Self-hosted Nark for compliance-conscious teams
Run Nark in your CI without sending a line of code to a third party. Profile-based detection on every PR. Air-gap-ready. Pro corpus included.
Local only
Nark runs as a CLI in your CI. Your source never leaves your VPC.
Pro corpus
250+ production-ready Profiles as a floor, growing continuously. Covers AWS SDK, Azure, Google Cloud, Stripe, Prisma, Twilio, and the long-tail SDK family. If your team depends on a package we don't yet cover, we author a new Profile for it on request — included in the subscription, typically within 2-4 weeks.
Deterministic
Same input, same output. Zero AI tokens. No spam.
How Enterprise compares
| Tier | Buyer | Hosting | Corpus | Seats | Price |
|---|---|---|---|---|---|
Free / OSS | Solo dev | Local CLI | 193 public profiles | 1 | $0 |
Plus (Cloud) | Small team, 1-10 devs | Hosted dashboard | 193 public profiles | up to 10 | $10/mo |
Enterprise (Self-Hosted)Recommended | 10+ dev org | Runs in your CI | 250+ Profiles (floor) + custom Profiles on request | Unlimited | Custom |
How it works in your CI
One step in your existing workflow. The corpus is pulled from npm like any other dependency.
- run: npx nark@latest --corpus nark-corpus-pro@latest
env:
NARK_CORPUS_TOKEN: ${{ secrets.NARK_CORPUS_TOKEN }}Design partners launching soon.
Frequently Asked Questions
Does my source code leave my infrastructure?
No. Nark runs as a CLI in your CI, reads your code, and writes an audit file to your CI artifacts. Source code never touches our infrastructure. The only outbound network call is the standard npm install of the corpus package, which contains no customer data. If you enable the dashboard, the CLI additionally uploads violation counts, file paths, and the list of npm packages your codebase imports — no source code, no variable names. If you'd rather stay fully air-gapped, don't set a token and nothing is uploaded, ever.
How do upgrades work?
Standard npm registry. Pin a version, or run @latest. Renovate and Dependabot handle upgrade PRs against the corpus the same way they handle any other npm dependency.
Do I need a SOC 2 review to use this?
No. Because the scanner is local-only, it falls outside the scope of most third-party-tool reviews. Many compliance-conscious teams adopt Nark Enterprise specifically to avoid that overhead.
What if my team uses a package you don't cover?
We author a new Profile for it. The 250+ Profiles shipping today are a floor, not a ceiling — custom Profile authoring is included in the subscription with no per-package fee, typically delivered within 2-4 weeks. The package needs to be a fit for the corpus (async, error-shaped, network-adjacent — the categories where Profiles actually catch real bugs); we won't write Profiles for pure UI libraries or synchronous utilities because there's nothing meaningful to check. Teams on the dashboard get proactive suggestions based on what their codebase actually imports; air-gapped teams can send us a package.json at onboarding and once a quarter.
Book a 20-min call
Custom pricing. We review fit and provision a self-hosted runner in your CI within the first week.
Or email sales@nark.sh directly.