Overview
Posture overview
Posture score, severity mix, and the top of the queue.
Parse supported manifests. Review what matters first.
Perpensa inventories nine shipped parser families, matches advisories, and ranks the resulting findings and update candidates—so AppSec and platform share one review queue.
No credit card. Rule-based categories on every plan. Perpensa Rank included on Pro and Team.
GitHub, GitLab, Bitbucket, Forgejo/Giteanpm, PyPI, Go, Maven, Docker, Cargo, Composer, NuGet, RubyGemsOSV + EPSS/KEV + SBOM
Parser families shipped in this version
Product
See the queue your team will live in
Current captures of the posture overview, risk-ranked queue, and matched findings. Sign in to open those screens in your workspace.
Try for freeQueue
Update queue
Risk-ranked remediations with KEV and exploit signals.
Mobile-ready triage
Queue and detail stay readable at ~390px. Primary actions stay thumb-friendly so on-call can act without a laptop.
Try for freeFindings
Findings
Triage open advisories with KEV, exploit, and EPSS signals.
Risk over volume
Not another upgrade bot
Renovate and Dependabot keep dependencies fresh. Perpensa tells you which findings and update candidates deserve review, why, and what to do first—with a shared queue and evidence for AppSec.
Risk over volume
A KEV-listed or high-exploit-probability finding before forty hygiene patches. Deterministic score first—always auditable.
Brain, not another arm
Renovate is excellent at automation. Perpensa is the triage layer AppSec and platform share.
Evidence, not more noise
Findings, digests, CycloneDX/SPDX exports, and an audit trail — prove you are watching, not only updating.
Upgrade bots
Perpensa
Keeps packages fresh through automated updates
Ranks the queue by risk (CVE/severity, EPSS, KEV/public exploit, direct/transitive)
Update volume follows repository rules
Prioritised queue + digests
Lives in each repo’s config
One org cockpit: findings, inventory, SBOM, policies
Changes dependency files in connected repositories
Read-first scan; public watch without push rights
Works alongside Renovate. Keep the bot for cadence and automerge; use Perpensa as the risk brain — triage, digests, and SBOM. Updates stay queued for review, and Perpensa does not claim to replace Renovate's ecosystem depth.
Features
Built for teams who can't afford surprise outages
Stop sorting by severity alone. Perpensa turns supported dependency evidence into a prioritized review queue, scored by risk and shaped by policy. Perpensa Rank refines the order on Pro and Team.
Supported manifest inventory
Parse npm, PyPI, Go, Maven/Gradle, Cargo, Composer, NuGet, and Bundler lock data. Dockerfile base images get end-of-life and pinning checks, with no image CVE scan. Other package formats are not scanned yet.
Auditable risk scores
Rank matched advisories with deterministic severity, EPSS, KEV/public-exploit, and direct/transitive inputs. Every factor remains visible.
Perpensa Rank
On Pro and Team, Perpensa Rank refines the order of the queue using dependency and vulnerability information. Review the reasons behind each priority before acting.
API & MCP
On Pro and Team, scoped, expiring API & MCP accesses let CI and AI assistants read existing results, evaluate a CI gate, and request exports. They cannot start scans or change findings.
Policy engine
Configure transitive-medium suppression and alert floors. Policy actions are recorded for review.
Nine parser families, one queue
npm and compatible JS lockfiles, PyPI lock and requirement files, Go modules, Maven/Gradle, Cargo.lock, composer.lock / composer.json, NuGet lock/csproj, and Gemfile.lock. Dockerfile base images: end-of-life and pinning checks only.
Digest previews and delivery
Build ranked email and Slack previews. Delivery requires a configured provider or per-org webhook; scheduled multi-tenant Slack remains store-only.
SBOM & audit-ready
Export CycloneDX or SPDX SBOMs, findings and updates CSV, and a compliance bundle. Scan, AI, policy, and digest actions produce audit events.
How it works
From connect to digest in one continuous loop
Connect repositories, scan supported manifests, then review the queue, apply policy, and preview delivery on your own workspace.
From repository to review
Connect your repos
Connect GitHub, GitLab, Bitbucket, Forgejo, or Gitea credentials. Public GitHub watches stay read-only.
Parse supported files
Supported lockfiles, manifests, and Dockerfile FROM lines feed OSV matching.
Score + policy
Transparent risk score (0–100), then deterministic policies such as transitive-medium suppression and alert floors.
Refine the order
Perpensa Rank refines the order within Fix now, Plan and Monitor on Pro and Team. Starter uses rules and declared context.
Review & notify
Review the queue, leave advice unapplied or ignore it, and preview or deliver digests through configured channels.
Rules set the category. Perpensa Rank refines the order.
Perpensa helps your team prioritize work alongside the transparent risk score. Review the recommendations and decide which actions to take.
How priority is built
Deterministic risk (0–100)
Severity, EPSS, KEV/public exploit, and direct/transitive dependency status.
Relevant context
Minimized vulnerability facts and declared environment context refine the order inside each category. Your source code is not sent.
Priority advice
Perpensa Rank is included on Pro and Team. Starter uses rule-based prioritization. Unavailable or uncertain refinements keep the deterministic rank.
You decide
Review the facts and choose what to fix. Optional explanations and contextual questions do not change the score or execute actions.
Risk scores stay auditable. Fix now, Plan and Monitor remain rule-based categories. Perpensa Rank refines their order; explanations cite available public sources.
Pricing
Straightforward plans for the review queue
Monthly price per organization. Start free, then pick the pack that matches your people and tracked branches.
Starter
For someone trying the queue on a few repos.
Free- 1 person
- 5 tracked branches
- 1 org-wide scan / 24h + weekly auto scan
- Custom schedules require Pro
- Rule-based prioritization
- Weekly email digest
- Slack digests require Pro
- Applications across repositories
- No API & MCP access
- CycloneDX, SPDX, and CSV exports
Pro
For engineers and small teams managing dependencies.
$49/ month- 10 people
- 75 tracked branches
- Auto scan every day, adjustable up to hourly, with a custom digest schedule
- Manual and webhook scan jobs
- Perpensa Rank · AI triage included
- Daily digest and optional email alerts
- Slack digests
- Applications across repositories
- 5 active API & MCP accesses
- CycloneDX, SPDX, and CSV exports
Interested in Pro? Paid upgrades are not available yet.
Team
For a larger account that needs several people on one tenant.
$149/ month- Unlimited people
- 300 tracked branches
- Auto scan every day, adjustable up to hourly, with a custom digest schedule
- Manual and webhook scan jobs
- Perpensa Rank · AI triage included
- Daily digest and optional email alerts
- Slack digests
- Applications across repositories
- 25 active API & MCP accesses
- CycloneDX, SPDX, and CSV exports
- Shared organization for multiple accounts
Interested in Team? Paid upgrades are not available yet.
Shipped workflow
What the current product helps teams review
Shared triage
Rules set the category; Perpensa Rank refines the order
Review matched advisories in one risk-ranked queue instead of treating every available update as equally urgent.
Conditional delivery
Stored previews remain visible in-product
Generate email or Slack previews, then deliver only when the corresponding provider or per-org webhook is configured.
Explicit handoff
Recommended updates stay queued for team review
Review recommended version changes in the queue. Your team applies updates and verifies the result in its repositories.
Explore the evidence before choosing an action
Sign in with GitHub to open a workspace—risk-ranked queue, findings, exports, policies, and Perpensa Rank on paid plans.
Try for freeAuditable scores. Perpensa Rank helps Pro and Team prioritize dependencies using their versions and vulnerability information.