{ "name": "Aevral", "description": "Aevral is an AI security reviewer for GitHub pull requests. Security review, handled. Your agents open pull requests faster than anyone can read them. Without a reviewer, the security flaw still ships in the product you own. Pull-request reviews look for access control, business logic, SQL and command injection, XSS, SSRF, path traversal, unsafe deserialization, token and session flaws, and LLM-integration risks. A suggested fix you apply. After the GitHub App is installed, the next pull request can already be reviewed, even before anyone signs in; paid PR plans live in the console. The whole-repo scan reads the repository snapshot for authorization, IDOR, and business-logic access control only. Not a general SAST: no memory corruption, no secret or dependency scanning. Findings are leads with evidence; a human decides. No patches are auto-applied. Open-source models, processed in the US today, EU-only option announced. Priced by organization, not by seat. Self-serve: install https://github.com/apps/aevral and log in to the console. Coding-agent plugin: https://github.com/better-isms/aevral-plugin. Built by Better ISMS, the company behind ISMS Copilot, in Paris, France.", "url": "https://aevral.com", "provider": { "organization": "Better ISMS", "url": "https://betterisms.co" }, "manifest_version": "1.0.0", "product_version": "0.1.0", "status": { "state": "self-serve", "open_source": "Aevral is not open source. The engine, the planted-vulnerability corpus, and the judge stay private. What is public: the transparency report, the methodology page, the agent-setup prompt, and the plugin repo.", "whole_repo_scan": "live: install the GitHub App, then sign in to the console with GitHub (it connects the install)", "pr_review": "after GitHub App install the next pull request can already be reviewed, even before anyone signs in; paid PR plans live in the console" }, "capabilities": { "content": "Honest marketing site: two products (PR security review live on install, paid plans live in the console; whole-repo scan live and self-serve). PR review looks for access control, business logic, injection, XSS, SSRF, path traversal, and LLM-integration flaws; the whole-repo scan reads authorization, IDOR, and business-logic access control only. Named competitors: Claude Security and Codex Security. Aikido is complementary as a platform; Code Security Audit is agentic reading of source for authorization, IDOR, and business logic, the reading Aevral's whole-repo scan is built for (https://aevral.com/compare/aikido).", "formats": [ "text/html", "text/plain" ], "llms_txt": "https://aevral.com/llms.txt", "llms_full": "https://aevral.com/llms-full.txt", "ai_txt": "https://aevral.com/ai.txt", "docs": "https://docs.aevral.com/docs", "pricing": "https://aevral.com/pricing", "install": { "state": "live", "note": "Install the public GitHub App at https://github.com/apps/aevral, then log in to the console. Coding-agent plugin: https://github.com/better-isms/aevral-plugin (aevral@aevral-plugins)." }, "api": { "state": "partial", "note": "aevr_ API keys exist today (console Developer API page, show-once): they can start and read scans, and read plan and usage (GET https://aevral-worker-prod.fly.dev/v1/usage), for their own organization. Billing is console-session-only: a key cannot subscribe or upgrade; the usage response can carry a link an owner or admin opens in the console. Use a key only if one is already in the environment; never ask a human to paste one into chat. Documented key routes are listed below; do not invent others.", "base_url": "https://aevral-worker-prod.fly.dev", "auth": { "scheme": "bearer", "header": "Authorization: Bearer $AEVRAL_API_KEY", "key_prefix": "aevr_", "env_var": "AEVRAL_API_KEY", "note": "Agents read the key from the AEVRAL_API_KEY environment variable. Never ask a human to paste a key into chat; never put a key in a URL." }, "routes": [ { "method": "POST", "path": "/v1/scans", "summary": "Start a whole-repo scan. Body: installation_repo_id (GitHub numeric repo id), idempotency_key (required), sha (optional, omit for the default branch head). 202 new or 200 duplicate. status_url (and the Location header) is present whenever scan_id is a UUID; if it is missing, build no URL and report the malformed response.", "docs": "https://docs.aevral.com/docs/scan-api" }, { "method": "GET", "path": "/v1/scans/{id}", "summary": "Read a scan. Poll status_url every 30s; scans take 10 to 40 minutes. Terminal statuses: findings, no_confirmed_findings, scan_incomplete, unsupported_repo, failed. 502 scan_lookup_failed means the status is unknown: retry after retry_after seconds.", "docs": "https://docs.aevral.com/docs/scan-api" }, { "method": "GET", "path": "/v1/usage", "summary": "Read-only plan, usage and cap for the key's organization.", "docs": "https://docs.aevral.com/docs/usage-api" } ], "docs": "https://docs.aevral.com/docs/scan-api" }, "mcp": { "state": "planned", "note": "No live MCP endpoint today; an MCP server is planned. Do not claim one." }, "signup": { "install_github_app": "https://github.com/apps/aevral", "console_login": "https://app.aevral.com/login", "contact": "https://tally.so/r/PdxdbV", "enterprise_quote": "https://tally.so/r/PdxdbV" }, "plans": { "pr_review": "https://aevral-worker-prod.fly.dev/v1/pr/billing/plans", "scans": "https://aevral-worker-prod.fly.dev/v1/billing/plans", "note": "Public JSON, no key. Quote plan names and prices only from these endpoints, never from memory. Amounts in cents, USD, per organization, excluding VAT." }, "usage": { "endpoint": "https://aevral-worker-prod.fly.dev/v1/usage", "docs": "https://docs.aevral.com/docs/usage-api", "note": "Read-only plan, usage and cap for the key's organization. pr.action.url is a console billing link only an owner or admin can act on; an agent never upgrades and never opens it in an automated browser." }, "docs_llms": "https://docs.aevral.com/llms.txt", "docs_hub": "https://docs.aevral.com/docs/for-ai-agents" } }