Kusari

What Kusari is

Kusari is a software supply chain security platform for developers and security teams managing risk across repositories, images and pipelines. Its Kusari Trust Fabric builds a continuously updated knowledge graph from source code and build artifacts, with information enriched at each node. Kusari Score weighs technical severity alongside reachability, exploitability, potential blast radius, effort to fix, ownership and license. The platform accepts source and build artifacts, CycloneDX and SPDX software bills of materials, VEX data and output from existing scanners.

Kusari Inspector reviews pull requests in GitHub, GitLab and the CLI, then provides a merge decision and a fix. Its checks cover vulnerabilities, transitive dependencies, credentials and secrets, typosquatted packages, licenses, unmaintained components, code weaknesses, and pipeline or image configuration. Reviews can include up to 2,000 dependency changes, with up to 1,000 high-priority changes examined in depth. Kusari lists integrations with GitHub, GitLab, Jenkins, Azure DevOps, CircleCI, Jira, ServiceNow, Slack and Microsoft Teams. The company says changed files are not stored, analysis input is deleted when processing is complete, and data is encrypted in transit and at rest. Kusari is SOC 2 Type II compliant and contributes to GUAC, which it co-created.

Who it suits

Kusari suits developers, DevSecOps teams and security teams that need to assess software supply chain risk across repositories, images and pipelines. Its pull request reviews and integration list may fit teams already working with the supported development, ticketing and communication services.

Limits

The free plan covers unlimited public repositories and one private repository across multiple GitHub organizations. Inspector analyzes pull requests with up to 2,000 total dependency changes and examines up to 1,000 high-priority changes in depth.

Getting started

1. Visit the Kusari website.
2. Choose the Free plan or review the paid plans, including the 30-day Starter Team offer.
3. Use Kusari through its web or API platforms.
4. Connect relevant repositories and pipelines through the listed integrations.

Verdict

Choose Kusari if your team needs a continuously updated view of software components and pull request reviews that consider several types of supply chain risk. The free plan is limited to one private repository, and teams needing more Inspector review capacity or self-hosted deployment should consider those limits before choosing it.