repowiseRepowise is AGPL-3.0 and the open-source distribution is the whole engine: five intelligence layers, every supported language, multi-repo workspaces, the MCP tools, the local dashboard and auto-sync. Nothing about the analysis is held back.
The commercial licence exists for two reasons. Some organisations cannot take AGPL terms into their own tooling, and some need the security, compliance and administration surface that only makes sense once more than one team is involved.
What ships in open source
Everything in this list is in pip install repowise and stays there.
- The five intelligence layers: graph, git history, code health, decisions and the generated wiki
- Every language on the support ladder, including the Full tier. No language sits behind the licence, and none will
- Multi-repo workspaces and cross-repo intelligence within a workspace
- The MCP tools and the generated
CLAUDE.md - The local dashboard, including the local security pattern scan and the full-history secret scan
- Test intelligence: coverage ingestion and the graph-inferred test map
- Auto-sync through hooks, the watcher and webhooks
What the commercial licence adds
Status is stated plainly. GA means available today. Rolling out means working internals with a limited customer-facing surface. Planned means committed to and not started. The roadmap carries the same vocabulary.
| Capability | Status |
|---|---|
| Graph-aware enhanced security scanning | GA on hosted |
| CVE-aware dependency analysis, priority-scored against KEV and EPSS | GA on hosted |
| Usage-aware CVE triage, weighing imports against dead code | GA on hosted |
| Function-level reachability triage | GA on hosted, per-language coverage |
| Hosted secret detection with a fingerprint store and incremental re-scans | GA on hosted |
| SBOM generation (CycloneDX), VEX export and diffs | GA on hosted |
| Compliance reporting for PCI-DSS 4.0 and SOC 2 | GA on hosted, Teams |
| Audit trail, in-product plus JSON and CSV export and a webhook stream | GA on hosted, security surface |
| Jira and Confluence integration | GA on hosted, Teams |
| Slack and Teams security alerting over signed webhooks | GA on hosted, Teams |
| Reference high-availability topology | GA on customer infrastructure |
| Custom language and framework extensions, built and maintained by us | GA |
| Priority support with an SLA | GA |
| IP indemnification and a defensive patent grant | GA |
| Language-specific security rulesets | Rolling out |
| GitHub Enterprise, Azure DevOps, GitLab self-managed, Bitbucket | Rolling out |
| SAML / OIDC SSO and SCIM provisioning | Rolling out |
| Engineering leader dashboard | Rolling out |
| Role-based access control and multi-tenant deployment | Planned |
| Air-gapped install bundle | Planned |
A custom language or framework extension is worth calling out: we build and maintain it as a line item, and the result still ships to everyone under AGPL.
On-premise deployment
A self-hosted commercial install runs as containers on your own infrastructure. The reference topology is Kubernetes-based, and the same containers run on Nomad or plain Docker. A Helm chart is on the roadmap rather than shipping today.
What runs where:
- Containerised services: the API server (FastAPI), the indexer workers, and the dashboard (Next.js). Postgres holds metadata, LanceDB or pgvector holds embeddings, and the graph is in memory.
- Webhook receivers for GitHub Enterprise, GitLab self-managed or Azure DevOps, configured per tracked repository.
- SSO wired through your existing Entra ID or Okta tenant.
- Outbound integrations (Jira, Confluence, Slack, Teams) configured with signed service tokens held in the Repowise secret store.
- Bring your own key for the LLM: your Anthropic or OpenAI enterprise contract, Azure OpenAI in your tenant, or Ollama running fully offline. The choice is per repository, so a sensitive repo can run offline while a tooling repo uses a hosted model.
Everything sits inside your VPC or air-gapped network. The LLM provider and the git server sit in the same network boundary, and air-gapped mode needs no outbound connectivity at all.
On indexing cost: the graph, git, dead-code and code-health layers
build in minutes with zero LLM calls (repowise init --no-prose). Only
the documentation layer calls a model, it is a one-time generation that
scales with repository size, and it can run in the background.
Incremental updates after a commit finish in under 30 seconds.
What the licence grants
- Proprietary modification rights: modify the source without releasing your modifications under AGPL.
- Embedding rights: put Repowise intelligence inside your internal tooling and developer platforms.
- A defensive patent grant covering the methods and algorithms.
- IP indemnification against third-party claims.
- Support and maintenance with SLA-backed response times.
- All updates and new features during the licence term.
- The right to audit our security and compliance practices.
Pricing models
Pricing scales along whichever dimension matches your procurement. Figures come in a proposal rather than on this page.
| Model | How it scales | Best for |
|---|---|---|
| Per-seat | Priced per engineer with dashboard, API or MCP access. Inactive seats are reclaimable and the lifecycle is SCIM-managed. | Spend tracking headcount, alongside existing dev-tool billing. |
| Per-repo | Priced per indexed repository, with cross-repo workspace intelligence included and unlimited seats inside the licensed set. | Cases where codebase footprint drives the value and Repowise is consumed mostly by agents and CI rather than people. |
| Enterprise-wide | Unlimited seats and repositories, every commercial feature, on-prem or air-gapped, named support. | Org-wide standardisation, with no per-repo accounting overhead. |
All three include the same feature set; only the scaling dimension changes. Hybrid arrangements work too, for example enterprise-wide in one business unit and per-repo elsewhere.
Get in touch
Commercial proposals and scoping questions go to hello@repowise.dev. Security reviews go to security@repowise.dev.