Endor Labs
Agentic application security platform that secures AI-generated code and open source dependencies without slowing developers.
By Endor Labs · HQ Palo Alto, USA · 4.5/5 Value-Position score (estimate)
Positioning guardrails
Best for
- Security and engineering teams that need to cut SCA and static-analysis noise so developers fix only reachable, exploitable risk.
- Organizations rolling out AI coding agents that want policy guardrails and an audit trail over agent actions, MCP servers and skills.
- Enterprises with FedRAMP, SBOM and software supply chain compliance obligations across many repositories and services.
- Platform teams adopting MCP-based developer workflows that want security checks inside the coding agent rather than after the PR.
- Companies consolidating security spend through AWS, Azure or Google Cloud marketplaces.
Ideal size: 50–2,000 contributing developers people · Scale-up or enterprise with a dedicated AppSec or product security function
Not for
- Teams with no dedicated AppSec or product security function and no appetite to run policy and triage workflows.
- Buyers who need published list pricing or self-serve paid checkout before talking to sales.
- Organizations looking for a broad SIEM, endpoint or cloud-posture platform instead of code and dependency security.
- Very small shops that only need the free local developer tier and never take a team plan.
Value metrics scorecard
Time-to-Value
1–2 weeks (guided POC)
~14 days to first production value
Total Cost of Ownership
On request
Seat-based subscription per contributing developer; no published list price. Free Developer tier plus paid Core and Pro editions and per-product SKUs quoted by sales.
Implementation Friction
2/5
Engineering + admin effort required
Value-Position score
out of 5 · model estimate
Full cost breakdown
Mandatory implementation fee
None
Seat tiers
Seats are contributing developers with one or more commits to a monitored repo in 90 days; volume discounts as contributor count grows.
Add-on costs
- Additional annual scan credits for semi-autonomous agent or other scan-intensive workflows
- Technical Success support tiers sold alongside the subscription
- Endor Outpost on-premises deployment (eligibility via sales)
Company & support
Who is behind Endor Labs, and how your team gets help once it is live.
Company
- Founded
- 2021 · 5 yrs in business
- Headquarters
- Palo Alto, USA
How you get support
- PhoneNot listed
- EmailNot listed
- Live chatNot listed
- Support portal / ticketsNot listed
- Community forumNot listed
- Help centre / docsAll plans
- Dedicated account managerPlan not stated
- In person / on-siteNot listed
- Hours
- Not recorded
- Response time
- Not stated
Product docs are public and self-serve, including the free developer tier. The pricing FAQ says several Technical Success tiers exist and customers should contact their account team; no support hours, SLA or response time are published.
“Not listed” means the vendor’s public pages don’t mention that channel, not that it is unavailable. Ask about it during evaluation.
Market position
Where Endor Labs sits against its closest alternatives. Pick any two of cost, speed, friction and buyer score, and up to 9 companies to compare.
Quadrant view
Typical annual cost × Time-to-value
The lines cross at the median of the solutions shown, so about half sit on each side of each line. A dashed ring marks an outlier pinned to the edge; hover for its value.
Companies on the chart 6 / 10
- Endor Labs
- Hyperproof
- MasterControl
- GitGuardian
- Thoropass
- Flagright
Add or change companies
Up to 10 companies including Endor Labs. Listed closest first.
Stack fit signal
Compatibility with standard B2B ecosystems.
No supported MCP path today, so it cannot be driven from an AI client.
AI & MCP readiness
What Endor Labs ships in AI, and what it asks of your ecosystem.
AI features shipped
AURI is an agentic AppSec layer that inventories coding agents, models, MCP servers and skills, enforces allow/block/human-review policy on each agent action and records every action. Endor Open Source also lists AI model governance alongside SBOM and VEX generation.
In your ecosystem
- AI connection
- Not supported
- Model key
- Not recorded
- AI usage audit
- Basic visibility
Compliance attestations
* IAPP AIGP certifies individuals, not products. It means named staff hold the credential — not that the platform does.
Bottom line
Founded in 2021 and headquartered in Palo Alto, Endor Labs sells an agentic application security platform. AURI governs AI coding agents and MCP servers, while AI SAST, reachability-based SCA, secrets detection, a package firewall and container scanning cut false positives across the SDLC. A free developer tier runs locally inside coding agents; paid Core and Pro editions are seat-based per contributing developer, sold direct and through AWS, Azure and Google Cloud marketplaces. Buyers cited include Citi, Atlassian, Rubrik, Dropbox and Zebra.
Frequently asked questions
How is Endor Labs priced?
Pricing is seat-based per contributing developer, defined as a developer who has committed to a repository monitored by Endor Labs in the last 90 days, with volume discounts as the contributor count grows. No list price is published: the free Developer tier is self-serve, while Core and Pro editions and per-product SKUs (Code, Open Source, AI Coding Agent Governance, Package Firewall, Patches, SBOM Hub) are quoted by sales. Purchases can also run through AWS, Azure or Google Cloud marketplaces.
Does Endor Labs store our source code?
No, per the pricing FAQ. Most customers use agentless scanning against GitHub, GitLab, Bitbucket or Azure DevOps; source is briefly cloned into a container in Endor's cloud and destroyed immediately after scanning. Teams can instead scan inside their own CI/CD pipelines so code stays in the runner and only results reach the dashboard, or deploy Endor Outpost to run scheduled scans entirely on their own infrastructure. Eligible customers can request Outpost for data residency or compliance reasons.
What does Endor Labs do for AI coding agents and MCP?
AURI plugs into coding agents such as Claude Code, Codex, VS Code/Copilot, Cursor and Antigravity. It inventories agents, models, MCP servers and skills, checks each agent action against policy (allow, block, or ask a human) and records every action, blocks malicious packages before install, flags leaked secrets and fixes vulnerabilities. Connection is made through the vendor's official MCP server, endorctl ai-tools mcp-server, or the CLI.
How long does implementation take?
Vendor materials describe Endor Labs as a cloud service that deploys in any customer environment within minutes, with value demonstrable within hours of deployment, and note that container scanning requires nothing installed in your cluster. Most organizations still run a guided proof of concept before rollout, so plan on roughly one to two weeks to first production value, longer if policy design or an on-premises Outpost is involved.
Which companies use Endor Labs?
Published customer stories and quotes name Citi, Atlassian, Rubrik, Dropbox, Cursor (Anysphere), Netskope, Zebra Technologies, VMware, Five9, Egnyte, Astronomer, Grip Security, Starburst, People.ai, Mysten Labs, Jellyfish and MileIQ, spanning fintech, AI and blockchain, data management, device manufacturing, security and technology.