← Primust · Pricing

One price. Per governed action.

No seats. No proof-floor surcharge. No metered check counts. A governed action is one Pipeline() open-to-close — and it costs the same whether it runs three checks or three hundred.

§ 01 — The plan
Pay as you go
$0.25
per governed action
Get API key →
⊢
One governed action = one Pipeline() open-to-close
⊢
Regardless of how many checks run internally
⊢
No proof-level surcharge — all levels same price
⊢
No contract, no commitment, no seat licenses
⊢
Production keys (pk_live_)
⊢
Audit-acceptable VPECs
⊢
All proof levels: Attestation → Mathematical
⊢
All adapters and connectors included
⊢
Open-source verification is free — primust-verify is Apache-2.0
⊢
Offline-verifiable credentials — no callbacks to Primust
§ 02 — How billing works

Seven rules. That's the whole contract.

Governed action
One Pipeline() open-to-close. Three checks or three hundred — same price.
Proof level
Attestation, Execution, Verified Model, Witnessed, Mathematical all bill the same.
Blocked actions
Blocked attempts generate a VPEC and count as one governed action.
Verification
Free. primust-verify runs locally without calling Primust.
Sandbox keys
pk_sb_ keys are free and unlimited. Not audit-acceptable — swap to pk_live_ to ship.
Key swap
Production swap is one env var. No code changes. No re-instrumentation.
Onboarding
primust init — one command: resolves the API key (RFC 8628 device flow), detects installed frameworks, wires the Claude Code hook if present. Keys land in ./.primust/config.toml (project) or ~/.primust/config.toml (--global) — never in shell history or .env files. primust whoami / logout for rotation; primust auth on its own for headless CI.
§ 03 — The math

Predictable. Even under load.

# A representative month
agent_sessions 10,000
checks_per_session_avg 14
billable_actions 10,000 # not 140,000
 
rate $0.25
total $2,500
 
# Add 300 checks to a session. Price: $0.00 more.
# Raise proof floor to Mathematical. Price: $0.00 more.
§ Ship

Swap one env var. That's production.

No re-instrumentation. No new SDK. No integration call. Every VPEC your sandbox produced had the same schema as the ones you'll ship — minus the pk_live_ signing key.