Plans & quotas
What each plan unlocks
One subscription, the whole mlab stack (TPRM and IR self-hosted licensed separately)
The pricing here is synced across the entire mlab.sh ecosystem: your plan applies to mlab.sh, vuln.mlab.sh and risk.mlab.sh at once, not just vuln.mlab.sh. The self-hosted platforms, tprm.mlab.sh and ir.mlab.sh, each have their own license. See full pricing
| Feature | Free €0 | Pro €59 / mo | Team €149 / mo | Enterprise Custom |
|---|---|---|---|---|
| CVE intelligence: always free | ||||
| Search · detail · vendor · KEV · CVSS · latest | Unlimited | Unlimited | Unlimited | Unlimited |
| Public REST API + RSS feeds | ✓ | ✓ | ✓ | ✓ |
| One-shot /scan (deps per scan) | 40 anon · 512 signed in | 40 anon · 512 signed in | 40 anon · 512 signed in | 40 anon · 512 signed in |
| Monitoring & alerting | ||||
| Watchlists | 3 | 25 | 100 | Unlimited |
| Inbox + RSS delivery | ✓ | ✓ | ✓ | ✓ |
| Webhook (Discord / Slack / Teams) | - | ✓ | ✓ | ✓ |
| Change triggers (CVSS change · new PoC · KEV deadline) | - | ✓ | ✓ | ✓ |
| EPSS-spike trigger | - | - | ✓ | ✓ |
| SBOM monitoring | ||||
| Continuous SBOM monitoring | - | ✓ | ✓ | ✓ |
| SBOM projects | - | 10 | 50 | Unlimited |
| Team & platform | ||||
| Personal API keys | 1 | 5 | 5 | Unlimited |
Quotas reflect the live gating in the service. One-shot /scan caps at 40 dependencies for anonymous callers and 512 once signed in, on every plan.