frogeye.ai

What It Is

Frogeye is positioned as an AI-powered security scanning and vulnerability detection tool for software developers. Its core asset is a vulnerability security knowledge graph, exposed via the MCP protocol for use by AI coding assistants or third-party MCP hosts. It is more like a lightweight SAST / vulnerability-pattern detection service embedded into development and AI Agent workflows than a full enterprise-grade security platform.

Core Capabilities and Deployment

Its main protection capabilities are code security scanning, vulnerability pattern recognition, and knowledge-graph matching. The Free and Pro tiers send code to Frogeye servers for real-time processing, with Frogeye stating that it does not permanently store original source code. Apex, by contrast, emphasizes a local-first approach: code stays in the local environment, is analyzed through a local MCP client, and only anonymized mathematical embeddings are uploaded for similar-pattern matching. On the management side, Pro provides a web dashboard, scan history, trend analysis, and vulnerability reports, but the main documentation does not disclose capabilities such as real-time alerts, RBAC, audit logs, or ticketing integrations.

Compliance, Integrations, and Pricing

For compliance, Frogeye states that it complies with GDPR and CCPA, and promises not to sell personal data or permanently store original code. However, there is no visible mention of enterprise procurement certifications such as SOC 2 or ISO 27001. In terms of integrations, it supports the MCP protocol and can be used with third-party AI assistant scenarios such as Claude, Cursor, and GitHub Copilot. Account registration relies on GitHub OAuth or Google OAuth, and payments are handled via Stripe. Pricing is clear: the free tier includes 50 scans per day; Pro is $15/month with 500 scans per day; Apex is $29/month with 500+ scans and support for a local SDK.

Pros and Cons

The advantages are a low barrier to entry, an anonymous free tier, and an MCP-oriented design that fits emerging AI coding workflows. Apex also provides relatively detailed explanations around keeping source code off the cloud, making it suitable for teams that care strongly about code privacy. The downsides are also clear: the service does not guarantee uptime, scan results are explicitly not a security audit or security guarantee, and false positives and false negatives are acknowledged as possible. Disclosure around enterprise-grade compliance, SLAs, team management, and alerting capabilities is limited.

Best Fit and Access from China

Frogeye is suitable for individual developers, small teams, heavy users of AI coding tools, and teams that want to quickly identify common vulnerability patterns before committing code. For large enterprises, heavily regulated industries, or organizations that need full DevSecOps governance, alternatives such as Snyk, Semgrep, SonarQube, Checkmarx, and Veracode should still be evaluated. There is no official information on access from China; because it depends on GitHub/Google OAuth, Stripe, and third-party AI assistants, network access and payment experience may be uncertain.