Ellipsis vs Graphite (2026)

The GitHub App, Slack and Linear integrations let agents open pull requests, post reviews and answer in the thread or ticket that started them, and a Sentry integration is documented but not generally released, with Jira listed as coming. Each agent's environment attaches MCP servers (Slack, Linear, remote or local) and secrets for further tools, so the customer extends the tool surface. GitLab no longer appears on the current site.

Sourceellipsis.dev/docs/integrations and docs/environmentsread 2026-10-28

Deep GitHub integration spans repositories, pull requests, CI and merge, with GitHub Enterprise Server supported on Enterprise. Developers work through a CLI for stacked pull requests and simplified git commands, a VS Code extension, a Mac menu bar app, MCP, a web pull request page and a PR inbox. Slack notifications and a Linear integration ship from Starter, with advanced integrations on Team and above.

The CI optimizer integrates Buildkite and GitHub Actions. Cursor Cloud Agents appear inside the pull request for authors on a paid Cursor plan, opening draft pull requests and committing fixes to the branch. The agent acts by commenting inline, applying suggested fixes, generating PR titles and descriptions, summarizing CI failures, restacking and merging through the queue.

Sourcegraphite.com/pricing, docs/integrations and docs/agentsread 2026-10-28

Agents are YAML files in the repository declaring trigger, harness, model, prompt, environment, permissions and budget, live on merge and previewed on branches. Parallel sessions each run in their own sandbox, branch and pull request, with a default of 32 live sessions per account, agents can start further sessions of their own, and a person can steer a session mid task. The documented harnesses are Claude Code, Codex and Gemini CLI; OpenCode, Copilot, Cursor, Pi, Grok Code and Antigravity are listed as not yet available, and no sub agent mechanism is documented.

Sourceellipsis.dev/docs/agents, docs/harnesses and ellipsis.dev/pricingread 2026-10-28

A stack aware merge queue sequences approved pull requests to keep the trunk branch green. It comes as Basic on Team and as Advanced, with additional settings, on Enterprise, and an external merge queue integration is in beta.

The queue also rebases stacked branches automatically as earlier changes land, so a chain of dependent pull requests stays current without manual intervention. An Automations engine and a CI optimizer batch and selectively trigger test runs, integrated with Buildkite and GitHub Actions. Within the pull request, Graphite Agent chains review into suggested fixes, CI summaries and collaborative merge.

Sourcegraphite.com/pricing, docs/graphite-merge-queue and docs/external-merge-queue-integrationread 2026-10-28

Each agent carries one trigger: a cron schedule in UTC, or an event on GitHub pull requests (opened, pushed, merged, closed, review submitted, commented), pushes, issues (opened, labeled), check runs, check suites, workflow runs, statuses and releases, Linear issues, Slack channel creation or Sentry events, and each run starts a session with no one invoking it. Sessions also start on demand from @ellipsis mentions, the dashboard, the CLI and the API. Issue assignment is not a trigger, and webhooks are outbound only.

Sourceellipsis.dev/docs/agents/triggersread 2026-10-28

Every pull request gets an automatic review from Graphite Agent when it is opened or updated. Automations act on pull request events to assign reviewers and add labels. Developers also reach the agent from the PR page, Graphite Chat, the CLI, VS Code and MCP.

Sourcegraphite.com/docs/ai-reviews, docs/automations and graphite.com/pricingread 2026-10-28

Context is assembled per session. Each session checks out the repositories its environment names from a cached environment image, so the Claude Code, Codex or Gemini CLI harness reads the working tree directly, alongside Codex skills and connected Slack, Linear and Sentry context. There is no persistent index, graph or embeddings layer over the customer's code.

Sourceellipsis.dev/docs/environments and docs/sessionsread 2026-10-28

Optional code indexing keeps an index of the files in each synced repository and speeds Graphite Chat's tool calls and the PR page; reviews that draw on related files through the index, and faster merges, are marked coming soon, so for now the agent's reviews are not grounded in it. By default Graphite stores no code and reads it from GitHub, and an index that is turned off is deleted within 30 days. Style guides and rules work as instructions to the review agent.

Sourcegraphite.com/docs/code-indexing and docs/ai-review-customizationread 2026-10-28

A session stays open for follow ups that continue the same workspace, and a mention starts a durable conversation per pull request, issue or Slack thread that later replies continue, with session records kept for a customer set retention of up to a year. That state stays within one thread. No memory layer with its own scope and lifetime that the agent reads across independent sessions is documented.

Sourceellipsis.dev/docs/sessions and docs/agents/triggersread 2026-10-28

Team written custom rules and file based rules persist and apply to every review. Graphite Agent also learns from whether developers accept or reject its comments, though no scope, lifetime or purge path is stated for what it learns.

Sourcegraphite.com/docs/ai-review-customization and docs/ai-reviews; graphite.com/docs/ai-reviewsread 2026-10-28

Ellipsis constrains what an agent can do rather than gating its actions. Permissions declared per agent limit each session's GitHub credential to named repositories and to read only or specific write scopes and set its Ellipsis API scopes, and hard budgets stop model requests per session, agent, developer and account before compute starts.

A code review agent's output is set to stay silent, comment or approve on a pass and to comment or request changes on a fail, with blocking comments marked, and work reaches the codebase as pull requests the customer merges on its own code host. There is no step where a person approves an agent action before it commits, and no plan review or auto merge.

Sourceellipsis.dev/docs/permissions, docs/budgets and docs/code-reviewread 2026-10-28

Review output is advisory. Findings land as inline comments and suggested fixes that a developer chooses to apply. Graphite Chat lets the developer interrogate and refine a suggestion before committing, and the person stays accountable for the merge.

Teams constrain the review agent through AI review customization, which covers automations, filters and rules, and through an imported style guide. The merge queue gates what reaches trunk under rules the team configures, with advanced settings on Enterprise, and ACLs on Enterprise limit access. Graphite names no approval gate for each agent action, no permission scoping for the agent itself and no shadow mode.

Sourcegraphite.com/pricing, docs/graphite-chat and graphite.com/featuresread 2026-10-28

SOC 2 Type I certification is in place, with Type II in progress and no trust page. Access controls cover owner and administrator roles for account settings with per developer spend limits, scoped API keys, per session GitHub credentials minted at the permissions each agent declares and revoked within an hour at teardown, write only secrets, zero source retention, and customer set session data retention from zero hours to one year with deletion within four hours of expiry. There is no SSO, SAML or SCIM support.

Sourceellipsis.dev/docs/security, platform/security and docs/api/authenticationread 2026-10-28

The Enterprise plan includes SAML and SSO, access control lists, an audit log with SIEM export, GitHub Enterprise Server support, a custom MSA and private uploads. Admins also get code indexing controls and AI privacy controls. Graphite is SOC 2 Type II compliant and continuously penetration tested, with GitHub tokens encrypted at rest under AES 256 and keys held in AWS Secrets Manager. Its AI features are opt in and do not train on customer code. The security page now sends SOC 2 report requests to trust.cursor.com.

Sourcegraphite.com/pricing and graphite.com/docs/privacy-and-securityread 2026-10-28

Every session is recorded. The dashboard and CLI show messages and tool calls as they happen, session events, turns and records are readable over the API, and an audit trail covers commands, file changes and tool calls. Transcripts are downloadable as unmodified Claude Code, Codex and Gemini CLI output, sessions are searchable and linked to the pull requests they produced, code review history is kept in the dashboard, and cost and token, CPU and memory usage are tracked per session, developer and agent.

Sourceellipsis.dev/docs/sessions and platform/observabilityread 2026-10-28

Team insights ship from Starter, with custom analytics on Enterprise, and give engineering leaders throughput and cycle time reporting. An audit log with SIEM export is available on Enterprise. A PR inbox centralizes reviews, review findings persist as durable inline comments on the pull request, and CI summaries explain failures in place. These report on team throughput and account access. Graphite names no trace of each step in the review agent's own reasoning, and no agent execution record, session history or replay.

Sourcegraphite.com/pricing and docs/insightsread 2026-10-28

Ellipsis comes in two offerings. With Managed SaaS, each session runs in its own sandbox VM in Ellipsis's cloud, sized by the agent's compute setting, and Your AWS Account deploys the control plane and agent sandboxes into the customer's AWS VPC with no credentials, code or LLM calls leaving it, billed by AWS. Session data retention is set by the customer. No region choice is stated.

Sourceellipsis.dev/pricing and docs/environmentsread 2026-10-28

The product is hosted software on AWS, delivered through a GitHub app with a CLI and VS Code extension as clients. The Enterprise tier adds GitHub Enterprise Server support and private uploads, which let Graphite work with a code host the customer runs itself. Graphite itself does not run in the customer's environment. There is no self hosted, on premises, VPC or private instance option on any tier, Enterprise included, and customers cannot choose a region.

Sourcegraphite.com/pricing and docs/privacy-and-securityread 2026-10-28

A code review agent is available as example YAML with documented output settings, Codex sessions take up to ten skills (Claude Code and Gemini skills are not supported), and skills install with npx skills add. The docs describe no template gallery, prebuilt agent library or review rule packs, only use case pages and guides.

Sourceellipsis.dev/docs/code-review and docs/agentsread 2026-10-28

A single agent, Graphite Agent, does the reviewing. The custom rule dialog offers built in templates for common scenarios, such as language specific style guides, security best practices and accessibility standards, that a team picks and adapts. The template set is named by category only, with no full list.

Sourcegraphite.com/docs/ai-review-customizationread 2026-10-28

The customer picks the harness and model for every agent and session across three makers: Claude models in Claude Code, GPT models in Codex and Gemini models in the Gemini CLI, each priced per million tokens. A Claude or ChatGPT subscription can pay for sessions a user starts. No bring your own key path is documented.

Sourceellipsis.dev/docs/models and docs/pricingread 2026-10-28

The AI features run on models from Anthropic and OpenAI, Graphite's two AI subprocessors, and the terms of service say either may generate outputs. Graphite makes the model choice itself and names no model picker, routing setting or bring your own key option for Graphite Agent; the model menu in the Agents tab belongs to Cursor Cloud Agents.

Sourcegraphite.com/docs/ai-privacy-and-security, terms-of-service and docs/agentsread 2026-10-28

A REST API at api.ellipsis.dev/v1 with bearer API keys and a published OpenAPI specification starts, streams, messages and stops sessions and manages agents, environments, secrets and webhooks. Python and TypeScript SDKs and the ellipsis CLI work over the same surface.

Sourceellipsis.dev/docs/api and docs/api/authenticationread 2026-09-29

GT MCP, in beta and built into the Graphite CLI from version 1.6.7, lets AI agents such as Cursor and Claude Code create stacked pull requests through Graphite's stacking operations, and MCP ships on every plan including the free Hobby tier. The CLI is a substantial client for stack management and simplified git commands, and Graphite publishes source on GitHub under the withgraphite organization. Graphite names no public REST API, SDK or webhooks for building on the platform.

Sourcegraphite.com/docs/gt-mcp and graphite.com/pricingread 2026-10-28

Ellipsis tests the customer's code, not the agent. A code review agent reviews each push to a pull request and runs the project's test suite in its sandbox, an environment validate hook and an Ellipsis environment pull request check confirm the setup, and session records show the tests run. There is no harness, scored test set or optimization loop for evaluating agent behavior.

Sourceellipsis.dev/docs/code-review, docs/environments and docs/sessions; ellipsis.dev/docs/agents/code-reviewread 2026-10-28

AI reviews check every pull request for bugs, logic errors and security issues before merge, with suggested fixes, CI summaries and rules the team tunes, and a dashboard tracks acceptance rates and rule effectiveness. The review works as a quality gate in the release path, where customers test their own changes.

Sourcegraphite.com/docs/ai-reviews and graphite.com/pricingread 2026-10-28

Ellipsis does not operate browsers or desktops. Sessions run the Claude Code, Codex or Gemini CLI harness in an isolated cloud Linux sandbox with terminal and file access, which is code execution, no browser, desktop or computer control tool is offered, and Gemini's web search and fetch are turned off.

Sourceellipsis.dev/docs/environments and docs/harnessesread 2026-10-28

Every Graphite action runs through programmatic interfaces. These are the GitHub API for pull requests, comments, suggested fixes and merges, git for stacking and automatic rebase of stacks, the CLI, the VS Code extension, MCP, and CI integrations with Buildkite and GitHub Actions. Graphite names no browser control, screenshot capture or visual verification, and no way to operate software that lacks a programmatic interface. The Cursor Cloud Agents surfaced in the Agents tab run on Cursor's own machines and are Cursor's product.

Sourcegraphite.com/pricing, graphite.com/features and docs/agentsread 2026-10-28