days.
Open source, startup or education?
Public open-source MCP servers get Team free. Write to hello@mcpprobe.tech with the repo link.