cubic vs Ellipsis (2026)

Breadth across classes is met on ticketing, documentation, chat, source control and IDE. The connector set is confirmed as named plan features, with Confluence on Pro rather than on all tiers.

GitHub, Slack, Linear and Sentry integrations let agents open pull requests, post reviews and reply where work started, and each agent's YAML attaches MCP servers and secrets, so the customer can extend the tool surface.

The review-to-fix-to-ticket chain is a real multi-step pipeline, and handing implementation to an external coding agent is a real handoff. Parallel scanning agents with no documented coordination are not multi-agent orchestration, and no branching or conditions are documented.

Agents are defined as YAML in the repository, go live on merge, can start further sessions of their own and run in parallel, each in its own sandbox.

Reviews start automatically when a pull request opens and again on new commits, codebase scans run nightly on Pro, and the AI wiki regenerates on a weekly or monthly schedule, so work reaches the agent without a person starting it. @cubic mentions, Fix with cubic and the CLI add runs a person requests.

Cron schedules and GitHub, Slack, Linear and Sentry events start agents unattended, and mentions, the dashboard, the CLI and the API start them on demand.

Cross-repo reviews and current library documentation both extend grounding past the repository boundary in two directions: into companion repositories and into upstream library docs.

Repositories are cloned fresh into each session alongside a shared skill library and Slack, Linear and Sentry context; no persistent index over the customer's code is documented.

Under a feature called Learns from you, cubic remembers reactions and corrections and applies them to reduce false positives over time. Learnings come from PR comments, reactions and senior reviewers' past reviews, stay scoped to the team, and can be browsed, edited and deleted, with a weekly cleanup that archives outdated guidance. That is learned state accumulating across sessions under the team's control.

Conversation state persists per pull request, issue or Slack thread, and session records are kept up to a year; nothing carries memory across independent sessions.

Auto-approval runs under a per-repository policy the customer sets (low risk only, custom or always), and cubic approves only when its review finds no issues. The docs say no person approves anything before cubic acts, so the policy constrains the agent rather than putting a person in the loop. Shadow mode lets a team preview which pull requests cubic would approve before switching it on; that is covered under testing.

Constraints instead of approvals: each session's GitHub credential is scoped to what its agent declares, budgets cap spend, and code lands only through pull requests the customer merges. No approval step before an agent acts is documented.

The pricing page lists the controls: SSO and SAML through GitHub OAuth, GitHub Enterprise support, exportable compliance audits, bring your own API keys and custom MSA and DPA terms, alongside a SOC 2 attestation. The SOC 2 claim comes from vendor pages rather than a trust center; no trust portal or named audit firm was found.

SOC 2 Type I with Type II in progress, plus roles, scoped API keys, per session credentials, write only secrets and customer set retention; no SSO, SAML or SCIM is documented.

Analytics and an Analytics API are real reporting surfaces, and exportable compliance audits are a real governance artifact. They report on code, review throughput and AI coding usage, not on what the agent itself did and why. There is no retained per-action trace of a review or a background fix.

Every session is recorded and searchable: messages and tool calls show live, transcripts download as unmodified harness output, each session links to the pull requests it produced, and cost is tracked per session, developer and agent.

The local CLI is a client against cubic's cloud rather than a deployment option, and the vendor says CLI findings differ from cloud review. No self-hosted, VPC, on-premises or region-selectable option appears on the pricing page, including Enterprise, which is where such an option would be listed; GitHub Enterprise support and custom MSA and DPA terms are listed there instead. The docs key features page and the enterprise page say the same.

Runs in Ellipsis's cloud or inside the customer's own AWS VPC, where the control plane and sandboxes deploy and no credentials, code or LLM calls leave the account.

Custom agents are reusable, and the docs show a rules library UI, but they are written by the customer rather than shipped as a vendor catalog. The tier caps of five and ten make clear these are configuration slots rather than a marketplace.

Templates deploy from a gallery in one command and a code review agent is published as example YAML, but the gallery's contents are not listed.

cubic's privacy page names OpenAI and Anthropic as the providers it runs on, so more than one provider is disclosed, but cubic makes the choice. Enterprise lists bring your own API keys with no model or provider selection, and supplying a key is not choosing a model.

Model choice per session and agent across Claude, GPT, GLM-5.2 and MiniMax M3, and a personal Claude or ChatGPT subscription can pay for sessions a user starts.

Two MCP servers, an Analytics API and a documented CLI make a real outward extensibility surface: cubic ships servers that other agents call. Bring your own API keys appears only as an Enterprise line item with no documented model selection, so it does not add model choice.

Ellipsis can be driven from code: a REST API with a published OpenAPI specification starts, streams, messages and stops sessions and manages agents, environments, secrets and webhooks, with Python and TypeScript SDKs and a CLI over the same surface.

Shadow mode tests the agent itself: cubic stays in comment-only mode on real pull requests and reports whether it would have approved each one, so a team sees how the agent behaves under its chosen policy before giving it live authority. cubic's bug detection tests the customer's code, not the agent. The vendor's reported #1 ranking on Martian's benchmark at 61.8 percent F1 is a vendor claim about a third-party benchmark, not a harness customers run.

Agents run the customer's tests and a review agent checks each push, but nothing evaluates the agent's own behavior.

No computer use is documented. Reviewing code in an isolated container while navigating with grep and jump-to-definition is programmatic access, not operating software through its interface. The docs key features page, the pricing page and the marketing site show no browser, screenshot or GUI capability. This is not documented rather than shown to be absent.

Code execution in a sandbox rather than computer use: the current docs name no browser, desktop or computer control tool for the agent.