Every plan carries a scanning allowance for the organization. It decides how much you can actually scan, it is enforced where a scan starts rather than merely displayed, and there is no way to pay past it.
One pool per organization
Scanning a repository and generating a patch both spend from the allowance, and all of it comes out of a single pool the whole organization shares. Seats add capacity to that pool rather than dividing it, so a quiet month on one repository pays for a loud one somewhere else.
What a scan costs depends on how much of the repository carries security surface, which checks are on, and the depth it runs at. A file that has not changed since it was last analysed is not analysed again, which is why the second scan of a repository usually costs far less than the first. See How scanning works.
The period
| Plan | What the allowance is | When it resets |
|---|---|---|
| Free | One grant, measured across the whole life of the organization | Never. It is spent once. |
| Plus, Pro, Max | The plan's monthly allowance, plus capacity for each seat beyond the ones it includes | Every month, on the organization's own renewal day |
When the allowance is spent
The refusal is allowance_exhausted. Admission checks apply to manual, push-triggered, and scheduled scans as well as new hosted fix and proof work. The workspace says scans are paused, and the date they resume, above every screen from the moment the allowance runs out, and warns from 80% used. A push or scheduled scan refused this way is not silent either: the first one each period is recorded in the audit log as scan.paused.
Repository limits
| Plan | Repositories that may be connected |
|---|---|
| Free | 2 |
| Plus | 10 |
| Pro | Unlimited |
| Max | Unlimited |
The limit is counted when a new repository is connected, and a connection that would exceed it is refused with repository_limit. Disconnecting one makes room for another. See Connect a repository.
Max-depth scans
| Plan | Max depth |
|---|---|
| Free | Not included |
| Plus | Not included |
| Pro | Unlimited |
| Max | Unlimited |
Setting a repository to max depth on a plan that does not include it is refused with depth_unavailable rather than accepted and quietly ignored. Pro and Max put no cap on how many max-depth scans you run. What binds instead is the allowance, which a max scan spends several times faster than a default one. See Scan depth.
Reading the meter
In the workspace, Billing shows the plan, seats, actual used and remaining model tokens when available, the rounded usage meter, and the next monthly refill date. Free has no refill. The standard plan grant can differ from the organization's adjusted live balance. Model tokens measure AI input and output, not a cash balance or a fixed number of scans. Any role can read the meter. Existing CLI clients can show only percentages; do not infer an exact token count from them.
$cf planPro active, billed yearly acme seats 12 10 included, 2 extra repositories unlimited usage 27% used scans 31 period 4 Sep 2026 to 4 Oct 2026 renews 4 Mar 2027 max depth unlimited
Read period for when the allowance comes back, not renews. That organization pays yearly, so its subscription renews next March while its allowance resets every month. Its allowance is larger than Pro on its own because two extra seats add capacity to the pool.
cf plan --agent returns the same thing as one line of JSON, which is how an agent finds out that a scan is about to be refused before it runs one. See Agent commands.
The refusals
| Code | What happened | What to do |
|---|---|---|
allowance_exhausted | The organization has spent its allowance for the period | Wait for the period to reset, or move up a plan. |
repository_limit | The plan covers fewer repositories than you are trying to connect | Disconnect one, or move up a plan. |
depth_unavailable | Max depth is not included on this plan | Scan at default depth, or move to a plan that includes it. |
billing_forbidden | Only an owner or admin may change what the organization pays | Ask one of them. |
no_subscription | Nothing has ever been bought, so there is no billing account to open | Choose a plan first. |
plan_unavailable | That plan or seat is not on sale on this deployment yet | Report it. Nothing you run changes it. |
billing_unavailable | This deployment has no billing configured at all | Report it. |
Making the allowance go further
- Scan at `default` depth continuously and keep `max` for audits. A max-depth scan does several times the analysis of a default one on the same repository.
- Match the schedule to the repository. A six-hourly sweep of something nobody pushes to spends the allowance on an answer that has not changed. See Scan triggers.
- Turn off checks you do not act on. Each one is work every scan does. See Checks.
- Read the meter before a wide rescan. The first scan of a large unfamiliar repository is the most expensive thing you can start.
Have a correction or need help?
Email the docs team