Security review, handled. Reviews start when the App is installed. Suggested fixes you apply. The whole-repo scan is live and reads access control. Aevral competes with Claude Security as an AI security reviewer for GitHub pull requests. Aevral is not a lab: it runs on open-source models, processed in the US today, with an EU-only option announced. Compare current coverage, access, price, and fix paths below.
Last verified 2026-09-29. Primary sources: Claude Security product page; Use Claude Security (help). Review monthly and on known product changes.
| Row | Aevral | Claude Security |
|---|---|---|
| Job | Security review, handled. Reviews start when the GitHub App is installed, then a scan of the repository. Suggest fixes you apply: a finding can carry a suggested diff, plus a prompt for your coding agent. | Scan the codebase, validate findings, and suggest patches for human review. |
| Target coverage | PR review looks for access control, business logic, SQL and command injection, XSS, SSRF, path traversal, unsafe deserialization, token and session flaws, and LLM-integration risks. Whole-repo scans read authorization, IDOR, and business-logic access control only. Not memory corruption, not secret or dependency scanning, not a general SAST. PR review is live on install; paid PR plans are live in the console. | memory corruption, injection, authentication bypasses, complex logic / authz / IDOR, and cross-file issues. Published as the hosted product focus. |
| Models | Open-source models. Processed in the US today, EU-only option announced. | Hosted scans run on Claude Mythos 5.1, per the product page (the help article still names Mythos 5). Users receive findings without direct model access. |
| Price shape | PR security review, USD per organization per month: Starter $49 (100 PR reviews a month, counted per pull request), Pro $199 (500), Business $999 (3,000, plus a monthly export of the security reviews Aevral ran on your pull requests, with coverage and results, that may serve as supporting evidence for automated security testing in audits (for example ISO 27001 A.8.29, SOC 2 CC8.1), and EU-only processing when it is available), Scale $1,999 (6,500, everything in Business), then $0.99 per extra PR review on every paid plan if the owner chose extras; Enterprise from $4,000 a month by conversation; public repositories free. Whole-repo scan, USD: Public repositories $0 (1 authorized public-repo scan / month), Team $99 / org / month (4 then $29), Business $399 (16 then $19), Scale $1,699 (100 then $17). Enterprise by quote from $3,300 per month equivalent (200 scans and up, $16.50 per scan minimum, annual, invoice billing; not self-serve, console features not shipped). Excluding VAT; scans HT, B2B. | Claude Enterprise plan plus token usage. No additional platform fee for Claude Security. |
| Seats | No per-seat. Priced by organization. No floor to start. | Hosted Mythos 5.1 scans: Claude Enterprise. Plugin: any Claude Code user on a paid plan, using that account's models, not Mythos. |
| Where it runs | GitHub App and console. PR review, live on install, posts an advisory Check and finding comments. Scans report through a GitHub Check. Paid PR plans are live in the console. | Hosted: claude.ai/security after an admin enable, GitHub you own. Plugin: local Claude Code session, using the models on that account. |
| Fix path | Suggested fix as a prompt you copy into Claude Code, Cursor, or Codex. Copy fix prompt. A finding can also carry a suggested diff you apply. No auto-applied patches; Aevral never applies or merges the fix. | Integrated suggested patch. Review and apply in Claude Code. Every patch needs a human. |
| Data / trust | Family trust center at trust.ismscopilot.com. Better ISMS is getting ISO 27001 certified. Intended scope includes Aevral. We are not certified today. Aevral is not a product certificate. | Anthropic's published help: no Zero Data Retention for Claude Security. Review their trust materials for the binding text. |
| Availability | Self-serve for PR security review and whole-repo scans. Install the GitHub App, then sign in to the console with GitHub; it connects the install automatically. PR review is live on install; paid PR plans are live in the console. | Hosted scans: public beta for Claude Enterprise. Plugin: beta for Claude Code users. |
Aevral is not affiliated with, endorsed by, or sponsored by Anthropic or OpenAI. Claude, Claude Security, Codex, and Codex Security are used nominatively to identify the products we compete with. No Anthropic or OpenAI logo or trade dress appears on this site.
Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.
For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.