Greptile vs Snyk (2026)

Reviews run on GitHub Cloud, GitLab.com, Bitbucket Cloud and Cursor Origin (beta) on every plan, with GitHub Enterprise Server, GitHub Enterprise Cloud with data residency, self managed GitLab, Bitbucket Data Center and Gitea on Enterprise and Perforce through P4 Code Review on premises. Context comes from Jira, Linear, Notion, Google Drive, Sentry and Datadog, and findings are delivered into Slack and the IDE.

Fix with your Agent sends a comment with file, line numbers and suggested fix straight to Claude Code, OpenAI Codex, Conductor, Cursor or Devin through a local bridge CLI, a Fix All control sends every issue at once, Greplooping lets an agent keep fixing until the review is clean, and comments are auto marked as addressed when a commit touches the flagged files.

A hosted MCP server, REST API, npm CLI and Zapier integration extend the reach, and the Partner Program adds maintained context for OpenAI, Vercel, Stripe, PostHog, Datadog, WorkOS, Mintlify and Braintrust.

Sourcegreptile.com/docs/integrations/code-providers, docs/integrations/fix-with-your-agent and greptile.com/independenceread 2026-10-28

Integrations span source control across GitHub, GitLab, Bitbucket Cloud and Server and Azure DevOps, CI/CD pipelines, IDEs, container registries, cloud providers and ticketing systems, configured at group level. Snyk Broker, deployable via Docker or Helm, reaches SCM instances that are not publicly accessible, and the Snyk MCP server exposes scanning as tools to AI assistants including Claude Desktop, Cursor, Windsurf and Qodo.

Sourcedocs.snyk.io/developer-tools/integrations and docs.snyk.io/snyk-apiread 2026-08-30

The v5 review engine runs a swarm of narrowly scoped agents in parallel, each exploring one hypothesis for a potential bug, and aggregates their results into a single review. Greptile reports median review time falling from 5:04 to 2:25 and author addressed comments rising from 52 to 66 percent in production A/B tests.

The agent looks beyond the diff for similar logic, traces dependencies, reads git history and runs iterative passes that challenge their own hypotheses, with the maximum number of agentic turns configurable per review.

TREX runs as a companion agent that writes and executes tests, the security reviewer chains Opengrep pattern scanning, dependency analysis and AI exploit detection, and Greplooping hands findings to a coding agent repeatedly until the review comes back clean.

Sourcegreptile.com/blog/greptile-v5, greptile.com/changelog 2026-08-05 and greptile.com/independenceread 2026-10-28

Multiple specialized agents chain across a discover, remediate, validate and prevent lifecycle. Evo AI-SPM discovers the AI and software attack surface, Agentic AppSec remediates through a CLI or agentic development environment remediation agent, Continuous Offensive Security runs autonomous pentesting and agent red teaming that attacks applications as they change and confirms fixes hold, and prevention gates stop new vulnerabilities from shipping. Agent Fix retries agentically until a fix validates.

Sourcesnyk.io/news/snyk-launches-evo-continuous-offensive-securityread 2026-08-30

Reviews start automatically when a pull request opens in GitHub, GitLab, Bitbucket or Cursor Origin and run again on later commits under configured review triggers. TREX runs on every reviewed pull request or only on those matching branch, label, author or path rules, and skips changes with nothing to test. Reviews can also be started with @greptileai, a re trigger control, a reply in the thread, @greptileai trex, or the CLI on a local branch.

Sourcegreptile.com/docs/quickstart, docs/trex/overview and greptile.com/cliread 2026-10-28

Scans fire from source control events, CI/CD pipeline gates, IDE plugins, the CLI, and invocation by third party AI assistants through the MCP server, while Continuous Offensive Security runs continuously against applications as they change rather than on a schedule, and Agent Guard applies at agent runtime in production.

Sourcesnyk.io/news/snyk-launches-evo-continuous-offensive-security and docs.snyk.io/developer-toolsread 2026-08-30

A graph index of the entire repository maps how functions, classes, files and directories connect and updates continuously, so reviews can reason about ripple effects beyond the diff, and a Knowledge Base generates and maintains documentation of how each part of the codebase works, how it connects and which past bugs and risks it carries, updated in real time as code changes, editable from the dashboard and served to coding agents over MCP.

Repo Clusters and a context.repos field give read only access to up to seven related repositories per review, with clusters suggested from shared contributors over the previous 90 days. A files.json file points reviews at existing schemas, API specs and architecture docs in the repository, and context also comes from Jira, Linear, Notion, Google Drive, Sentry and Datadog. The Partner Program supplies partner maintained documentation for supported third party APIs, and imported AI rules files, including CLAUDE.md and Cursor rules, become org wide context.

Sourcegreptile.com/knowledge-base, docs/code-review/cross-repo-context and greptile.com/pricing; greptile.com/docs/code-review/cross-repo-contextread 2026-10-28

A proprietary vulnerability database and a decade of enterprise deployment data confirm which findings are real and exploitable, which Snyk calls ground truth no model produces alone. An AI bill of materials maps the customer's own models, agents, MCP servers, skills and tools, and Continuous Offensive Security returns validated proof of exploitability rather than inferred findings.

Sourcesnyk.io/news/snyk-launches-evo-continuous-offensive-security and snyk.io/news/snyk-launches-agent-security-solutionread 2026-08-30

Memory and Learning picks up team preferences from PR comments, replies to Greptile, reactions and whether comments were addressed between the first and last commit, suppresses comment types a team ignores, and turns repeated patterns into suggested rules. Its scope, lifetime and any way to review or delete what was learned are not stated.

Sourcegreptile.com/docs/how-greptile-works/memory-and-learningread 2026-10-28

A Discovery Agent maintains a live AI-BOM that a Risk Intelligence Agent continuously enriches, and the platform keeps persistent project and organization state, including scan history and accumulated risk scores. No agent memory with its own scope, lifetime or review and delete path is described.

Sourcesnyk.io/news/snyk-launches-agent-security-solutionread 2026-09-29

Greptile posts its reviews and, where enabled, approves pull requests on its own after a clean five out of five review at or below a risk cap the customer sets, with exclusion filters by label, branch, file and author.

Authentication, secrets, billing, migrations, infrastructure, CI and public APIs form the critical risk tier, so they are held back only when the cap sits below critical or the paths are excluded; with no cap set the page says it can approve any clean review, and an option counts TREX results in the decision. Custom rules shape what it flags. These controls constrain the agent, but no step where a person approves the agent's action before it lands is described.

Sourcegreptile.com/docs/code-review/auto-approve-prs, docs/trex/overview and greptile.com/changelog 2026-06-26; greptile.com/docs/code-review/first-pr-reviewread 2026-10-28

A Policy Agent turns plain English governance intent into guardrails enforced in CI. Runtime enforcement stops destructive commands in the development loop, and prevention gates block secrets and vulnerabilities across coding agents, IDEs, PRs and CI/CD. The Remediation Agent's interactive run shows its plan and asks before applying each fix, and an auto approve flag skips that prompt. That agent is in early access and off by default, so its approval step is not yet part of the generally available product.

Sourcedocs.snyk.io remediation-agentread 2026-10-25

Greptile is SOC 2 Type II compliant, with the report, penetration test results and subprocessor list in its Trust Center at trust.greptile.com, and it holds zero data retention agreements with its LLM providers. Single sign on with SAML and role based access control come with Enterprise, along with audit logs.

Greptile Cloud runs on AWS with customer code cached on an encrypted filesystem until access is revoked, an admin can delete all customer data within 24 hours, and de identified data may be used to train Greptile's models unless an admin turns that off, which self hosted deployments never do. The whole service can also self host into a customer VPC or an air gapped environment with customer supplied LLM providers.

Sourcegreptile.com/security (updated 18 October 2026) and greptile.com/pricingread 2026-10-28

Snyk's trust center at trust.snyk.io states ISO 27001 and SOC 2 Type II. Administration works at group and organization level with SSO, role based access and Broker for private networks. Evo AI-SPM keeps a live AI-BOM of models, agents, MCP servers, skills and tools, and a Policy Agent turns governance intent into enforceable guardrails in CI.

Sourcetrust.snyk.io, snyk.io/plans and docs.snyk.ioread 2026-10-25

Each TREX flow keeps a step by step record of what the agent did and a captioned video of the run, posted to the pull request with live progress while it runs and retained for 30 days to anyone with read access to the repository. The analytics dashboard tracks reviews, addressed rate, bugs caught and merge times with export, and Enterprise adds audit logs. The review agent itself keeps outcomes rather than a step trace.

Sourcegreptile.com/docs/trex/overview, docs/trex/results and docs/analytics; greptile.com/docs/trex/resultsread 2026-10-28

Each Continuous Offensive Security finding keeps a Steps trace of the actions Snyk's agents took, held in the target's scan history, and remediation campaign agent journals stay available after a run. The live AI-BOM shows the models, agents, MCP servers and tools the customer runs and what each can reach.

Sourcedocs.snyk.io continuous offensive security finding details and remediation agentread 2026-10-25

The entire service can be self hosted, including in air gapped environments, using Docker Compose on a single Linux VM for up to 100 developers or Kubernetes with Helm for 100 or more with horizontal scaling and high availability. Sizing requirements are published, and parallel deployments give a migration path between the two. An AWS Terraform module provisions VPC, EC2, RDS PostgreSQL and ElastiCache Redis and bootstraps the application, and manual setup covers GCP, Azure and on premises.

Self hosted customers bring their own LLM provider by base URL and keys, choosing among OpenAI, Anthropic, AWS Bedrock, Azure OpenAI and GCP Vertex AI, so inference stays on customer infrastructure; the deployment repository is public at github.com/greptileai/akupara and self hosting requires a license. Greptile Cloud runs on AWS, and Enterprise adds GitHub Enterprise Cloud with data residency and Perforce for on premises deployments.

Sourcegreptile.com/docs/deployment-options, greptile.com/security and docs/integrations/code-providersread 2026-10-28

Scanning runs locally through the CLI and the local only MCP server, which has no hosted remote version, so code need not leave the developer machine. Snyk Broker deploys via Docker or Helm inside the customer network to reach private SCM instances, there is guidance for securing data at rest and using FIPS validated cryptography, and Agent Guard enforces at the customer's own agent runtime.

Sourcedocs.snyk.io/developer-tools/integrations and docs.snyk.io/snyk-cli; snyk.io/news/snyk-launches-agent-security-solutionread 2026-08-30

The Partner Program supplies vendor curated review context for third party APIs, so a pull request that touches a supported partner API, SDK, config or integration is reviewed against partner maintained documentation, implementation rules and common failure patterns, with comments marked by partner logo and linked to the relevant docs.

It is on by default for all users, with featured partners including OpenAI, Vercel, Stripe, PostHog, Datadog, WorkOS, Mintlify and Braintrust. Greptile also ships two named agents, the code reviewer and TREX, and imports existing AI rules files, including CLAUDE.md, AGENTS.md and Cursor rules, as org wide context. There is no browsable catalog, marketplace or gallery of installable agents or templates.

Sourcegreptile.com/partners and greptile.com/pricingread 2026-10-28

The platform rate card prices separately adoptable capabilities that each do their own job, among them Evo AI-SPM (Discovery, Risk Intelligence and Policy agents), Evo ADS coding agent security, Evo COS AI pentesting and agent red teaming, Secrets, Code, Open Source, IaC, Container and API and Web. Each works without the others, and quickstart guides cover Cursor, Windsurf and Qodo.

Sourcesnyk.io/plans and the agent security announcementread 2026-09-29

Review settings let the customer choose which AI model powers reviews and set the maximum number of agentic turns per review, balancing speed, depth and cost.

Model Inversion, marked experimental, detects from commit trails, branch prefixes and PR titles when a coding agent wrote a pull request and routes the review to a different model, so Claude authored code is reviewed by GPT and GPT authored code by Claude.

The cloud service combines frontier models from OpenAI and Anthropic, and self hosted deployments bring their own provider by base URL and keys, with OpenAI, Anthropic, AWS Bedrock, Azure OpenAI and GCP Vertex AI supported, so models run entirely on customer infrastructure.

Sourcegreptile.com/changelog entries of 2025-09-26 and 2026-07-22, greptile.com/independence and docs/deployment-optionsread 2026-10-28

DeepCode AI and the platform's other AI features run on models Snyk selects: frontier models fine tuned with security context, plus a model of Snyk's own, with no customer choice. The Remediation Agent's agentic CLI lets the customer pick the provider (Anthropic, OpenAI, Bedrock, Vertex, LiteLLM or Ollama) and the model. That agent is in early access, though, and its bring your own model configuration is documented as unstable.

Sourcedocs.snyk.io remediation-agentread 2026-10-25

A REST API exposes Index Repository, Query Repos, Search Repos and Get Repository Info, alongside webhooks, with API keys issued from app.greptile.com/settings/api.

A hosted MCP server at api.greptile.com/mcp, configured by bearer token in Claude Code, Claude Desktop, Cursor and VS Code, lets assistants trigger and re run reviews, inspect results, manage custom context and update repository rules, and the Knowledge Base MCP on Pro serves the maintained codebase documentation to coding agents.

An npm CLI runs reviews locally, with --json for machine readable output and --agent for agent workflows and scripts, and greptile onboard sets up an organization from the terminal. A Greptile plugin ships in Anthropic's official Claude Code marketplace, and a Zapier integration is published.

Sourcegreptile.com/docs/mcp/setup, greptile.com/knowledge-base, greptile.com/pricing and greptile.com/changelogread 2026-10-28

A REST API serves customizing, integrating and automating Snyk workflows, and the Snyk CLI comes with tooling including snyk-delta, snyk-filter and snyk-to-html. A Snyk MCP server shipped as part of the CLI exposes scan invocation to MCP enabled AI tools, with quickstart guides for Cursor, Windsurf and Qodo, and a separate API and Web MCP server onboards and configures scan targets conversationally.

Sourcedocs.snyk.io/snyk-api and docs.snyk.io/developer-toolsread 2026-08-30

Every pull request is reviewed for logic, security and cross file bugs, with confidence scores and P0 to P2 severity. TREX, in beta, works out which user flows a change affects, starts the app in a sandbox built from an environment the customer configures, exercises those flows like a user and runs targeted tests, posting what it tested and what broke with logs, traces and a video, so the tests act as a quality gate before release and can feed the auto approval decision.

Sourcegreptile.com/trex, docs/trex/overview, docs/trex/environments and greptile.com/changelog 2026-06-15read 2026-10-28

Continuous Offensive Security delivers autonomous AI powered pentesting and agent red teaming that attacks applications continuously as they change, returning validated proof of exploitability and continuously confirming that fixes hold, alongside API and web testing. Agent Fix retries agentically until a fix validates.

Sourcesnyk.io/news/snyk-launches-evo-continuous-offensive-securityread 2026-08-30

TREX, in beta, starts the customer's app in a sandbox built from a configured environment and uses it the way a person would, clicking, typing and observing what is on the screen, on every reviewed pull request or on those matching rules. It records a video of every flow it runs. Each TREX run costs 3 credits on top of the review, charged only when a flow reaches a pass or fail.

Sourcegreptile.com/docs/trex/overviewread 2026-10-28

Continuous Offensive Security and API and Web Testing attack running applications, including web surfaces, but this is security testing against the customer's own targets, not an agent operating third party software that has no programmatic interface. There is no browser or computer use capability as such.

Sourcesnyk.io/news/snyk-launches-evo-continuous-offensive-securityread 2026-08-30