Freedom251 › Software Supply Chain Security Software
CRACI
What CRACI is
CRACI provides managed CI runners that record software dependencies during builds and monitor them for vulnerabilities. Its build-time SBOMs include transitive dependencies and declared licenses, with export in CycloneDX or SPDX formats. CRACI reevaluates monitored SBOMs as new vulnerabilities are published and supports triage, fix routing and VEX. GitHub Actions is the supported CI integration today; other CI systems are roadmap items. The service records packages from npm, PyPI, RubyGems, Cargo, Go, Nix, OCI registries, Debian, Ubuntu, Alpine, and Git or other source downloads. Jobs use an egress policy validated before startup that fails closed, and policy gates can stop builds in real time. Managed runners are Linux on x86-64 and ARM64; Windows, macOS and on-prem runners are planned. CRACI says it processes source code during builds without storing it, and build data is hosted in Europe. Its API returns SBOMs, network traces and provenance, though the pricing FAQ says there is no report export. Pro has no monthly fee and meters build time at $0.002 /vCPU-minute.
Who it suits
CRACI describes its intended users as companies that build or ship software, including startups, SaaS providers, enterprises, agencies and hardware makers with embedded code. It suits teams using GitHub Actions that need dependency and vulnerability monitoring.
What it does well
- SBOMs include transitive dependencies and licenses
- Exports available in CycloneDX or SPDX
- Policy gates can stop builds in real time
- Linux runners available on x86-64 and ARM64
- Build data is hosted in Europe
What to know first
- GitHub Actions is the only supported CI integration today
- Windows, macOS and on-prem runners are roadmap items
- No report export is available
- Build time is metered at $0.002 /vCPU-minute
Limits
Pro is limited to 1–20 users and meters build time at $0.002 /vCPU-minute, billed per second. Its managed runners are Linux on x86-64 and ARM64, and GitHub Actions is the supported CI integration today.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Pro | $0.002 /vCPU-minute; build minutes are metered per second · 1–20 users · no monthly fee · no per-SBOM charges · standard support | Free |
| Enterprise | Custom; annual contract · 20+ users · EU data residency · custom data retention · SAML & SSO · ISO 27001 · priority support | On request |
As craci.com lists them, read 5 Oct 2026. The maker's own page has the final word.
Getting started
- Open https://craci.com/.
- Choose the Pro plan, which has no monthly fee and meters build minutes, or contact CRACI about Enterprise pricing.
- Connect a GitHub Actions workflow, the supported CI integration.
- Run builds on a managed Linux x86-64 or ARM64 runner.
- Review SBOMs, network traces, and provenance through the API.
Verdict
CRACI combines managed Linux CI runners with dependency capture, vulnerability monitoring and policy gates. Its current CI integration is GitHub Actions, and build time is metered even though Pro has no monthly fee.
Questions
Does CRACI have a free plan?
No. Pro has no monthly fee, but build minutes are metered at $0.002 /vCPU-minute.
What does the Pro plan cost?
Pro is billed at $0.002 /vCPU-minute, with build minutes metered per second. It has no monthly fee and no per-SBOM charges.
Which CI systems and runners does CRACI support?
GitHub Actions is the supported CI integration today. Managed runners are Linux on x86-64 and ARM64; Windows, macOS, on-prem runners, and other CI systems are roadmap items.
Can CRACI export SBOMs?
Build-time SBOMs can be exported in CycloneDX or SPDX formats. CRACI's pricing FAQ says there is no report export.
Where is build data hosted, and does CRACI store source code?
CRACI says build data is hosted in Europe and that it processes source code during builds without storing it.
What does Enterprise include?
Enterprise has custom pricing and an annual contract. It includes 20+ users, EU data residency, custom data retention, SAML and SSO, ISO 27001, and priority support.
Facts from CRACI's own pages
- API
- The API returns SBOMs, network traces and provenance; the pricing FAQ says there is no report export. · craci.com, 5 Oct 2026
- Code and data
- CRACI processes source code during builds and says it does not store it; build data is hosted in Europe. · craci.com, 5 Oct 2026
- Founded
- 2025 · craci.com, 28 Sept 2026
- Headquarters
- Helsinki, Finland · craci.com, 28 Sept 2026
- Integration
- GitHub Actions is the supported CI integration today; other CI systems are on the roadmap. · craci.com, 5 Oct 2026
- Intended users
- CRACI says it is for companies that build or ship software, including startups, SaaS providers, enterprises, agencies and hardware makers with embedded code. · craci.com, 5 Oct 2026
- Package sources
- CRACI records packages from npm, PyPI, RubyGems, Cargo, Go, Nix and OCI registries, plus Debian, Ubuntu and Alpine repositories and Git or other source downloads. · craci.com, 5 Oct 2026
- Policy controls
- Jobs run under an egress policy validated before startup that fails closed, and policy gates can stop builds in real time. · craci.com, 5 Oct 2026
- Product
- CRACI provides managed CI runners that record software dependencies during builds and monitor them for vulnerabilities. · craci.com, 5 Oct 2026
- Runners
- Available managed runners are Linux on x86-64 and ARM64; Windows, macOS and on-prem runners are listed as roadmap items. · craci.com, 5 Oct 2026
- SBOMs
- It records build-time SBOMs with transitive dependencies and declared licenses, exportable in CycloneDX or SPDX formats. · craci.com, 5 Oct 2026
- Security certification
- CRACI Corporation Oy says its information security management system is certified to ISO/IEC 27001. · craci.com, 5 Oct 2026
- Support
- The Pro plan includes standard support, while Enterprise includes priority support. · craci.com, 5 Oct 2026
- Vulnerability tracking
- CRACI continuously reevaluates monitored SBOMs as new vulnerabilities are published and supports triage, fix routing, and VEX. · craci.com, 5 Oct 2026