Refuse

Name: Refuse
Brand: Refuse
Price: 5 USD

Claim this tool

Block vulnerable package installs across your dev and CI/CD

From $5/mo, billed monthly (free plan available)

Freemium Security Developer Tools CI/CD

Visit Website

Freemium Visit Website

Tracked since 2026

The Bottom Line

Updated Oct 19, 2026

Price: From $5/mo, billed monthly (free plan available). Compare plans

Key facts

Blocks vulnerable package installations across 21 ecosystems.
Offers both hosted and self-hosted deployment options.
Integrates with shell, CI/CD, and AI coding agents to prevent security risks.

Pros

Significantly enhances software supply chain security by preventing vulnerable package installations.
Supports a broad range of package managers and development environments.
Offers flexible deployment options including a free self-hosted solution and a generous free hosted tier.
Provides specific safe version suggestions when blocking vulnerable packages.
Easy to install and integrate into existing workflows (shell, CI/CD, agents).

Cons

Requires an additional step in the package installation workflow, which might introduce a slight overhead.
The hosted Pro tier with higher scan limits is planned for future release.

What is Refuse?

Refuse is an open-source shim designed to intercept package installation requests from various package managers and block those identified as vulnerable. It acts as a protective layer, ensuring that your shell, agents, and CI/CD pipelines do not inadvertently install packages with known security advisories. By routing all installation attempts through Refuse, users can prevent the introduction of security risks into their development environments and production systems. The tool supports a wide array of ecosystems, including popular package managers like npm, pip, cargo, and gem, as well as Dockerfile dependencies and GitHub Actions workflows. It offers both a hosted SaaS option with a free tier and a self-hosted solution, providing flexibility for different operational needs. Refuse is ideal for developers, security teams, and organizations looking to enhance their software supply chain security by automatically filtering out vulnerable dependencies.

Data compiled by Toolradar Pricing checked Oct 19, 2026 · How we evaluate

Source refuse.dev

Key Features

Vulnerable package blocking
Support for 21 package ecosystems (npm, pip, cargo, gem, go, composer, dotnet, etc.)
Dockerfile dependency scanning (apt, apk, dnf)
GitHub Actions workflow integration
Linux distro-specific advisory checking (Debian, Ubuntu, Alpine, Red Hat)
CLI for easy installation and configuration
Self-hosted server option (Apache-2.0 licensed Docker image)
Hosted SaaS with free tier and upgrade options

Pricing Plans

Pricing checked Oct 19, 2026. Source: refuse.dev/pricing, read Oct 19, 2026

Refuse plans and prices, checked October 2026
Plan	Price	Details
OSS / Self-host	$0 / forever	Apache-2.0 CLI + server Unlimited scans All ecosystems +1 more Show less REST API; MCP on roadmap
Hosted Free	$0 / forever	100,000 scans / 30 days Hosted MCP at mcp.refuse.dev All ecosystems +1 more Show less 90-day request logs
Hosted Pro	$5 / month	5,000,000 scans / 30 days Everything in Hosted Free Email support

Calculate your cost View full pricing

Is Refuse worth the price?

Great value

Refuse offers a very generous pricing model, with both a self-hosted and a hosted free tier at $0.

The Hosted Pro tier at $5/month for 5 million scans is exceptionally affordable, making it accessible for a wide range of users. This pricing is best for individual developers, small teams, and open-source projects looking for robust vulnerability scanning without breaking the bank.

Hidden Costs & Gotchas

Potential for overage fees if exceeding scan limits

Full Refuse pricing: every plan, hidden costs and alternatives

How Refuse's pricing compares

At $5/mo, billed monthly, Refuse is the most affordable of its 4 comparable direct competitors.

Refuse

$19

$25

$25

$30

Entry paid plan, monthly price, billed monthly. Pricing checked Oct 19, 2026.

Refuse by the numbers

Toolradar data: Refuse's entry paid plan ($5/mo, billed monthly) ranks #3 of 35 (joint) for price among the CI/CD tools with a verified entry price and no stated unit, where the median is $20/mo. As of Oct 2026.

Refuse compared with 118 CI/CD tools on Toolradar, as of Oct 2026
Metric	Refuse	Peer median	Position (1 is best)
Entry paid plan	$5/mo, billed monthly	$20/mo	#3 of 35 (joint) tools with no stated price unit, verified price
Free plan	Yes	86% have one	n/a

Each position is counted among the tools that have data for that row, as noted under it. A lower entry price ranks higher; prices are read on vendor pages and compared only with tools priced on the same basis. All CI/CD data · How we compute this. Advertising and placement fees are not inputs to any position.

Cite this: Toolradar, “Refuse by the numbers”, Oct 2026.

Reviews

Improve Your Thinking Patterns Using ChatGPT cover

$99 Free with your review

Review Refuse, get a free AI guide

Share your experience and we will send you Improve Your Thinking Patterns Using ChatGPT, free.

Write a review

Best Refuse Alternatives

Top alternatives based on features, pricing, and user needs.

View full list →

GitGuardian Freemium

Detect hardcoded secrets and exposed credentials in code and public repos

4.8

Snyk Freemium

Secure your code, dependencies, containers, and IaC from dev to production

4.5

Semgrep Freemium

Static analysis for finding bugs

4.6

Socket Freemium

Secure your dependencies and ship with confidence.

4.7

Grype Free

Vulnerability scanner for container images

CodeQL Freemium

Discover vulnerabilities across a codebase with industry-leading semantic code analysis.

See all security tools →

Still deciding?

Most buyers shortlist 2 or 3 tools before committing. Pull a side-by-side comparison or browse the full alternatives shortlist below.

All Refuse alternatives 6+ tools ranked, pricing + verdict per pick Refuse vs GitGuardian Head-to-head: features, pricing, who wins Refuse vs Snyk Head-to-head: features, pricing, who wins Refuse vs Semgrep Head-to-head: features, pricing, who wins

Explore More

Refuse FAQ

How does Refuse intercept package installations?

Refuse works by installing shims that wrap common package managers like npm, pip, and cargo. When an installation command is executed, the shim intercepts it, routes the package and version information to the Refuse backend for vulnerability checking, and only proceeds with the installation if the package is deemed safe.

What types of vulnerabilities does Refuse check for?

Refuse checks against a database of over 362,000 advisories, including malicious code, newly disclosed CVEs, and active threats. It also considers distro-specific advisories for Linux distributions, which can differ from generic CVE lookups.

Can Refuse be used within CI/CD pipelines?

Yes, Refuse is designed to integrate seamlessly into CI/CD pipelines, including GitHub Actions workflows. It checks every action and dependency used in your workflow against advisories before they are deployed or used.

What is the difference between a 'scan' and a 'package' in Refuse's pricing model?

One scan is defined as checking one (package, version) pair. For example, if your lockfile contains 1,000 dependencies, that would count as 1,000 scans. A Dockerfile installing 30 pinned packages would be 30 scans.

Does Refuse support private package registries or air-gapped environments?

Yes, for private registries or air-gapped environments, you can self-host the Refuse server. The self-hosted option ensures that no data leaves your network, providing full control over your security posture.

How does Refuse handle cases where a package is blocked?

When a vulnerable package is blocked, Refuse will refuse the installation and typically suggest a safe, non-vulnerable version of the package. This allows users to easily update their commands to install a secure alternative.

What are the infrastructure requirements for self-hosting Refuse?

Self-hosting Refuse is straightforward, requiring only Docker. The server ships as a single Docker image and can be run with a simple docker run command. By default, it uses SQLite, but it can be configured for production setups as detailed in the self-host guide.

Can Refuse be used with AI coding agents?

Yes, Refuse is designed to work with AI coding agents like Claude Code, Cursor, and Codex. Any package installation command issued by these agents, when routed through the shim, will be intercepted and checked for vulnerabilities.

How does Refuse pricing compare with other CI/CD tools?

Refuse's entry paid plan ($5/mo, billed monthly) ranks #3 of 35 (joint) for price among the CI/CD tools with a verified entry price and no stated unit, where the median is $20/mo. Prices are read on each vendor's own pricing page and compared only with tools priced on the same basis. Source: Toolradar, Oct 2026.

Source: refuse.dev

Guides & Articles

Best MCP Gateways & AI Agent Security Tools 2026

Expert guide

Best Deepfake Detection Tools 2026

Expert guide

Best AI Governance Tools 2026

Expert guide