Two readings on one pull request: Kodus checking the change against your rules and its ticket, and Aevral adding its security reading of the same change.
| Row | Kodus | Aevral |
|---|---|---|
| Question it answers | Does this change follow the team's rules, and does it satisfy its ticket? | Who has access to what, and does this change widen it? |
| Stated job | Open source AI code review: cross-repo context, enforced team rules, and acceptance-criteria checks against a linked ticket, per Kodus's site | Security reading of the PR diff: access control, business logic, injection, XSS, SSRF, path traversal, LLM integration |
| Where it runs | GitHub, GitLab, Bitbucket, Azure DevOps, and Forgejo or Gitea pull requests, self-hosted or cloud, per Kodus's site | GitHub Check and inline comments, live on install; scans run from the console on a chosen SHA |
| Unit of work | A review comment with a risk score and blast radius across files and repos, per Kodus's site | Up to five findings per review, grounded on the added lines |
| Complementary? | Yes | Yes |
Kodus is built as an open source AI code review platform: its review agent maps the callers, callees, and tests around a change, including code in linked repositories, turns team rules written in plain language into enforced checks, and pulls acceptance criteria from a linked Jira, Linear, or Notion ticket to check whether the pull request satisfies them, per Kodus's site. Aevral is built for a security reading of its own: whether a diff widens who has access to what, or carries injection, XSS, SSRF, path traversal, or LLM-integration flaws. A pull request can satisfy every acceptance criterion on its ticket and still widen an access rule the ticket never mentioned.
The framing is addition, not replacement: Kodus checking the change against team rules and the ticket it closes, and Aevral adding its security reading of the same pull requests with Aevral's PR review, live on install. Aevral also reads the repository snapshot at rest, for authorization, IDOR, and business-logic access control only. This page makes no claim about results on your code.
Kodus
Kodus is an open source AI code review platform (AGPL core) that reviews pull requests on GitHub, GitLab, Bitbucket, Azure DevOps, and Forgejo or Gitea, self-hosted or cloud. Its review agent maps callers, callees, and tests across linked repositories, turns team rules written in plain language into enforced checks, and checks a pull request against acceptance criteria pulled from a linked Jira, Linear, or Notion ticket, per Kodus's site.
Aevral
Security review, handled. PR review, live on install, looks for access control, business logic, SQL and command injection, XSS, SSRF, path traversal, unsafe deserialization, token and session flaws, and LLM-integration risks on the diff. Paid PR plans are live in the console. The whole-repo scan is live and self-serve, and reads authorization, IDOR, and business-logic access control only. A finding is a lead with evidence, and a human decides. No patches are auto-applied.
The linked ticket asks for a refund endpoint with two acceptance criteria: the refund amount stays within the order's own limit, and the action writes an audit log entry. This change meets both: the amount check runs first, and the audit write is the last line before the response.
export async function POST(req: Request) { const session = await requireUser(req); const { orderId, amount, reason } = Refund.parse(await req.json()); const order = await db.order.findUnique({ where: { id: orderId } }); if (amount > order.refundableAmount) throw new Error("over limit"); const refund = await issueRefund(order, amount, reason); await auditLog.write(session.userId, "refund", order.id); return Response.json({ refund });}Both acceptance criteria pass: the amount is checked against the order's own limit, and the audit log is written. Neither criterion asked whether the order belongs to the caller, and the lookup never checks it: any signed-in user can refund any order by id, within that order's own limit. The change is correct against its ticket and still widens who can act on someone else's order, which is the class Aevral reads for on a diff.
Keep Kodus for code review against your team's rules and the ticket it closes; run Aevral for its security reading of the same pull requests, live on install.
No. Kodus does its stated job and keeps doing it. Aevral runs alongside it with its own reading: its PR review, live on install, looks for access control, business logic, injection, XSS, SSRF, path traversal, and LLM-integration security on the pull requests it reviews, and its whole-repo scan reads access control and business logic across the repository at rest.
No. This page states each product's job and shows one worked example of Aevral's own reading. Results on your code depend on your code; evaluations belong to you.
Aevral is self-serve: install the GitHub App and log in to the console. The waitlist form is a launch-updates channel; joining does not reserve a price, access, or a contract.
More comparisons
The shorter version, at a glance: Kodus and Aevral on the works-alongside page.
Primary sources: Kodus: the open source alternative to CodeRabbit; Kodus documentation; Aevral PR security review; Aevral whole-repo scan.
Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.
For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.