Two readings on one pull request: Greptile's review of the change with codebase context, and Aevral, through its PR review, live on install, adding its security reading.
| Row | Greptile | Aevral |
|---|---|---|
| Question it answers | Does this change fit the codebase, and does it add security risks? | Who has access to what, and does this change widen it? |
| Stated job | AI code review of pull requests with a graph index of the codebase, custom rules and learning, and Security Check security review; TREX, a beta test agent, also offered, per Greptile's site | Security reading of the PR diff (access control, business logic, injection, XSS, SSRF, path traversal, LLM integration), and an access-control and business-logic reading of the whole-repo snapshot at rest |
| Where it runs | GitHub and GitLab pull requests, plus MCP, IDE handoffs, and a Claude Code plugin, per Greptile's site | GitHub Check and inline comments, live on install; scans run from the console on a chosen SHA |
| Unit of work | Review comments on the diff; TREX test runs as a separate offering | Up to five findings per review, grounded on the added lines; scan findings come as leads with evidence |
| Complementary? | Yes | Yes |
Greptile builds a graph index of the repository, then reviews each pull request with a swarm of agents, and Greptile describes the review scope as style violations, security risks, and multi-file logical bugs; its Security Check page names an authorization-bypass example. It also offers TREX, a beta agent that writes and runs tests for a pull request in a sandbox, per Greptile's site. Aevral is built for a reading of its own: its PR review, live on install, looks for access control, business logic, injection, XSS, SSRF, path traversal, unsafe deserialization, token and session flaws, and LLM-integration risks on the change, and its whole-repo scan reads who has access to what: authorization, IDOR, and business-logic access control. Good code and safe access are separate properties; a change can read well while moving the other.
With Aevral's PR review, live on install, both readings sit on the same pull request: Greptile reviewing the change with codebase context, and Aevral reading it for security flaws. Greptile publishes security among its review scope; Aevral reads access control and business logic at rest, and a wider security class list on the pull request. The framing stays complementary: each tool does the job it publishes, and this page makes no claim about results on your pull requests.
Greptile
Greptile is an AI code reviewer. It indexes the codebase as a graph, then reviews pull requests with agents that read the change with full codebase context and learn team standards from review comments, per Greptile's site. It also offers TREX, a beta agent that writes and runs tests for a pull request in a sandbox.
Aevral
Security review, handled. PR review, live on install, looks for access control, business logic, SQL and command injection, XSS, SSRF, path traversal, unsafe deserialization, token and session flaws, and LLM-integration risks on the diff. Paid PR plans are live in the console. The whole-repo scan is live and self-serve, and reads authorization, IDOR, and business-logic access control only. A finding is a lead with evidence, and a human decides. No patches are auto-applied.
This change flattens two guards into one because the billing page already displays the plan. The route passes the signed-in check, the audit line is written, and the tests that exercise the happy path still pass.
export async function entitlement(userId: string, caller) { assertOwner(caller, userId) assertSignedIn(caller) return plans.active(userId)The caller is signed in, the plan is still returned, and the audit line is written. What changed is the check: the owner assertion became a bare signed-in assertion, so any signed-in caller who can name another user's id reads that user's entitlements. That is the Broken Object Level Authorization shape (OWASP API1:2023): the object reference is caller-controlled and the server stopped binding it to the entitled principal. Aevral is built to read a diff for the binding that left, not the route that stayed.
Keep Greptile for codebase-aware review and TREX tests on pull requests; run Aevral for its security reading of the same pull requests and the access-control reading of the whole-repo snapshot, live on install.
No. Greptile does its stated job and keeps doing it. Aevral runs alongside it with its own reading: its PR review, live on install, looks for access control, business logic, injection, XSS, SSRF, path traversal, and LLM-integration security on the pull requests it reviews, and its whole-repo scan reads access control and business logic across the repository at rest.
No. This page states each product's job and shows one worked example of Aevral's own reading. Results on your code depend on your code; evaluations belong to you.
Aevral is self-serve: install the GitHub App and log in to the console. The waitlist form is a launch-updates channel; joining does not reserve a price, access, or a contract.
More comparisons
The shorter version, at a glance: Greptile and Aevral on the works-alongside page.
See the wider field: Greptile alternatives.
Primary sources: Greptile code review agent; Greptile; Greptile Security Check; Aevral PR security review; Aevral whole-repo scan.
Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.
For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.