The old Shipmoor plan boundary was visible in too many places. Community and IC sounded like different products. Installer names implied that the binary decided what you could use. A trial began in checkout, before you had seen the complete workflow. And the free path was centered on one command instead of the way developers actually work with agents.
Shipmoor 0.10.0 replaces that model with one CLI and two individual plans: Free and Pro. A newly created personal account receives the complete Pro product for 30 consecutive days, with no card or invitation. After that, it can continue automatically on a useful Free plan or stay unlimited with Pro for $19 per month.
The change is not a new wrapper command or a vague pool of credits. It is a command-by-command contract designed to make access predictable.
The new individual plan matrix
| Capability | First 30 days | Free | Pro |
|---|---|---|---|
| Deterministic Scan | Unlimited | Unlimited | Unlimited |
| Claim Check | Unlimited | 5/month | Unlimited |
| Code Review | Unlimited | 5/month | Unlimited |
| Test Evidence | Unlimited | 5/month | Unlimited |
| Blast Radius | Unlimited | 5/month | Unlimited |
| Agent Harness | Unlimited | Unlimited | Unlimited |
| Agent Skills | Unlimited | Unlimited | Unlimited |
| IDE, advanced configuration, richer local history | Included | Not included | Included |
Pro is $19/month or $190/year. Team and Enterprise remain coming-soon product contracts; the capabilities described here are the individual Free and Pro product shipping in 0.10.0.
The first 30 days use the same capability matrix as paid Pro. This is not a reduced trial and it does not create a Stripe customer, Checkout Session, or subscription. The one-time grant begins when a new personal account is created and lasts exactly 30 consecutive 24-hour periods. Existing unpaid accounts do not receive it retroactively unless Shipmoor runs a separate migration campaign.
Free keeps the recurring local workflow
Free is not a read-only dashboard or a one-run demo. Scan, Agent Harness, and Agent Skills remain unlimited because they form the recurring local loop: inspect the change, keep deterministic checks inside the agent’s edit cycle, and give the agent reusable verification behavior.
The four higher-level command families each receive their own monthly allowance:
- five
shipmoor claim-checkinvocations; - five
shipmoor reviewinvocations; - five
shipmoor test-evidenceinvocations; - five
shipmoor blastinvocations.
These are four independent counters, not 20 interchangeable credits. Using all five Reviews does not reduce the five Claim Checks. All four counters renew at 00:00 UTC on the first day of each calendar month, and unused invocations do not roll over.
That separation follows the questions the commands answer. Claim Check asks whether a change fulfilled its stated task. Review surfaces advisory code findings. Test Evidence checks whether the test signal is trustworthy. Blast Radius maps impact through the repository. They can work together, but they are not the same unit of work.
One top-level execution counts once
An allowance is consumed when an authenticated, valid top-level command crosses its execution boundary. That happens after argument and configuration validation, but before the engine, model, or runner starts expensive work.
The rule is intentionally mechanical:
- rerunning a command is a new invocation;
- an invocation counts whether its result is clean, blocked, inconclusive, canceled, or failed after admission;
- an invocation launched by an agent, Skill, Harness, or IDE counts exactly like one typed by a user;
- a network retry of the same invocation does not count twice;
- help, parse failures, authentication failures, and setup-only commands do not consume an allowance.
Internal composition does not double-charge. If one admitted Claim Check invokes Review or Test Evidence as part of its own evidence assembly, it consumes one Claim Check invocation and nothing from the Review or Test Evidence buckets. If you explicitly run Claim Check and then explicitly run Review, each top-level command consumes one unit from its own bucket.
That means the number shown in shipmoor usage corresponds to a command you chose to execute, not Shipmoor’s internal implementation details.
One binary, authorized per device
0.10.0 uses one universal installer and one shipmoor executable for every plan:
curl -fsSL https://dl.shipmoor.dev/install.sh | SHIPMOOR_VERSION=0.10.0 bash
shipmoor version
# shipmoor 0.10.0Every supported product command now requires an authorized account or CI token. On an unauthenticated workstation, running a command such as:
shipmoor scan --changedstarts device authorization, opens the account approval flow, and resumes the original command after approval. The device receives short-lived access credentials and a signed offline entitlement lease. You can inspect the current plan, authorization, and allowance state with:
shipmoor auth status
shipmoor usageNon-interactive, self-managed CI uses a revocable SHIPMOOR_TOKEN. The current CI token path is Scan-only; the individual launch does not quietly promise managed Review or Claim Check pull-request automation.
Account metadata leaves; source stays local
Adding accounts changes the old anonymous-CLI promise, so the privacy statement has to be precise rather than absolute:
Free account. Local execution. No source upload.
Shipmoor runs analysis in your environment. By default, it does not upload source code, diffs, prompts, findings, evidence, file paths, repository names, branch names, tests, or acceptance criteria. It does contact Shipmoor services for authentication, signed entitlements, command allowances, billing when you choose Pro, and features you explicitly enable.
Allowance requests contain operational metadata: opaque account and device identifiers, the command-family key, invocation source, a random idempotency key, and a timestamp. They do not contain the command’s output or project context. The idempotency key is what lets a transport retry recover the original result without decrementing a counter twice.
Your configured coding-agent or model provider remains your own provider relationship. Shipmoor does not introduce a hosted model into this plan change.
What happens to Community and IC
Community maps to Free. IC and Developer map to Pro. Existing paid users retain their access and contractual end dates; the rename does not ask them to buy the same entitlement again.
The old Community and Pro installer URLs remain temporary compatibility shims, but they install the same universal binary. New documentation and acquisition use the universal installer because installer choice no longer grants a plan.
When a 30-day Pro grant ends without a paid subscription, the account falls back to Free. The transition does not delete local configuration, reports, attestations, Agent Harness setup, Agent Skills setup, or other local evidence. Pro-only surfaces lock with an upgrade path; the recurring Free workflow remains available.
Start with the complete product
A plan model should answer two questions clearly: what can I do now, and what continues if I do not pay? In 0.10.0, the answers are full Pro for the first 30 days, then unlimited local Scan, Harness, and Skills plus four separate five-per-month verification allowances on Free. Pro removes those command limits and keeps the complete individual workflow for $19 per month.
Start free, then install the universal CLI and authorize your device. No card, invitation, or separate Community binary is required.
One binary. One account boundary. Four counters you can predict. A Free plan that still does useful work after the trial ends.
- From the
shipmoor.devEngineering Team