Skip to main content

Accounts and licensing

Vulkro is a paid tool. An account holds your 14-day trial or your Pro subscription, and without one the scanner refuses to scan. Start on the Billing page of the customer portal (app.vulkro.com/billing, or run vulkro buy to open it). The trial needs a card at checkout, charges nothing for 14 days, and becomes paid Pro on day 15 unless you cancel. Then sign in on your machine with vulkro login. Signing in never starts a trial on its own. Prices and plans are on the pricing page. For an Enterprise plan, invoicing or a custom licence, write to license@vulkro.com. Open-source maintainers can request a complimentary licence through the support page; it is issued by hand on request.

The scanner always runs on your machine. Your code and your findings never leave it unless you choose to send something: vulkro publish sends a redacted summary (never source code), and a repository you connect to Vulkro Cloud is cloned and scanned in Vulkro Cloud instead of on your machine. The account layer sends only a short device token and anonymous usage counters over the network (see Telemetry).

What the trial and Pro include​

Everything the scanner does is included in the trial and in Pro: every language (JavaScript, TypeScript, Python, Go, Java and Spring, PHP, C and C++, see Languages and coverage), every detector, the findings with their proof, the fix, AI recommendations, the guard, the editor extension, the MCP tools, the local console, every output format, attack paths, change review, the release gate, compliance evidence and SBOM. Core Pro covers application code, Salesforce Pro covers Salesforce (including live-org scans), and the "Core and Salesforce" plan covers both. Pro also includes Cloud scans in the portal.

Without a licence: license_required​

Without an active trial or Pro (no signed lease from vulkro login and no installed .lic file from vulkro activate), every scanning command refuses to run and exits with code 1. That includes explain and demo. The refusal carries the marker license_required:

  • on stderr, the line vulkro: license_required (vulkro-sf: license_required for Vulkro for Salesforce);
  • in JSON output, error.reason set to "license_required".

The message tells you what to do next: start the 14-day trial at app.vulkro.com/billing, then run vulkro login. On an air-gapped machine, run vulkro activate <file.lic> instead.

These commands work without a licence, so you can install, sign in and check your state: --help, --version, login, logout, account, activate, machine-id, license-status, buy, usage, install-extension, init, install-hook, config, env, glossary and formats.

The other surfaces say so too, instead of returning nothing:

  • MCP server: scan tools return JSON-RPC error -32001 with license_required, never an empty result.
  • Language server and VS Code extension: a visible "no licence" state, never silently empty diagnostics.
  • Guard hook: a non-blocking notice in the hook protocol, so your agent's edits are not blocked.
  • CI: the scan step fails with exit code 1 and license_required. Set VULKRO_ACCOUNT_TOKEN to a CI key (see CI keys).

Two other states also stop a scan with exit code 1, because both mean something is wrong with the machine: a licence with an invalid signature, and a detected clock rollback.

Sign in: vulkro login​

There are three ways in, tried in this order:

vulkro login                    # browser login (default)
vulkro login --code ABCD-1234   # paste a pairing code, no browser
VULKRO_ACCOUNT_TOKEN=... vulkro login   # CI / headless, no browser
  • Browser login (vulkro login, no arguments). Vulkro prints a short code (for example ABCD-1234) and opens your browser to the account console. Approve the code in a logged-in tab and the lease installs. If no browser can open, it prints the URL to open by hand. The wait is bounded (about 15 minutes). A denied, expired, or timed-out login exits 2 and changes nothing.
  • Pairing code (vulkro login --code <CODE>). Paste a code from app.vulkro.com/connect instead. Use it on headless machines or when no browser is available.
  • CI / headless. Set VULKRO_ACCOUNT_TOKEN to a CI key and run vulkro login with no --code. It swaps the key for a lease, with no browser and no code. See CI keys.

All three install the same signed subscription lease. Exit codes: 0 logged in and lease installed; 2 error (offline, account-server failure, an invalid lease, or a denied / expired / timed-out browser login).

The lease and offline grace​

Login installs a short-lived signed lease that unlocks the scanner just like a .lic file. The scan itself is unchanged and still runs fully offline against the cached lease.

  • The lease refreshes automatically once a day while online.
  • It stays valid offline through its signed expiry (about 14 days), so short offline stretches (travel, flaky networks) never interrupt work.
  • Once that expiry passes without a refresh, scanning stops with license_required until the lease refreshes, you log in again, or you activate a .lic. Results and reports already on the machine stay and stay readable.

The refresh call carries only this device's token and anonymous usage counters. Never your code, your findings, or your machine fingerprint.

The trial, renewal and cancelling​

  • The trial. Pro starts with a 14-day trial when you check out on the portal Billing page; a card is required and nothing is charged during the trial. There is one trial per email address and per machine.
  • Renewal. On day 15 the trial becomes paid Pro, monthly or annual, and renews until you cancel. Cancel at any time from the Billing page; Pro stays active until the end of the period you paid for.
  • Changing plans. Upgrades (for example to both products, or to more Cloud scans) start at once; downgrades take effect at the end of the period.
  • When the trial or Pro ends (a cancelled plan, or a failed payment), the cached lease keeps working for a 14-day grace, then scanning stops with license_required. Results and reports on your machine stay and stay readable; nothing is deleted. Live-org Salesforce scans stop too.

One Pro subscription belongs to one person, on one machine per product. For a team, Vulkro Cloud gives every member Pro on their own machine.

Check your state: vulkro account and vulkro license-status​

vulkro account          # local view: tier, seat, expiry, offline grace
vulkro license-status   # sign-in status, tier, expiry, machine ID, features
  • vulkro account is fully local. It reads only your local database and makes no network call, so it works air-gapped. It shows your plan (trial, Pro, Team, Enterprise), your seat (for example "seat 2 of 5"), the lease expiry, and the offline grace remaining. Exit codes: 0 printed, 2 local read error.
  • vulkro license-status shows the current license state and the per-feature checklist. Exit codes: 0 printed, 2 local database error.

Sign out: vulkro logout​

vulkro logout

This deletes the local device token and cached lease, then tries to revoke the seat on the account server. Local logout always succeeds; a failed or offline revoke is a warning, not an error. A perpetual offline .lic you installed with vulkro activate is left untouched and keeps working. Without that file, scanning on this device refuses with license_required after logout until you sign in again. Exit codes: 0 logged out (or nothing to do), 2 local database error.

Air-gapped and offline machines​

Machines that cannot reach the internet use a license file instead of vulkro login:

vulkro activate ./your-team.lic   # install a signed .lic (replaces login)
vulkro machine-id                 # print this machine's fingerprint

vulkro activate verifies the Ed25519 signature, checks the machine binding, and stores the key locally. With Pro, create a signed offline licence file yourself on the Connect page of the customer portal; for a custom or machine-bound licence, write to license@vulkro.com with the fingerprint from vulkro machine-id. See Offline mode for the full air-gap workflow.

With VULKRO_OFFLINE=1 set, vulkro login and vulkro logout refuse to run (no outbound call) and point you at the .lic path. vulkro account still works.

CI keys​

A CI runner signs in with a CI key instead of a person's login. Create one in the customer portal (app.vulkro.com), store it as a secret in your CI system, and expose it to the job as VULKRO_ACCOUNT_TOKEN. A CI key works for the trial and for paid plans, uses no device seat, and can be revoked from the portal at any time.

# in the CI job, with VULKRO_ACCOUNT_TOKEN set from a secret
vulkro login
vulkro scan .

An air-gapped runner uses a licence file instead: set VULKRO_LICENSE_B64 to the base64 of a .lic file (for example base64 < your-team.lic), stored as a CI secret.

Without either, the scan step fails with exit code 1 and license_required. The CI/CD guide has examples for each CI system.

Environment variables​

VariableEffect
VULKRO_ACCOUNT_URLOverride the account / API base. Defaults to https://api.vulkro.com. Useful for self-hosting or testing.
VULKRO_ACCOUNT_TOKENSupply a CI key non-interactively so vulkro login (with no --code) can sign in a headless / CI machine without the browser flow.
VULKRO_LICENSE_B64The base64 of a .lic licence file, for air-gapped CI runners that cannot sign in.
VULKRO_OFFLINE=1The air-gap switch. Disables login, the lease refresh, and every other outbound call, guaranteeing zero egress.

What's next​

Last updated on