Graphite vs Greptile (2026)

Integration is deep on GitHub across repositories, pull requests, CI and merge, with surfaces in the CLI, VS Code, MCP, the web pull request page and the PR inbox. Cursor Cloud Agents now run inside the Graphite pull request, a post acquisition integration and the clearest product evidence that the two products are converging.

Breadth across classes is comfortably met. Fix with your Agent routes findings outward into five named coding agents through a local bridge CLI, an unusual integration direction for a review tool: Greptile positions itself as the review step that hands work to whichever agent the customer already runs.

The orchestration is real and layered: a stack aware merge queue with basic and advanced tiers, an automations engine, a CI optimizer, and automatic rebase of dependent branches as changes land. Sequencing dependent pull requests to keep trunk green while keeping the chain current is multi step workflow execution over a dependency graph, which is what this axis measures. It orchestrates the merge pipeline rather than coordinating multiple agents, so it earns Full on the multi step half rather than the multi agent half.

v5, shipped 5 August 2026, makes the architecture explicit: a swarm of narrowly scoped agents, each exploring a single hypothesis, run in parallel and aggregated into one review. The coordination is evidenced by measured aggregate outcomes: median review time halved and the comment addressed rate rose from 52 to 66 percent, which only makes sense if the swarm's output is filtered and merged rather than concatenated.

Every pull request opened or updated starts a review with no person involved, and automations fire on pull request events. Trigger coverage spans pull request events, merge queue events and CI events, plus the CLI, VS Code, MCP, web and inbox surfaces, with Slack as a notification output. Everything is anchored to GitHub and the local development loop: there is no chat initiated or ticket initiated invocation and no scheduled runs.

Reviews start automatically when a pull request opens in GitHub or GitLab and re-run on later commits under configured triggers, so work reaches the agent with no person starting it. It can also be invoked by an @greptileai mention, a re-trigger control, a reply in the thread, or the CLI on a local branch, and MCP reaches it from four IDEs. Slack is a delivery destination rather than an invocation channel, and no scheduled or cron driven review is documented.

Whole codebase context and code indexing are confirmed first party, with admin controls over code indexing. Indexing is optional and described as indexing code for short periods of time to speed Graphite Chat's tool calls and the PR page, while reviews that reference related files through the index are marked coming soon. By default Graphite stores no code and reads it from GitHub. No index architecture, retrieval method or scope statement is documented, so a maintained retrieval structure grounding the agent's reviews is not yet shipped, which keeps this at Partial.

Two mechanisms extend grounding past the repository boundary: Repo Clusters, reading up to seven related repositories per review, and the Partner Program, supplying maintained context for third party APIs. The files.json mechanism is a design choice worth noting: it points reviews at existing schemas and architecture docs rather than requiring a separate knowledge base.

The AI reviewer tunes itself from accepted and rejected comments, which is real but is feedback loop adaptation of a model's behavior rather than a documented memory layer. Imported style guides and rules are static configuration the customer maintains. Nothing is named as a memory feature with a described mechanism; the line is whether the vendor documents persistence as a capability rather than as a training characteristic.

Memory and Learning is a named system with its own documentation page, its own dashboard section, five documented learning signals and an inference step that proposes new rules from observed behavior. It holds at Partial because the page states no scope boundary, lifetime or way to review and delete what was learned.

Oversight is largely structural: the AI reviewer's output is advisory findings a person accepts or rejects. What lifts it toward the gate this axis wants is the merge queue, which sequences and merges approved pull requests under rules the team configures, with advanced settings on Enterprise, and ACLs that bound who can do what. It stays below Full because no per action approval gate on the agent's own actions is documented, and there is no shadow or preview mode for automatic approval.

Greptile posts reviews and, where enabled, approves pull requests on its own: auto-approve, shipped 26 June 2026, works under a customer set risk ceiling, with exclusion filters and a never approve list covering authentication, secrets, billing, migrations, infrastructure, CI and public APIs that the customer cannot switch off. Those are customer controlled constraints on the agent; no step where a person approves the agent's action before it lands is documented, which holds it at Partial.

The pricing page's Admin section enumerates the identity and governance matrix in full, and the bar is met twice over: SOC 2 Type II plus continuous penetration testing on the attestation side, and SAML and SSO, ACLs, SIEM audit log export, code indexing controls, AI privacy controls and GitHub Enterprise Server support on the named control side.

Both halves of the bar are met independently, and the self hosted air gapped path with customer supplied models matters most for the regulated buyers this vendor targets, since it removes the trust question rather than attesting to it. The SOC 2 Type II claim and the defense, healthcare and financial services customer base come from vendor marketing pages rather than a trust portal, and no named audit firm or published report has been found.

Team insights and custom analytics are genuine reporting, and the Enterprise SIEM audit log is a real governance artifact, but both measure people and access rather than agent behavior. Reporting on throughput and cycle time is not a retained per action trace of what the AI reviewer did and why. A documented per review execution record would move this to Full.

The analytics dashboard, shipped 15 April 2026, is a real reporting surface with export, and the review footer's counter and last reviewed commit link add per PR traceability. It holds at Partial because these measure review outcomes and team throughput, not a retained per action record of what the agent did and why; no session record, execution replay or agent run history is documented.

Graphite is hosted software. GitHub Enterprise Server support is listed on Enterprise, but that is support for a customer hosted code host, not a deployment option for Graphite itself; portability of the code host does not confer residency on the platform. No region selection, VPC, private instance or self hosting of Graphite is documented.

Greptile publishes the actual deployment mechanics rather than describing air gapped deployment on a marketing page: named services, sizing thresholds, a public repository, a Terraform path and a documented migration route between deployment methods. Both halves of the axis are met independently, deployment surface and data location control, with bring your own LLM closing the inference path.

AI review customization covering automations, filters and rules is reusable configuration, but this axis rewards prebuilt assets the customer installs or adopts, and every one of these is authored by the customer. Graphite ships a single reviewer agent with no library, gallery, template set or marketplace on the pricing matrix, the features navigation or the homepage.

The Partner Program, shipped 22 June 2026, is a vendor curated pack, supplying partner maintained review rules for eight named third party APIs, enabled by default. It holds at Partial because these are context packs applied automatically rather than a browsable catalog of installable agents or templates, and there is no marketplace or gallery. AI rules import is customer owned configuration and does not count.

Graphite names Anthropic and OpenAI as the model providers behind its AI features and keeps the choice itself. AI privacy controls and code indexing controls are admin capabilities over data handling, not model selection. The model layer may change materially: Cursor's stated plan on acquisition was to use its coding models to make Graphite's AI features more intelligent and to merge Graphite's reviewer with Cursor's Bugbot.

Configurable Models has been documented since 26 September 2025, and three independent forms of the axis are present: explicit customer selection, documented routing, and bring your own model on self-host. Model Inversion is an unusual routing rule: it routes review away from the authoring model, on the vendor's own research that models catch more bugs in code written by a different model.

MCP is listed on the pricing page as a feature on every plan, including the free Hobby tier, grouped under Stacking alongside the CLI and VS Code extension. The grouping indicates an MCP server exposing Graphite's stacking operations to other agents rather than a general platform API. No REST API, SDK or webhook surface is documented, and Full would need a documented API or SDK for building on Graphite.

The surface is broad: four named REST endpoints, a hosted MCP server with a documented bearer token setup across four IDEs, an npm CLI with machine readable and agent oriented output modes, a plugin in Anthropic's official marketplace, webhooks and Zapier. Other assistants call Greptile to query rules and trigger reviews, which is the direction this axis credits.

The axis and the product coincide: the customer points a shipped review product at their own code and it finds defects, with customer configurable rules and filters. This is a defect detection product rather than an agent running a project's existing tests. No harness for evaluating the agent's own behavior exists, so the grade rests on the product being a test of the customer's work.

Here the axis and the product coincide: Greptile tests the customer's change on every pull request. TREX is the unusual part: it writes and executes targeted tests against the repository's real stack rather than a mock environment and attaches execution evidence to the comment, which is close to a customer facing test harness. TREX is in public beta, and the security agent's benchmark claims are vendor reported.

Every documented action runs through git and the GitHub API. Reviewing and navigating code, applying commits, rebase operations through the CLI and self healing CI are all programmatic, which is exactly what this axis excludes. No browser, screenshot or GUI automation appears on the pricing matrix, the features navigation or the homepage. Cursor Cloud Agents now run inside the pull request, and if those agents carry browser tooling that could change, but that capability belongs to Cursor's record and is not documented on any Graphite surface.

All documented action runs through programmatic interfaces: sandboxes, code graphs and the GitHub API. TREX attaches screenshots and videos as failure evidence, which implies browser driven end to end tests, but running the customer's own test framework is executing their harness rather than operating software that lacks a programmatic interface, and no browser tool, computer use capability or GUI automation is named on the TREX page or in the changelog. A documented browser tool would change this.