Comparison · checked July 2026
A focused local review aid alongside broader security platforms.
CodeRiskTools checks an intent manifest and unified diff for declared-scope/policy drift and secret-like literals. The other products below cover broader platform categories and may be a better fit when you need SAST, SCA, container security, dashboards, or enterprise governance.
| Product | Workflow | Public pricing reference | Fit | Source |
|---|---|---|---|---|
| CodeRiskTools | Focused local intent-manifest + unified-diff review; 176-rule secret scanner | Professional is available for $19 and Agency for $30 as one-time purchases. The public MIT Secret Scanner Engine remains separately available. | Not full SAST, not SCA, not container security, and not a security guarantee | Official source |
| Snyk | Local CLI plus a broader developer-security platform | Official plans from $25/month; enterprise options vary | Broader SAST, SCA, container, and platform workflows; verify plan details | Official source |
| GitGuardian | Local CLI plus platform and API workflows | Free and paid plans; see vendor pricing | Secret-security platform with organization workflows beyond this focused aid | Official source |
| Semgrep | Local open-source engine plus team platform | Team platform starting at $30/contributor/month | Broad code scanning and team workflows; plan capabilities vary | Official source |
| SonarQube | Self-managed server and platform offerings | Annual LOC-based pricing; see vendor | Broad code quality/security governance rather than intent-bound diff review | Official source |
Vendor capabilities and prices can change. Links above are official source pages and were checked in July 2026. Confirm current scope and terms with each vendor.
Choose CodeRiskTools when
You want a bounded local review step for an AI-assisted change, can supply an intent manifest and unified diff, and will review deterministic redacted evidence yourself.
Both editions include the same engines. Agency pricing reflects authorized multi-project/client operations, not stronger detection.
Choose or add a broader platform when
You need repository-wide application security, vulnerability intelligence, dependency analysis, container scanning, IDE coverage, centralized policy, RBAC, or portfolio reporting.
CodeRiskTools edition facts
- Professional: $19 one-time; Firewall 240 passing tests / 379 subtests; Scanner 383 passing tests / 523 subtests / 1 expected no-Git skip.
- Agency: $30 one-time; Firewall 259 passing tests / 379 subtests; Scanner 385 passing tests / 523 subtests / 1 expected no-Git skip.
- Scanner pre-commit config included.
- Scanner GitHub Actions secret-scan template included.
This product is not full SAST, not SCA, not container security, and not a security guarantee. False positives and false negatives are possible.
AI Change Firewall v4.2.0 evidence boundary
The public benchmark separates three evidence tracks:
- Shared synthetic secret/config detection: each eligible tool receives its own predeclared denominator; NOT_APPLICABLE is not scored as zero.
- Intent-bound policy: CodeRiskTools-specific workflow evidence, not a competitor false-negative comparison.
- Agent integration and binding: workflow/integrity evidence, not combined Scanner + Firewall accuracy.
Inspect exact versions, hashes, raw results, methodology, and limitations
The 240-case corpus is deterministic and synthetic. These results are not production efficacy and do not establish general product superiority.
The paid workflow advantage
Stop over-scoped AI changes—not just exposed secrets.
CodeRiskTools tied Gitleaks at 120/120 on the shared synthetic secret-detection track. The paid differentiation is the next gate: bind a declared task to a quantitative change budget, run Scanner evidence, and return an auditable ALLOW or BLOCKED decision before the agent’s change is accepted.
Choose low, medium, or high scope. Each profile limits changed files, added lines, deleted lines, and dependency-file touches.
The same deterministic evaluator runs in the CLI, Scanner → Firewall workflow, supported agent hooks, Repository Guard, and Agency batch.
Observed counters, approved limits, exceeded dimensions, stable Rule IDs, and redacted evidence make the decision reviewable.
This is workflow and policy-enforcement differentiation—not a claim of better secret-detection accuracy, production efficacy, or broad competitive superiority. Competitors were not scored on this CodeRiskTools-only budget capability, and its result must not be combined with the 120-point shared track.