Perpensa
Risk over volume · shared dependency triage

Risk before volume. Review what matters first.

Perpensa scans your dependency manifests and lockfiles, matches advisories with exploit signals, and ranks findings and update candidates—so AppSec and platform share one review queue.

Try for freeSee Perpensa Rank

No credit card. Rule-based categories on every plan. Perpensa Rank included on Pro and Team.

GitHub, GitLab, Bitbucket, Forgejo/Giteanpm, PyPI, Go, Maven, Docker, Cargo, Composer, NuGet, RubyGemsOSV + EPSS/KEV + SBOM
perpensa.app
Zoomed Update queue showing Fix now, Plan, and Monitor summary cards and the top Customer portal updates (jquery, ejs, typeorm, and y18n) ordered by rank

10 supported ecosystems and manifest families

  • LuaRocks inventory only
  • npm
  • PyPI
  • Docker EOL & pinning
  • Go modules
  • Maven / Gradle
  • Cargo / crates.io
  • Composer
  • NuGet
  • RubyGems

Product

See the queue your team will live in

Current captures of the posture overview, risk-ranked queue, and matched findings, plus the SBOM inventory. Sign in to open those screens in your workspace.

Try for free

01 · Overview

Posture overview

Posture score, severity mix, and the top of the queue.

perpensa.app
Perpensa posture overview with a score gauge, severity mix, and top of queue

02 · Queue

Update queue

Risk-ranked remediations with KEV and exploit signals.

perpensa.app
Update queue ordered by rank with Fix now, Plan, and Monitor summary cards, filters, and review actions
Perpensa update queue on a mobile viewport

Mobile-ready triage

Queue and detail stay readable at ~390px. Primary actions stay thumb-friendly so on-call can act without a laptop.

Try for free

03 · Findings

Findings

Triage open advisories with KEV, exploit, and EPSS signals.

  • Grouped by application and environment with live search and filters
  • Severity, EPSS probability when available, and KEV badges for known exploited vulnerabilities
  • Side-by-side detail drawer to inspect evidence or accept risk
perpensa.app
Findings triage view showing 292 open advisories across Fix now, Plan, and Monitor with rank, KEV, and EPSS signals

04 · SBOM inventory

Inspect every component and export CycloneDX or SPDX

Inspect every direct, transitive, and base-image component across your applications with advisory counts, recommended target versions, and one-click CycloneDX or SPDX exports.

  • Grouped by repository source or manifest across your applications and environments
  • Filter by ecosystem, direct vs transitive, advisories, and CISA KEV
  • One-click CycloneDX JSON and SPDX JSON SBOM exports
perpensa.app
SBOM inventory view showing 981 components across npm and Docker with direct and transitive dependency scope, open advisory counts, and CycloneDX or SPDX export

Risk over volume

Not another upgrade bot

Renovate and Dependabot keep dependencies fresh. Perpensa tells you which findings and update candidates deserve review, why, and what to do first—with a shared queue and evidence for AppSec.

Risk over volume

A KEV-listed or high-exploit-probability finding before forty hygiene patches. Deterministic score first—always auditable.

Shared triage, not another bot

Renovate is excellent at automation. Perpensa is the triage layer AppSec and platform share.

Evidence, not more noise

Findings, digests, CycloneDX/SPDX exports, and an audit trail — prove you are watching, not only updating.

Upgrade bots
Perpensa

  • Keeps packages fresh through automated updates

    Ranks the queue by risk (CVE/severity, EPSS, KEV/public exploit, direct/transitive)

  • Update volume follows repository rules

    Prioritised queue + digests

  • Lives in each repo’s config

    One org cockpit: findings, inventory, SBOM, policies

  • Changes dependency files in connected repositories

    Read-only repository scan; track public GitHub repos with no write access

Works alongside Renovate. Keep the bot for cadence and automerge; use Perpensa for risk prioritization — triage, digests, and SBOM. Updates stay queued for review, and Perpensa does not claim to replace Renovate's ecosystem depth.

Try for freeSee product surface

Features

Built for teams who can't afford surprise outages

Stop sorting by severity alone. Perpensa turns supported dependency evidence into a prioritized review queue, scored by risk and shaped by policy. Perpensa Rank refines the order on Pro and Team.

  • Supported manifest inventory

    Parse npm, PyPI, Go, Maven/Gradle, Cargo, Composer, NuGet, and Bundler lock data. Dockerfile base images get end-of-life and pinning checks, with no image CVE scan. Other package formats are not scanned yet.

  • Auditable risk scores

    Rank matched advisories with deterministic severity, EPSS, KEV/public-exploit, and direct/transitive inputs. Every factor remains visible.

  • Perpensa Rank

    On Pro and Team, Perpensa Rank refines the order of the queue using dependency and vulnerability information. Review the reasons behind each priority before acting.

  • API & MCP

    On Pro and Team, scoped, expiring API & MCP accesses let CI and AI assistants read existing results, evaluate a CI gate, and request exports. They cannot start scans or change findings.

  • Policy engine

    Quiet medium-severity transitive findings and set minimum alert severity thresholds. Policy actions are recorded for review.

  • Application & environment context

    Organize repositories by application and Production or Non-production environment. Shared sources are scanned once while keeping per-environment risk priorities.

  • Digest previews and delivery

    Preview ranked email and Slack digests in-app. Send Slack digests on demand through your organization webhook (scheduled Slack delivery is not automatic yet), and deliver scheduled email digests through personal notification subscriptions.

  • SBOM & audit-ready

    Export CycloneDX or SPDX SBOMs, findings and updates CSV, and a compliance bundle. Scan, AI, policy, and digest actions produce audit events.

How it works

From connect to digest in one continuous loop

Connect repositories, scan supported manifests, then review the queue, apply policy, and preview delivery on your own workspace.

From repository to review

4 steps
  1. 01

    Connect & scan

    Connect GitHub, GitLab, Bitbucket, Forgejo, or Gitea in read-only mode, or track a public GitHub repository. Supported manifests, lockfiles, and Dockerfile FROM lines are parsed automatically.

  2. 02

    Score + policy

    Transparent risk score (0–100), then deterministic policies that quiet medium-severity transitive findings and apply alert floors.

  3. 03

    Refine the order

    Rules set the category. Perpensa Rank refines the order within Fix now, Plan and Monitor on Pro and Team. The adjustment stays bounded.

  4. 04

    Review & notify

    Review the queue, leave advice unapplied or ignore it, and preview or deliver digests through configured channels.

Product guarantees

Built for engineering reality: what stays in your control

  • Shared triage

    Rules set the category; Perpensa Rank refines the order

    Review matched advisories in one risk-ranked queue instead of treating every available update as equally urgent.

  • Conditional delivery

    Stored previews remain visible in-product

    Generate email or Slack previews, then deliver only when the corresponding provider or per-org webhook is configured.

  • Explicit handoff

    Recommended updates stay queued for team review

    Review recommended version changes in the queue. Your team applies updates and verifies the result in its repositories.

Perpensa Rank

Rules set the category. Perpensa Rank refines the order.

Perpensa helps your team prioritize work alongside the transparent risk score. Review the recommendations and decide which actions to take.

Before and after Perpensa Rank

Illustrative example · Fix now (±30 max)

Before · Rule-based order

Fix now

  1. #01

    @acme/admin-report 1.4.0 → 1.4.2

    Internal admin · Production (+8)

    Critical · RCE · Direct · EPSS 33%

    Rules 69

  2. #02

    @acme/batch-worker 2.1.0 → 2.1.5

    Backoffice · Production (+8)

    Critical · SQLi · Direct · EPSS 21%

    Rules 67

  3. #03

    @acme/edge-session 3.0.1 → 3.0.4

    Public storefront · Production (+14)

    Medium · Transitive · Internet-facing · KEV · EPSS 10%

    Rules 66

After · Perpensa Rank order

Fix now · ±30 max

  1. #01

    @acme/edge-session 3.0.1 → 3.0.4

    Public storefront · Production (+14)

    Medium · Transitive · Internet-facing · KEV · EPSS 10%

    Rank 96

    +30

  2. #02

    @acme/admin-report 1.4.0 → 1.4.2

    Internal admin · Production (+8)

    Critical · RCE · Direct · EPSS 33%

    Rank 69

    0

  3. #03

    @acme/batch-worker 2.1.0 → 2.1.5

    Backoffice · Production (+8)

    Critical · SQLi · Direct · EPSS 21%

    Rank 67

    0

Illustrative multi-service example: rule-based rank combines the deterministic risk score with declared environment weights (Risk 61 + 8 = Rules 69, Risk 59 + 8 = Rules 67, Risk 52 + 14 = Rules 66). Within Fix now, Perpensa Rank can move a finding by up to ±30 based on vulnerability and exposure context—for example, +30 here promotes the internet-facing KEV item from #03 (Rules 66) to #01 (Rank 96) while internal services stay at 0.

How priority is built

Rules → category → order
  1. 1

    Deterministic risk (0–100)

    Severity, EPSS, KEV/public exploit, and direct/transitive dependency status.

  2. 2

    Relevant context

    Minimized vulnerability facts and declared environment context refine the order inside each category. Your source code is not sent.

  3. 3

    Priority advice

    Perpensa Rank is included on Pro and Team. The line is "Perpensa AI adjusted the order within this category.", "Ranked by rules. Perpensa AI reviewed it and kept this order.", "Ranked by rules for now. Perpensa AI review is in progress.", "Ranked by rules. Perpensa AI could not review this one.", or "Ranked by rules." when it has never been reviewed. On Starter, rules set the category.

  4. 4

    You decide

    Review the facts and choose what to fix. Optional explanations and contextual questions do not change the score or execute actions.

Risk scores stay auditable. Fix now, Plan and Monitor remain rule-based categories. Perpensa Rank refines their order; explanations cite available public sources.

MCP Server & Machine API

Connect your coding agent

Connect Codex CLI, Claude Code, Grok Build, ChatGPT, or any MCP-capable coding agent over Streamable HTTP with OAuth 2.1 and PKCE. Query published priorities, inspect CVE evidence, and evaluate the check_ci release gate directly from your assistant.

Included on Pro and Team

5 machine accesses on Pro and 25 on Team, shared between API tokens and MCP connections.

Scoped OAuth 2.1 consent

Scoped by organization and application, expiring after 90 days and revocable at any time.

Read results & Check CI by default

Read results and Check CI by default (list_organizations, list_applications, list_priorities, explain_update, explain_finding, check_ci, list_inventory); Export and Send feedback are opt-in. Never starts a scan or modifies a finding.

Read the MCP setup guideMachine API & CI reference
https://perpensa.app/mcp

Paste into a coding agent that supports Streamable HTTP MCP with OAuth 2.1 and PKCE:

Streamable HTTP + OAuth 2.1
Agent setup prompt
Set up the Perpensa MCP server (Streamable HTTP with OAuth):
- Server name: perpensa
- URL: https://perpensa.app/mcp
Once connected, use list_organizations and list_priorities to list our Fix now priorities for Production, then explain the first item with explain_finding or explain_update depending on its kind (skip if the queue is empty).

Uses Streamable HTTP (protocol 2026-07-28) with OAuth 2.1 and PKCE.

Pricing

Straightforward plans for the review queue

Monthly price per organization. Start free, then pick the pack that matches your people and tracked branches.

  • Starter

    For someone trying the queue on a few repos.

    Free
    • 1 person
    • 5 tracked branches
    • 1 org-wide scan / 24h + weekly auto scan
    • Custom schedules require Pro
    • Rule-based prioritization
    • Weekly email digest
    • Slack digests require Pro
    • Applications across repositories
    • No API & MCP access
    • CycloneDX, SPDX, and CSV exports
    Start free
  • Recommended

    Pro

    For engineers and small teams managing dependencies.

    $49/ month
    • 10 people
    • 75 tracked branches
    • Auto scan every day, adjustable up to hourly, with a custom digest schedule
    • Manual and webhook scan jobs
    • Perpensa Rank · AI triage included
    • Daily digest and optional email alerts
    • Slack digests
    • Applications across repositories
    • 5 active API & MCP accesses
    • CycloneDX, SPDX, and CSV exports
    Start on Starter

    Interested in Pro? Paid upgrades are not available yet.

  • Team

    For a larger account that needs several people on one tenant.

    $149/ month
    • Unlimited people
    • 300 tracked branches
    • Auto scan every day, adjustable up to hourly, with a custom digest schedule
    • Manual and webhook scan jobs
    • Perpensa Rank · AI triage included
    • Daily digest and optional email alerts
    • Slack digests
    • Applications across repositories
    • 25 active API & MCP accesses
    • CycloneDX, SPDX, and CSV exports
    • Shared organization for multiple accounts
    Start on Starter

    Interested in Team? Paid upgrades are not available yet.

Explore the evidence before choosing an action

Sign in with GitHub to open a workspace—risk-ranked queue, findings, exports, policies, and Perpensa Rank on paid plans.

Try for free

Auditable scores. Perpensa Rank helps Pro and Team prioritize dependencies using their versions and vulnerability information.