attestd Pricing 2026

attestd is a freemium security tool that offers 6 key features including risk_state: NVD-derived vulnerability classification (none → critical), supply_chain.compromised: malicious-publish flag independent of CVE history, typosquat: package-name integrity including AI-hallucinated package names. attestd is a software-risk API designed to be called by CI/CD pipelines and by AI coding agents, which is a narrower and more interesting brief than a general vulnerability scanner. One request against a package name and version returns three signals that the company insists are independent by design: risk_state, an NVD-derived vulnerability classification with values from none through critical; supply_chain.compromised, a malicious-publish flag that is deliberately not derived from CVE history, so a package can return no known vulnerabilities and still be flagged as compromised; and typosquat, a package-name integrity check that catches both classic typosquats and names an LLM invented that never existed. That third signal is the one built specifically for the agent era — a coding agent that hallucinates a dependency name will happily install whatever squatter registered it, and a scanner that only scores known-good packages misses the failure mode entirely. The design principle stated throughout is determinism: NVD, CISA KEV and OSV all publish machine-readable data, but none of them yield a single condition a pipeline can branch on without interpretation, so attestd does the normalisation and returns something a script can act on. No repository or code access is required, there is a Python SDK, and the free tier is genuinely usable for evaluation and personal automation.

✅ attestd is a good choice if you need:

• •risk_state: NVD-derived vulnerability classification (none → critical)
• •supply_chain.compromised: malicious-publish flag independent of CVE history
• •typosquat: package-name integrity including AI-hallucinated package names
• •No code or repository access required
• •Python SDK and a documented curl quickstart

💡 Value Assessment

With a free tier available, attestd is an easy recommendation for anyone looking to try security tools without financial commitment. The paid plans offer good value for power users who need the additional features and higher usage limits.