Pricing verified Sep 4, 2026 11 frontier models 3 providers

AI scans the code.
What does it cost?

Estimate what you would pay directly to an AI provider to scan repositories and pull requests with frontier models. Defaults come from Arnica's benchmark cohorts; every workload and model assumption is editable.

Start estimating What else to consider
Workload

Environment assumptions

Repository and stale-repository defaults update from the developer count using Arnica's benchmark cohorts: SMB under 100 developers, Midmarket from 100 to 999, and Enterprise at 1,000 or more. Active and stale repositories can use different full-scan cadences.

Midmarket benchmark cohort.
Default: 4.0 repos per developer.
Default: 60% stale.
Default from Arnica's benchmark.
Weekly means 52 full scans per active repository per year.
Annually means 1 full scan per stale repository per year.
Models and calibration

Select up to 3 models

Prices match each provider's published API pricing. Select up to three models here, then compare their estimated scan costs in the estimate below.

Select up to 3 models to compare in the estimate table below.

Use
Model
Input $/M
Output $/M
Claude Haiku 4.5Anthropic
$1.00
$5.00
Claude Sonnet 5Anthropic
$2.00
$10.00
Claude Opus 5Anthropic
$5.00
$25.00
Claude Fable 5.1Anthropic
$10.00
$50.00
GPT-5.6 LunaOpenAI
$0.20
$1.20
GPT-5.6 TerraOpenAI
$2.00
$12.00
GPT-5.6 SolOpenAI
$4.00
$20.00
GPT-6 AstraOpenAI
$10.00
$50.00
Gemini 3.1 Flash-LiteGoogle
$0.25
$1.50
Gemini 3.8 FlashGoogle
$0.75
$3.75
Gemini 3.1 Pro PreviewGoogle
$2.00
$12.00
Estimate

Annual provider cost

This is the estimated amount paid to the AI model provider for the selected workload. It excludes engineering time, orchestration infrastructure, storage, CI minutes, alert routing, and triage operations.

What this means: raw provider spend is only one lever. Arnica helps make AI scans faster and cheaper while driving 100% developer adoption across the enterprise, so teams can find backlog risk and prevent new risk without turning every scan into another expensive workflow.
Formulas

How the estimate is calculated.

The calculator separates workload volume from model token economics so finance and engineering can test each assumption independently.

Workload

Developers set the default repository and stale-repository assumptions by company segment. Manual repository and stale overrides are preserved until reset.

repos = developers x cohort repos/dev
annual PRs = developers x PRs/dev/month x 12
annual full scans = active repos x active cadence + stale repos x stale cadence

Per-event cost

Per-event scan costs are estimated from calibrated provider benchmarks and each model's published input/output pricing.

model scan cost = calibrated scan benchmark x model pricing multiplier
pricing multiplier = derived from relative input/output token rates

Annual cost

The general-purpose estimate lets active and stale repositories use separate full-scan cadences, while PR scan volume follows developer activity.

annual total = annual full scans x full cost + annual PRs x PR cost
What else to think about

Provider tokens are only one part of operating AI code scanning.

This calculator exists because executives are watching models like Claude Mythos demonstrate source-visible vulnerability discovery and asking a reasonable question: what unknown risk is already sitting in the backlog, and how do we prevent the next wave of AI-detectable risk from entering the codebase?

Backlog discovery

Frontier security models raise the urgency of finding latent vulnerabilities before attackers or auditors do. The immediate question is no longer whether AI can find buried issues; it is how often you can afford to look across all repositories.

Forward prevention

Backlog scans are only half the problem. New pull requests and active repositories need continuous coverage so fresh risk is caught while developers still have context and can fix it quickly.

Model choice

Public follow-up testing of Mythos showcase cases found that multiple cheaper and smaller models recovered the same vulnerability analyses. That makes orchestration, context, and scan design as important as always choosing the most expensive model.

Caching and dedupe

Repeatedly scanning unchanged code pays the model provider again. Arnica's offering is designed around reusing prior analysis and reducing repeat token spend on unchanged code.

Active vs stale repos

Stale repositories still need periodic coverage for newly disclosed vulnerability classes, but active repositories drive most continuous scan activity. Treating both the same can inflate spend.

Operational controls

Provider limits, key management, monthly budgets, retry behavior, failed scans, and silent workflow breaks all need owners. Arnica provides the control plane to operate this safely without turning it into another platform burden.

Developer workflow

Raw model output still needs routing, prioritization, suppression, fix context, and developer-native comments. Otherwise token spend can turn into alert volume instead of resolved risk.

Model upgrades

Frontier models, pricing, and deprecation timelines change quickly. Arnica can help route the right work to the right model as price and quality shift.

Cost reduction path

If this estimate is higher than expected, Arnica can help reduce the provider bill through scan orchestration, caching, dedupe, active-repo targeting, and model operations built for application security.

Hint: use the calculator to size the raw provider exposure, then compare it with architectures that avoid unnecessary scans, route the right workload to the right model, and prevent new risk before it becomes backlog.

Make AI code scanning better, faster, and cheaper

Talk to Arnica
FAQ

Questions about AI scanning cost.

Short answers to what the estimate covers, where the defaults come from, and what the number leaves out.

What does the AI code scanning cost calculator estimate?

This calculator estimates the annual amount you would pay directly to an AI model provider in API token charges to scan your repositories on a schedule and to scan every pull request. It excludes engineering time, orchestration infrastructure, storage, CI minutes, alert routing, and triage operations.

How much does it cost to scan a pull request with an AI model?

It depends almost entirely on the model. Anthropic's Claude Code Review announcement references reviews averaging $15 to $25 per pull request on frontier models. This calculator anchors an entry-tier model at $0.40 per pull request and $3.00 per full repository scan, and a state-of-the-art model at $20 per pull request and $250 per full scan, then scales those anchors by each model's published input and output token pricing.

Which AI models can I compare?

Eleven frontier models from three providers. Anthropic: Claude Haiku 4.5, Claude Sonnet 5, Claude Opus 5, and Claude Fable 5.1. OpenAI: GPT-5.6 Luna, GPT-5.6 Terra, GPT-5.6 Sol, and GPT-6 Astra. Google: Gemini 3.1 Flash-Lite, Gemini 3.8 Flash, and Gemini 3.1 Pro Preview. You can compare up to three at a time.

How is the annual AI scanning cost calculated?

Annual total = (annual full scans × full scan cost) + (annual pull requests × pull request cost). Annual full scans = active repositories × the active scan cadence + stale repositories × the stale scan cadence. Annual pull requests = developers × pull requests per developer per month × 12.

What are the default workload assumptions?

Thirteen pull requests per developer per month, plus repository and stale-repository ratios drawn from Arnica's benchmark cohorts: SMB under 100 developers at 2.7 repositories per developer and 45% stale; Midmarket from 100 to 999 developers at 4.0 repositories per developer and 60% stale; Enterprise at 1,000 or more developers at 4.5 repositories per developer and 47% stale. Every value is editable.

Does the estimate include the cost of running a code scanning platform?

No. The figure is provider token spend only. Operating AI code scanning also requires orchestration, caching and deduplication, provider key and budget management, retry handling, finding prioritization, suppression, and developer-native routing of results.

How can I reduce AI code scanning costs?

Avoid paying the provider again for unchanged code by caching and deduplicating prior analysis, give stale repositories a slower scan cadence than active ones, and route work to the cheapest model that performs well on it. Public follow-up testing of frontier security showcases found that several smaller and cheaper models recovered the same vulnerability analyses, so orchestration and scan design matter as much as always picking the most expensive model.

Is this calculator free to use?

Yes. It is free, requires no signup, and runs entirely in your browser. Your inputs stay local and can be shared with a link generated by the Copy shareable link button.

References used for defaults

Model list and provider pricing last verified .

  1. Arnica benchmark defaults: 13 PRs per developer per month; SMB under 100 developers with repository ratio 2.7x and stale 45%; Midmarket 100-999 developers with repository ratio 4.0x and stale 60%; Enterprise at 1,000+ developers with repository ratio 4.5x and stale 47%.
  2. Claude PR benchmark: Anthropic's Claude Code Review announcement references reviews averaging $15-$25 per PR, billed on token usage.
  3. Claude full-audit benchmark: Insight Services APAC's security audit cost experiment used Opus 4.7 with a 1M context window and reported substantial per-project audit spend. This calculator uses a $250 SOTA full-scan planning anchor.
  4. Mythos and model-choice context: Anthropic's Claude Mythos Preview describes source-visible vulnerability discovery, while AISLE's Mythos jagged-frontier reproduction materials report that multiple smaller or cheaper models recovered the same public showcase vulnerability analyses.
  5. Claude Fable 5.1 pricing: Anthropic's Claude Fable 5.1 and Claude Mythos 5.1 announcement (September 1, 2026) keeps Fable 5's $10 per million input tokens and $50 per million output tokens.
  6. GPT-6 Astra pricing: OpenAI's GPT-6 Astra model page (released September 3, 2026) lists $10 per million input tokens and $50 per million output tokens with a 1M-token context window. Advanced cyber capabilities are gated behind OpenAI's trusted-access program, so the publicly available API model may decline some security-analysis prompts.
  7. Provider pricing references re-verified September 4, 2026 against Anthropic Claude API pricing, OpenAI API pricing, and Google Gemini API pricing. Gemini 3.8 Flash is listed at an introductory $0.75 input and $3.75 output per million tokens through December 31, 2026, doubling to $1.50 and $7.50 on January 1, 2027. GPT-5.6 Sol's $4 input and $20 output promotional pricing is listed as available at least through November 21, 2026.
  8. Cheapest-model anchor: the $0.40 per-PR and $3.00 full-scan planning anchors were originally benchmarked on GPT-5 mini and are now applied to GPT-5.6 Luna, the current entry-tier OpenAI model.
Disclaimer. This calculator is a planning tool only. Actual cost depends on code volume, prompt design, context strategy, model availability, provider terms, and pricing at the time of use.