AiMatch

codethreat

CodeThreat uses AI-assisted reviews and security scans to help application security and development teams find risks in repositories and pull requests before code is merged.

Visit codethreat Compare alternatives Own this tool? Claim it
codethreat screenshot

Who it's for

  • Application security teams that want AI-assisted SAST and false-positive triage alongside SCA and other listed security scans.
  • Development teams using GitHub, GitLab, or Bitbucket that want security findings during pull request review.
  • Organizations seeking on-premises deployment or private LLM hosting options, which CodeThreat lists on its Enterprise Plan.

Not the right fit if…

  • Teams needing more than 3 private repositories on the Free Plan: that plan is capped at 3 private repositories.
  • Teams that require a published Enterprise price before evaluating a plan: the page does not state the Enterprise price.

How it fits your workflow

Connect CodeThreat with a supported source-control service or CI/CD workflow and analyze repositories or code changes. The platform describes project-wide repository analysis and pull request reviews that identify security issues and risks.

Review findings and explanations, including the false-positive agent's assessment of whether an issue may be non-exploitable. The page also lists SAST, SCA, infrastructure, container, and secret scanning capabilities.

Pricing

Free: The Free Plan costs $0/month and includes 3 private repositories, limited Agentic PR Review and False Positive Elimination, SAST and SCA scanning, and no credit top-ups.

Free Plan

$0/month

  • · 3 private repositories
  • · Limited Agentic PR Review
  • · Limited False Positive Elimination
  • · SAST and SCA scanning

Pro Plan

$39 per contributor/month

  • · Role-based access control
  • · Secret scanning
  • · Infrastructure security
  • · Jira integration

Enterprise Plan

Not stated

  • · On-premises deployment
  • · SLA and dedicated support
  • · Advanced compliance reporting
  • · Private LLM model hosting options

Prices checked on Oct 29, 2026 from the vendor's site. They can change; confirm before you buy.

Key features

Agentic PR Review
Reviews code changes at the pull request level and performs project-wide analysis to identify issues, risks, and improvement points before code is merged.
False Positive Agent
Re-checks findings, flags issues considered non-exploitable, and explains why they may be false positives.
AI SAST
Analyzes code with project context to identify security issues such as logic flaws, data flows, and authorization paths.
Agentic Repository Analysis
Maps a project and generates AI-powered insights about architecture, documentation, endpoints, dependencies, and data flows.
Repository Mapping
Visualizes repository components, flows, and relationships to help teams understand project structure.
Unified security scanning
Brings SAST, SCA, infrastructure-as-code, container security, and secret scanning into one platform.

Works with

  • GitHub
  • GitLab
  • Bitbucket
  • CI/CD pipelines
  • Cloud providers
  • Jira

Limitations to know

  • The Free Plan is limited to 3 private repositories and includes limited Agentic PR Review and False Positive Elimination.
  • The page does not state the Enterprise Plan price.

Alternatives to consider

  • CodeCrab

    Choose it if you want local-first AI reviews of pull requests and uncommitted changes using your own AI tools and keys, without uploading source code to the cloud.

  • Sentrint

    Choose it if you want a code-security scanner focused on hardcoded secrets, access rules, vulnerable dependencies, and dangerous code paths, with AI-filtered findings and a numeric grade.

Compare codethreat side by side

Getting started

  1. Choose Try for Free to start with the Free Plan, or book a demo.
  2. Use the listed source-control and CI/CD integrations to incorporate CodeThreat into the development workflow.