StackHawk
Runtime API security testing inside your AI coding agent: find, fix and verify exploitable vulnerabilities before the PR opens.
By StackHawk, Inc. · 4.6/5 Value-Position score (estimate)
Positioning guardrails
Best for
- Development teams whose AI coding agents (Claude Code, Cursor, Codex, Copilot, Antigravity) should test and fix runtime vulnerabilities before a PR opens
- Security teams that need attack surface discovery, sensitive data detection and scan-coverage reporting across every app (Scale plan)
- Teams replacing legacy DAST with a CI/CD-native API security testing workflow alongside GitHub, GitLab, Jenkins and Snyk
- Small teams wanting unlimited apps at a flat $10 per user per month with a 14-day free trial
Ideal size: 5-1,000+ developers people · Shift-left engineering org with CI/CD pipelines and AI coding agents already in use
Not for
- Teams that only need SAST/SCA code scanning; StackHawk partners with Semgrep, Snyk and Endor Labs for static analysis
- Organizations without a running or staging environment, since StackHawk tests running apps and APIs at runtime
- Buyers wanting an outsourced penetration-testing or managed security service
- Air-gapped or on-premises-only deployments; the platform runs on AWS
Value metrics scorecard
Time-to-Value
Same day; install takes minutes
~1 days to first production value
Total Cost of Ownership
$3,000/yr
Starts at $120 · Wingman: $10/user/month with unlimited apps and 50 scans/user/month, 14-day free trial. Scale: custom pricing scoped by team size with unlimited apps and unlimited agentic scans.
Implementation Friction
2/5
Engineering + admin effort required
Value-Position score
out of 5 · model estimate
Full cost breakdown
Mandatory implementation fee
None
Seat tiers
Wingman is priced per user at $10/user/month with no minimum stated; Scale is scoped per team.
Add-on costs
- Additional scans can be purchased after hitting the 50 scans/user/month Wingman allowance, or teams can upgrade to Scale, which removes scan limits.
Company & support
Who is behind StackHawk, and how your team gets help once it is live.
Company
- Founded
- Not recorded
- Headquarters
- Not recorded
How you get support
- PhoneNot listed
- EmailNot listed
- Live chatNot listed
- Support portal / ticketsNot listed
- Community forumNot listed
- Help centre / docsPlan not stated
- Dedicated account managerNot listed
- In person / on-siteNot listed
- Hours
- Not recorded
- Response time
- Not stated
The contact page routes Support separately from Sales and Jobs. The plan comparison lists Standard support on Wingman and Enterprise support (teams, roles, SSO) on Scale. Product pages link to documentation, but no support hours or SLA are published.
“Not listed” means the vendor’s public pages don’t mention that channel, not that it is unavailable. Ask about it during evaluation.
Market position
Where StackHawk sits against its closest alternatives. Pick any two of cost, speed, friction and buyer score, and up to 9 companies to compare.
Quadrant view
Typical annual cost × Time-to-value
The lines cross at the median of the solutions shown, so about half sit on each side of each line. A dashed ring marks an outlier pinned to the edge; hover for its value.
Companies on the chart 6 / 10
- StackHawk
- Cobalt
- NordLayer
- Afi
- Vanta
- Contrast Security
Add or change companies
Up to 10 companies including StackHawk. Listed closest first.
Stack fit signal
Compatibility with standard B2B ecosystems.
Ships an official MCP server. Connects to Claude Code, Claude Desktop, ChatGPT connectors and Cursor out of the box.
AI & MCP readiness
What StackHawk ships in AI, and what it asks of your ecosystem.
AI features shipped
StackHawk agent skills (HawkScan and the API skill) run DAST from inside Claude Code, Cursor, Codex, GitHub Copilot and Antigravity; the agent remediates findings in the codebase and a rescan verifies the fix. The MCP server accepts natural-language commands such as "scan my API for vulnerabilities".
In your ecosystem
- AI connection
- Official MCP server
- Model key
- Not recorded
- AI usage audit
- Not recorded
Compliance attestations
* IAPP AIGP certifies individuals, not products. It means named staff hold the credential — not that the platform does.
Bottom line
StackHawk is a developer-first dynamic application security testing (DAST) tool. Its agent skills install into Claude Code, Cursor, Codex, GitHub Copilot and Antigravity, so exploitable runtime vulnerabilities are found, fixed in the codebase and rescanned before a PR opens. Wingman costs $10/user/month with unlimited apps and 50 scans/user/month; Scale adds attack surface discovery and coverage reporting. StackHawk completes an annual SOC 2 Type II audit.
Frequently asked questions
What does StackHawk actually do?
StackHawk runs runtime (DAST) security tests against your running application and APIs, surfaces only the issues that are actually exploitable, has your AI coding agent remediate them in the codebase, and then rescans to verify the fix. It ships as agent skills (HawkScan and an API skill) inside Claude Code, Cursor, Codex, GitHub Copilot and Antigravity, firing post-commit and pre-PR so the commit that reaches CI is already attested as clean.
How much does StackHawk cost?
Wingman is $10 per user per month with unlimited apps and 50 scans per user per month, and includes a 14-day free trial with no credit card. If you routinely exceed the scan allowance you can buy extra scans or move to Scale, which is custom-priced by team size and includes unlimited apps and unlimited agentic scans. Existing apps, findings and attestations carry over from Wingman to Scale.
Which AI coding agents does StackHawk support?
Claude Code, Cursor, Codex, GitHub Copilot and Antigravity today. Installation is per-agent (for example, Copilot auto-discovers the skills from your repository), and putting StackHawk skills in the repo means every developer gets the same security workflow regardless of which agent they use.
Does StackHawk have an MCP server?
Yes. StackHawk publishes an open-source MCP server built on Anthropic's Model Context Protocol, available to existing customers. You install uv, add your STACKHAWK_API_KEY to mcp.json, point the server at uvx stackhawk-mcp, and then ask your assistant in natural language to scan an application or API endpoints.
What compliance certifications does StackHawk hold?
StackHawk states that it undergoes an annual ISAE3402 SOC 2 Type II audit and at least yearly penetration tests, with sensitive customer data encrypted at rest using AES-256 and in transit with TLS 1.2 or better. Its security page also covers access control, logging, incident response and a 72-hour breach notification commitment. The site does not claim ISO 27001, HIPAA, FedRAMP or ISO 42001.
What support is included with each plan?
The plan comparison lists Standard support on Wingman and Enterprise support on Scale, where Scale also adds teams, roles and SSO. The contact page routes support separately from sales and jobs. No support hours, response-time SLA or named success-manager commitment is published on the vendor site.