Pricing
Pay for upgrades that pass, not attempts.
Every plan runs the same upgrade in Token Factory Sandboxes: tests green, re-audit clean, one draft PR. Scanning is free on all of them. What changes is how many repositories and how many fixes a month.
Free
Scan anything you can see. Fixing is where the money starts.
$0
forever
- Public repositories
- 5 fix runs a month, then it stops until next month
- Unlimited scanning and advisory detection
- At most one draft PR per request
- Handoff card on every issue
Solo
One person, a shelf of side projects, and a Dependabot queue nobody is reading.
$15
per month, billed yearly
- 20 private repositories
- 40 fix runs a month, then $1.00 each
- Watch mode on every repository
- Advisory and migration guide research
- Tests run before any PR exists
Team
Most teamsA working team's repositories, upgraded and tested before anyone opens the PR.
$49
per month, billed yearly
- 100 private repositories
- 150 fix runs a month, then $1.00 each
- The Mill: live runs and audit log
- Managed Token Factory Sandboxes
- Tavily research included
- Cost by repository and package
Scale
A fleet you cannot read through, and a security backlog you would like to stop reading about.
$165
per month, billed yearly
- 1000 private repositories
- 500 fix runs a month, then $0.75 each
- Everything in Team
- Priority in the run queue
- Spend and margin reporting
Enterprise
Unlimited repositories, your own Nebius endpoints, Nemotron tuned on your codebase, zero data retention, and a named engineer.
Or run it yourself. Rivet is MIT licensed and deploys as three containers against your own Postgres, with your own GitHub App and your own Nebius key, so none of your source code passes through us. Self-hosting.
Estimate
What a month of upgrades costs.
Drag to your upgrade volume. Scanning is free; these are the runs that actually fix something.
Doing it yourself
$13.00
100 runs at $0.13, straight to Nebius and Tavily
Team
$49.00
$49.00 a month, billed yearly, 150 fix runs included.
Scanning is free and unmetered on every plan. Only a fix run counts.
Compare
Side by side.
| Feature | Free | Solo | Team | Scale | Enterprise |
|---|---|---|---|---|---|
| Scanning and detection | Unlimited | Unlimited | Unlimited | Unlimited | Unlimited |
| Private repositories | Public only | 20 | 100 | 1000 | Unlimited |
| Fix runs per month | 5 | 40 | 150 | 500 | Custom |
| Past the allowance | Hard stop | $1.00 / run | $1.00 / run | $0.75 / run | Custom |
| Sandbox attempts per upgrade | 3 | 3 | 3 | 3 | Up to 5 |
| Re-audit before PR | Yes | Yes | Yes | Yes | Yes |
| Planner and reviewer | Nemotron Super | Nemotron Super | Nemotron Super | Nemotron Super | Super or Ultra |
| Code editing loop | Nemotron Lightning | Nemotron Lightning | Nemotron Lightning | Nemotron Lightning | Lightning or tuned |
| The Mill dashboard | Full | Full | Full | Full | Full |
| Data retention | 30 days | 30 days | 30 days | 30 days | Zero |
| Support | GitHub issues | Named engineer |
FAQ
Questions maintainers ask first.
Dependabot and similar bots change the version and stop. Rivet starts where they stop: it reads the advisory and the migration guide, edits your code for breaking changes, runs your tests and re-audits in a sandbox before anything reaches GitHub.
Start with one repository.
Scan it first, that needs nothing from you. Install Rivet when you want the advisories fixed, pick the repositories it may act on, and read the draft pull request it hands back.
Draft pull requests only. Rivet never merges anything.