Two readings on one pull request: Greptile's review of the change with codebase context, and Aevral, through its live opt-in PR review, adding the authorization and business-logic reading.
| Row | Greptile | Aevral |
|---|---|---|
| Question it answers | Does this change fit the codebase, and does it add security risks? | Who has access to what, and does this change widen it? |
| Stated job | AI code review of pull requests with a graph index of the codebase, custom rules and learning, and Security Check security review; TREX, a beta test agent, also offered, per Greptile's site | Authorization, IDOR, and business-logic reading of the PR diff, and of the whole-repo snapshot at rest |
| Where it runs | GitHub and GitLab pull requests, plus MCP, IDE handoffs, and a Claude Code plugin, per Greptile's site | GitHub Check and inline comments, opt-in per organization; scans run from the console on a chosen SHA |
| Unit of work | Review comments on the diff; TREX test runs as a separate offering | Up to two findings per opt-in review, grounded on the added lines; scan findings come as leads with evidence |
| Complementary? | Yes | Yes |
Greptile builds a graph index of the repository, then reviews each pull request with a swarm of agents, and Greptile describes the review scope as style violations, security risks, and multi-file logical bugs; its Security Check page names an authorization-bypass example. It also offers TREX, a beta agent that writes and runs tests for a pull request in a sandbox, per Greptile's site. Aevral is built for a reading of its own: does a change widen who has access to what, an authorization, IDOR, or business-logic access-control issue. Good code and safe access are separate properties; a change can read well while moving the other.
With Aevral's PR review, live and opt-in, both readings sit on the same pull request: Greptile reviewing the change with codebase context, and Aevral reading it for the access questions. Greptile publishes security among its review scope; Aevral's single job is the access reading, at rest and on the pull request. The framing stays complementary: each tool does the job it publishes, and this page makes no claim about results on your pull requests.
Greptile
Greptile is an AI code reviewer. It indexes the codebase as a graph, then reviews pull requests with agents that read the change with full codebase context and learn team standards from review comments, per Greptile's site. It also offers TREX, a beta agent that writes and runs tests for a pull request in a sandbox.
Aevral
Aevral is a security researcher for your code, built to read authorization, IDOR, and business-logic access control with cross-file context. The whole-repo scan is live and self-serve; PR review is live and opt-in per organization; paid PR plans are live in the console. A finding is a lead with evidence, and a human decides.
This change flattens two guards into one because the billing page already displays the plan. The route passes the signed-in check, the audit line is written, and the tests that exercise the happy path still pass.
export async function entitlement(userId: string, caller) { assertOwner(caller, userId) assertSignedIn(caller) return plans.active(userId)The caller is signed in, the plan is still returned, and the audit line is written. What changed is the check: the owner assertion became a bare signed-in assertion, so any signed-in caller who can name another user's id reads that user's entitlements. That is the Broken Object Level Authorization shape (OWASP API1:2023): the object reference is caller-controlled and the server stopped binding it to the entitled principal. Aevral is built to read a diff for the binding that left, not the route that stayed.
Keep Greptile for codebase-aware review and TREX tests on pull requests; run Aevral for the authorization and business-logic reading of the same pull requests and the whole-repo snapshot, opt-in per organization.
No. Greptile does its stated job and keeps doing it. Aevral runs alongside it with its own reading: authorization, IDOR, and business-logic access control across the repository, and across every pull request through its opt-in PR review.
No. This page states each product's job and shows one worked example of Aevral's own reading. Results on your code depend on your code; evaluations belong to you.
Aevral is self-serve: install the GitHub App and log in to the console. The waitlist form is a launch-updates channel; joining does not reserve a price, access, or a contract.
More comparisons
The shorter version, at a glance: Greptile and Aevral on the works-alongside page.
Primary sources: Greptile code review agent; Greptile; Greptile Security Check; Aevral PR security review; Aevral whole-repo scan.
One GitHub App. A report with evidence. A prompt for the agent you already use.