Marshal runs inside your infrastructure. You pay a platform fee for your deployment and a monthly seat for each engineer. Compute, storage and model tokens stay on your own bill, so what we quote is all you pay us.
A platform fee
One deployment in your own Kubernetes cluster, with every security control switched on.
A seat per engineer
Each seat covers unlimited interactive Spaces. Seats are sold in blocks of five.
Deputies, by concurrency
Agents that work on their own. Your plan sets how many run at once; runs are unlimited.
Marshal Dispatch: your GitHub Actions, in secured ephemeral Spaces (coming soon)
SLA and a dedicated engineer
Your own private marketplace
Bring your own integrations, org-scoped
Security review and contract redlines
Most of the starting figure is the platform fee. The cost per engineer falls sharply as the team grows. Tell us your team size and we will walk you through the numbers.
Every figure on this page is an estimate, for working out roughly what a deployment costs. The approved prices are the ones in Marshal’s price catalogue. That is what any quote or agreement is based on.
Deputies
How Deputies work
A Deputy is an agent that works on its own, in its own Space, with no engineer at the keyboard. Your plan sets how many run concurrently.
Trigger: what starts it
A schedule or the CLI, from Team upward. The API, webhooks (a new issue, a failed check) and MCP start on Advanced.
What it may touch
A Deputy is bound to a manifest that fixes exactly what it may touch: which repos, which tools, which MCP servers, which databases and which network destinations. Marshal re-checks that binding at every launch, and hands over credentials without the Deputy ever seeing them.
Slack: work with your agents
Any agent can ask you a question or request sign-off in Slack, and wait. That includes a session an engineer is driving and a Deputy running on its own. You answer with one click: Approve, Decline, or whichever choices it offered. For a longer answer, or to review the work, the message links straight into Marshal. Available from Team.
Escalation: when it gets stuck
If the Deputy needs something its manifest does not allow, it does not guess. It pauses and pulls an engineer into the live run, who can approve, deny or take over. Available from Advanced.
Compare
Compare plans
Feature
Essentials
Team
Advanced
Enterprise
Plan fit
Team size
10 to 15
Up to 50
Up to 100
100+
Seats sold in
blocks of 5
blocks of 5
blocks of 5
Custom
Spaces
Interactive Spaces per engineer
Unlimited
Unlimited
Unlimited
Unlimited
Any supported agent: Claude Code, Codex, Cursor, Gemini, Copilot, Grok, OpenCode, Hermes and more
✓Included
✓Included
✓Included
✓Included
Your own IDE over Remote-SSH
✓Included
✓Included
✓Included
✓Included
Preview URLs, bridged ports, Docker Compose in your Space
✓Included
✓Included
✓Included
✓Included
Run workbench: terminal, ports, preview, live transcript
✓Included
✓Included
✓Included
✓Included
Change set: every file the run touched, as a review view
Secrets brokered just in time, so the agent never holds one
✓Included
✓Included
✓Included
✓Included
Egress control, fully logged
✓Included
✓Included
✓Included
✓Included
Guardrails on every tool, MCP server and database
✓Included
✓Included
✓Included
✓Included
Database gateway: connect without sharing credentials
✓Included
✓Included
✓Included
✓Included
Every Space bound to a manifest (repos, tools, MCP servers, databases, egress), re-checked at every launch
✓Included
✓Included
✓Included
✓Included
Deputies
Concurrent Deputies
–
10
25
Unlimited
Extra Deputies
–
In packs of 5
In packs of 5
Custom
Triggers: schedule, CLI
–Not included
✓Included
✓Included
✓Included
Triggers: API, webhooks, MCP
–Not included
–Not included
✓Included
✓Included
Take over mid-run by hand, then hand it back
–Not included
–Not included
✓Included
✓Included
Escalation: pulls an engineer into the live run
–Not included
–Not included
✓Included
✓Included
Marshal Dispatch: secure CI
Your workflows, unchanged: swap runs-on: ubuntu-latest for marshal-dispatch
–Not included
–Not included
–Not included
Coming soon
Every job gets a fresh, isolated Space as its runner
–Not included
–Not included
–Not included
Coming soon
Per-job egress policy, every request logged
–Not included
–Not included
–Not included
Coming soon
Per-run egress audit trail you can hand an auditor
–Not included
–Not included
–Not included
Coming soon
docker build inside an egress-controlled sidecar
–Not included
–Not included
–Not included
Coming soon
Audit and access
Google SSO
–Not included
✓Included
✓Included
✓Included
SAML and Okta SSO
–Not included
–Not included
–Not included
Coming soon
RBAC
–Not included
–Not included
–Not included
✓Included
SCIM provisioning
–Not included
–Not included
–Not included
Coming soon
Audit log retention
7 days
14 days
Configurable
Configurable
Audit export to your S3, GCS or Azure bucket
–Not included
–Not included
✓Included
✓Included
Deployment and support
Bring your own KMS or Vault
–Not included
–Not included
✓Included
✓Included
Multi-cluster
–Not included
–Not included
–Not included
✓Included
Air-gapped install
–Not included
–Not included
–Not included
Coming soon
Support
Email
Email and Slack
Priority
SLA and dedicated engineer
Questions
Questions
What does a seat include?
An engineer who can open Spaces. Each seat includes unlimited interactive Spaces, so engineers can run as many agent sessions as they need. Seats are sold in blocks of five, so a team of twelve buys fifteen.
What is a Deputy?
An agent that works headless, with no engineer at the keyboard, in its own isolated Space. Your plan sets how many run concurrently; runs are unlimited. Need more? They are added in packs of five, up to 25. Beyond that we price it with you.
Where does Marshal run?
In your own Kubernetes cluster: GKE, EKS or k3s. Code, credentials and agent traffic stay in your infrastructure, so compute is yours and not part of our price.
Estimates in USD, excluding VAT. Marshal’s price catalogue is the approved source.