Pricing
The Developer Edition governs an agent in your process — free, with no paid plan. Cloud adds a control center for policy, history and teams. Beacon adds what needs state outside your process — and runs in your own environment.
On every tier the authorization decision stays in your process. If Cloud is unreachable, your agents keep working.
Cloud Team
$99/mo
or $990/yr — two months free
A small team putting its first agents into production.
Request accessCloud Business
$299/mo
or $2,990/yr — two months free
An organization running agents in production at scale.
Request accessCloud is in private beta — prices are shown so you can plan, and access is by invitation while we onboard in small batches.
| Developer | Cloud Team | Cloud Business | Enterprise | |
|---|---|---|---|---|
Where it runs | ||||
| Hosted control center | ||||
| Runs in your own environment | Self-hosted | |||
| Air-gapped, on-premises operation | ||||
| Your audit data stays in your infrastructure | ||||
Control center | ||||
| Central policy management | ||||
| Agent inventory, discovered from the trail | ||||
| Environments | Development | Dev, staging, production | Dev, staging, production | Dev, staging, production |
| Decision history | 7 days | 90 days | 1 year | Unlimited — retained in your environment |
| Delegation chains and forensics | Signed execution lineage | |||
| Policy bundle upload from CI | ||||
| Single sign-on — any OpenID Connect provider (Okta, Entra ID, Google Workspace, Auth0, Keycloak, Ping) | ||||
Beacon — the enterprise platform Beacon is deployed in your environment, not ours. These capabilities need state outside your agent's process — a fleet to revoke across, a plane to quarantine into, a key to sign lineage with — and that plane runs where your agents run. | ||||
| Runtime enforcement proxy — on the wire, not only in-process | ||||
| Stop a run, quarantine an agent, sever a subtree, revoke authority | ||||
| Signed, tamper-evident execution lineage | ||||
| Drift detection with automated quarantine, at machine speed | ||||
| Infrastructure discovery — agents and MCP servers found across your environment, continuously | ||||
| Registration — every discovered agent and MCP server enrolled in the registry with an owner and an identity | ||||
| Attested identity — OIDC federation and mTLS workload identity | ||||
| Fleet-wide revocation at the credential broker | ||||
Start free
Sign up, install the Developer Edition, and govern a real agent in five minutes. No paid plan, no card.
Developer EditionEnterprise, in your environment
Beacon deploys where your agents run — air-gapped if you need it — and your audit data never leaves your infrastructure.
sales@watchlight.ai