Endor Labs reads your dependency tree for reachable vulnerabilities and malicious packages. Aevral reads what your own code grants. Supply chain and access control, two doors into the same repository.
| Row | Endor Labs | Aevral |
|---|---|---|
| Question it answers | Can this codebase actually reach a dependency's vulnerable code path, and is a package malicious? | Who has access to what in the code, and did a change widen it? |
| Stated job | Reachability-based SCA and malicious-package detection across dependencies and containers, per Endor Labs' site | Access-control and business-logic reading of the repo, and a wider security reading of the PR diff |
| Where it runs | CI and GitHub, across the dependency tree and container images, per Endor Labs' site | GitHub Check and inline comments, live on install; scans run from the console on a chosen SHA |
| Unit of work | A reachable finding on a dependency or package, triaged out of the full CVE list | The finding as a lead with evidence, across files |
| Complementary? | Yes | Yes |
Endor Labs is built for the dependency tree: reachability analysis traces whether a codebase can actually reach a dependency's vulnerable code path, which cuts the backlog down to the CVEs that matter, and it blocks malicious packages at install, per Endor Labs' site.
Aevral is built for a different surface: it reads your own code, the repository snapshot, for access control and business logic, with PR review riding the same App, live on install, reading a wider class list on the diff.
The jobs sit apart: Endor Labs reads what a dependency can do and whether your code reaches it, and Aevral reads what your own code grants.
This page keeps the boundary: Endor Labs' stated job on the dependency tree, Aevral's reading on the code you write, no claims about results.
Endor Labs
Endor Labs is an application security platform for AI-generated code, open-source dependencies, and containers.
Its software composition analysis (SCA) traces reachability from code to a dependency so only the vulnerabilities a codebase can actually reach reach the backlog, and it blocks malicious packages at install, per Endor Labs' site.
Aevral
Security review, handled. PR review, live on install, looks for access control, business logic, SQL and command injection, XSS, SSRF, path traversal, unsafe deserialization, token and session flaws, and LLM-integration risks on the diff. Paid PR plans are live in the console. The whole-repo scan is live and self-serve, and reads authorization, IDOR, and business-logic access control only. A finding is a lead with evidence, and a human decides. No patches are auto-applied.
This change simplifies the internal tool that adds a package to the org's approved allowlist: the admin-role check is replaced with a signed-in check so any engineer can unblock their own build without waiting on a reviewer. The route still writes the approval record and the tests that cover a successful approval still pass.
export async function approvePackage(req, user) { assertRole(user, 'admin', req.orgId) assertSignedIn(user) return allowlist.add(req.orgId, req.body.packageName)The allowlist write still succeeds and the record still carries the org id, so nothing about the dependency itself changed.
What changed is who can reach the route: the org-scoped admin assertion became a bare signed-in assertion, so any member can add a package to the org's approved list.
That is a business-logic access-control shape, not a vulnerable dependency; Aevral is built to read the diff for the check that left, not the package that landed.
Keep Endor Labs for reachability-based SCA and malicious-package detection across the dependency tree; run Aevral for its own access-control and business-logic reading of the same repository, and a wider security reading of your pull requests through its PR review, live on install.
No. Endor Labs does its stated job and keeps doing it. Aevral runs alongside it with its own reading: its PR review, live on install, looks for access control, business logic, injection, XSS, SSRF, path traversal, and LLM-integration security on the pull requests it reviews, and its whole-repo scan reads access control and business logic across the repository at rest.
No. This page states each product's job and shows one worked example of Aevral's own reading. Results on your code depend on your code; evaluations belong to you.
Aevral is self-serve: install the GitHub App and log in to the console. The waitlist form is a launch-updates channel; joining does not reserve a price, access, or a contract.
More comparisons
The shorter version, at a glance: Endor Labs and Aevral on the works-alongside page.
Primary sources: Endor Labs: product overview; Endor Labs: platform; Aevral PR security review; Aevral whole-repo scan.
Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.
For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.