Pricing
ThreatCluster is priced as an API. Every account mints a free key: 100 credits a day over the last 7 days, no card. Paid plans raise the daily allowance and include the platform built around the data.
Plans
100 free credits is about 100 record lookups or 20 searches, every day. The public feeds and IOC blocklist need no key or account at all.
Free
$0
Evaluation and personal use.
- 100 credits a day
- Last 7 days of history
- 25 rows a request · 30/min
- Every read endpoint and page
Starter 7-day free trial
$7.99 / month
Internal business use.
- 1,000 credits a day
- 90 days of history
- 50 rows a request · 120/min
- Custom feeds, alert rules, the full analyst platform
Growth
$29 / month
For teams building on the API.
- 5,000 credits a day
- Full history, back to launch
- 100 rows a request · 240/min
- Everything in Starter
Business
$199 / month platform access
Teams, service providers, redistribution.
- 10,000 credits a day for your own org
- +$59 / month per managed customer, each adding 10,000 credits a day to the pool
- Each customer a managed tenant: own feeds, alerts, branded digest
- Unlimited rows · 600/min · org sharing · redistribution by agreement
The Starter trial needs no card; after 7 days you drop back to Free, nothing charged. Running clients? Business is one top-level tenant at $199 with each company managed under it at $59 — set up over a short call, detail on the service providers page.
Credit packs, for anything past the daily allowance
| Pack | Price | Credits | Roughly |
|---|---|---|---|
| Starter | $10 | 2,000 | 2,000 record lookups, 400 searches or 200 dark-web enrichments |
| Bulk | $50 | 12,000 | 12,000 record lookups, 2,400 searches or 1,200 dark-web enrichments |
One-off, never expire, spent only after the day's allowance, on any plan. Past about 4,000 credits a month, Starter is the better buy.
What a request costs
| Credits | Requests |
|---|---|
| 1 | Records and lists: incidents, entities, vulnerabilities, dark-web lists, stats |
| 3 | Bulk and fan-out: the IOC feed and export, STIX bundles, dark-web keyword hits and trends |
| 5 | Search, one query across the whole corpus |
| 10 | A dark-web victim enrichment record: screenshots, extracted data, negotiation state |
A request that finds nothing costs nothing: empty searches and 404 lookups refund their credits. Every response carries X-Request-Cost and your remaining balance.
The platform, in full
Every plan includes the web platform around the API. The short version: Starter unlocks the full analyst platform, Growth adds the complete archive, Business adds org sharing and managed customers.
Compare everything, row by row
| Capability | Free | Starter | Growth | Business |
|---|---|---|---|---|
| Intelligence | ||||
| Smart analysis and timeline | Short summary, 3 events | ✓ | ✓ | ✓ |
| Threat scoring (0–100, four sub-scores) | ✓ | ✓ | ✓ | ✓ |
| Full analyst platform (attack flows, threat graph, D3FEND, CWE, exploit tracking, link enrichment, X intelligence, Explore) | — | ✓ | ✓ | ✓ |
| Dark web | ||||
| Ransomware leak-site tracking | — | ✓ | ✓ | ✓ |
| Company / domain monitoring | — | — | — | Single org |
| Feeds & alerts | ||||
| Alerting keywords (push to digest, webhooks, alerts) | 5 | Unlimited | Unlimited | Unlimited |
| Saved feeds (named views, RSS exports) | — | 5 | 5 | 10 |
| Entities per saved feed | — | 75 | 75 | 100 |
| Org-shared saved feeds | — | — | — | ✓ |
| Alert rules | — | 5 (5 conditions each) | 25 (5 conditions each) | 50 (50 conditions each) |
| Alert on a whole feed (one rule tracks every entity in the feed, no condition cap) | — | ✓ | ✓ | ✓ |
| Org-shared alert rules | — | — | — | ✓ |
| Feeds, rules and webhooks over the API (create, list, update, delete, test) | — | ✓ | ✓ | ✓ |
| Webhooks | — | 3 | 10 | 25 |
| Org-shared webhooks | — | — | — | ✓ |
| Personalised threat digest | ✓ (5 keywords) | ✓ | ✓ | ✓ (plus one per managed customer) |
| RSS feed | 50 items | 50 items | 50 items | 50 items |
| MISP feed | 10 events | 50 events | 50 events | 50 events |
| Managed customers | ||||
| Multi-customer scoping ($59 / month per customer: records, per-client feeds, rules, webhook routing, +10k credits/day each) | — | — | — | ✓ |
| Branded scheduled digests per customer | — | — | — | ✓ |
| AI assistant | ||||
| Ask AI per cluster / day | — | 3 | 3 | 10 |
| Cluster AI global search / day | — | 10 | 10 | 100 |
| Inline source citations | — | ✓ | ✓ | ✓ |
| Collections | ||||
| Collections | 1 | 5 | 5 | 25 |
| Items per collection | 10 | 100 | 100 | 100 |
| Team sharing with roles | — | — | — | ✓ |
| IOC exports | ||||
| IOC exports (TXT / CSV / JSON, STIX 2.1 bundles, bulk filters; the public 30-day blocklists need no account at all) | 7-day window | ✓ | ✓ | ✓ |
| Integrations | ||||
| REST API | 100 credits/day, 7-day window, 25-row lists | 1,000 credits/day, 120 req/min, 90 days of history, 50-row lists | 5,000 credits/day, 240 req/min, full history, 100-row lists | 600 req/min, 10k credits/day + 10k per managed customer |
| tc CLI | ✓ | ✓ | ✓ | ✓ |
| API scopes | Read-only, trimmed rows (threats, IOCs, entities, CVEs, dark web) | Full rows + feeds/alerts (9 scopes) | Full rows + feeds/alerts (9 scopes) | Full (all scopes) |
| Org-level API keys (custom scopes) | — | — | — | ✓ |
| Agent tools (MCP, tc CLI, agent bearer tokens — scopes follow the plan) | ✓ | ✓ | ✓ | ✓ |
| AI-assisted feed creation | — | — | — | ✓ |
| SIEM ingestion (feed polling on any key; TAXII 2.1 from Starter) | Polling | ✓ | ✓ | ✓ |
| SOAR / ticketing (webhook routing) | — | ✓ | ✓ | ✓ |
Free for education, non-profits, foundations and press
We grew up reading the same open writeups as everyone else. If you are a university, a registered non-profit, a cybersecurity foundation (CERTs, ISACs, threat-sharing communities, infosec charities) or a reporter or researcher, Starter is free.
Reach out via the contact form from your institutional address with a one-line description of what you are working on. We turn it around in a couple of days.
FAQ
Is the web platform a separate price?
No. One plan covers both: the account that holds your API key sets your limits in the web platform too. The matrix above is the full map.
Can I try Starter first?
Yes. Start a 7-day trial with no card. If you do not add a payment method by day 7 you drop back to Free; nothing is charged automatically.
How is Business metered?
Two enforced ceilings: 600 requests a minute, and a pooled daily budget of 10,000 credits plus 10,000 per active managed customer. Credit packs cover an overage like any other plan, and a workload that genuinely needs more gets a per-key override by agreement. Systematically replicating the corpus, or redistributing data outside a redistribution agreement, is out of scope on any plan.
How do I get Business?
$199 a month for platform access plus $59 a month per managed customer, set up over a short call: account, seats, contract. We keep it under an hour.
Do you offer annual billing?
Starter and Growth are monthly. Business is an annual contract by default, with quarterly options if that fits your finance calendar better.
Can I redistribute the data?
The public feeds are free with attribution; keyed responses are for your own tooling. Embedding or redistributing in a product you sell is by agreement on Business — the detail is on the formats page.
Can I cancel?
Plans are monthly with no minimum term. Cancel from settings and the key keeps working until the end of the period. The free key never expires.
Get started
The whole surface is in the spec: 70+ endpoints over incidents, IOCs, entities, vulnerabilities and the dark web. Mint a free key and make the first call in a minute.