Disclosure: I'm a co-founder at Manifest. One of the eight is ours. I've given every tool the same space and the same columns.
Your app breaks for three reasons, and each one has its own bots now:
- What your code does: a logic bug, a missed edge case, code that doesn't match the spec.
- What your code imports: a dependency that went stale, or a package that was never safe to install.
- What your code calls: a third-party API that changed on its own schedule, with no commit on your side.
Every app below installs on a GitHub repo in about a click. Here's where each one stands.
| App | Watches | Opens | Since |
|---|---|---|---|
| cubic | Your PRs, whole-repo context | Review comments, suggested fixes | 2025 |
| Manifest API Bot | The third-party APIs your app calls | Pull requests with the fix | 2026 |
| Macroscope | Your PRs, precision-first | Comments, auto-fixes | Sept 2025 |
| Baz | Your PRs against specs and designs | Comments, plan reviews | Jan 2025 |
| Aviator Verify | An approved spec vs. the implementation | Pass/fail per criterion | 2026 |
| Kodus | Your PRs, on the model you choose | Comments, tracked issues | 2025 |
| Renovate | Your dependency manifests | Update PRs | 2017, now Mend |
| Socket | Every package a PR adds | Risk alerts on the PR | 2020 |
1. cubic
cubic reviews a PR the way a senior engineer who knows the codebase would: it points out what breaks production and stays quiet about the rest. The team reports an 11% false-positive rate, which is the number that matters once your developers have started ignoring bot comments. Background agents scan the whole repository, not just the diff, so it catches the change in one file that breaks a call in another.
2. Manifest API Bot
The one app on this list that never reads your diff.
A provider changes how customer.address handles nulls, another one deprecates an endpoint. Nothing changed in your repo, so nothing above has anything to say... But your app breaks anyway, usually on a Saturday.
Manifest API Bot connects to your GitHub repo, finds the APIs your app depends on, and checks them daily. When a change affects your code, it opens a pull request with the fix already written and the context attached: which API, what changed, when it takes effect, which files. Your team reviews it like any other PR.
It works with any API.
3. Macroscope
Macroscope cares about one number: precision. It publishes its own 118-bug benchmark and claims 98% precision on it. You pick a detection mode for each review, from Budget and Balanced to Precise and Ultra, which sets how much noise you accept in exchange for recall. It also goes past the comment. It writes the fix, checks it, and you can run it as an agent on your codebase from Slack or GitHub.
The Periscope founders built it, and it came out of stealth in September 2025. It only works with GitHub, and you pay per use: $0.05 per KB of diff in the default mode.
4. Baz
Baz asks a simple question, like "is this the code we asked for?". Its Spec Reviewer pulls Figma designs and Jira tickets into the review and checks the change against them, with separate agents for security boundaries and production telemetry. Since June 2026, Baz Planner runs that check against the architecture plan before any code is written.
Founded in 2023 by the Bridgecrew founders, generally available since January 2025.
5. Aviator Verify
Aviator argues that an AI review is still a review, where a model reads the diff and guesses what you meant. Verify works the other way. Your team first approves a spec with acceptance criteria, and Verify then checks every push against each criterion with deterministic methods like AST analysis and execution tests, calling an LLM only as a fallback. Every run leaves an immutable record. That record ties the intent to the approval, the implementation and the result.
Aviator launched Verify in 2026 and has run merge queues since 2020. Compliance teams will notice the SOC 2 angle.
6. Kodus
The open-source reviewer! Kody the agent, runs on GitHub, GitLab, Bitbucket and Azure DevOps. And you bring your own model keys: OpenAI, Anthropic, Gemini, or an internal OpenAI-compatible endpoint. You pay the provider directly. Rules are written in plain language, unimplemented suggestions become tracked issues, and the whole thing self-hosts under AGPLv3.
Try it if your security team's first question is "where does the code go?"
7. Renovate
Renovate opens PRs to update npm, pip, Docker images, GitHub Actions and dozens of other manifests, with the controls Dependabot lacks: grouping, schedules, per-package rules, auto-merge. The hosted GitHub App is being renamed to "Mend" but the bot and the config are the same.
8. Socket
If Renovate keeps dependencies fresh, Socket keeps them safe. Socket looks past known CVEs. It inspects every package a PR adds or updates for the signs of a supply-chain attack, such as install scripts, network calls, obfuscated code and typosquatting, then posts the change in risk score on the PR. In May 2026, Socket flagged the compromised TanStack, SAP and Mistral packages within hours of the attack.
Socket dates from 2020. It's free for open source and reached a $1 billion valuation in 2026.
What to install first
You don't need eight. Pick one per reason:
- What your code does: cubic or Macroscope if noise is your problem; Baz or Aviator Verify if correct code keeps shipping the wrong feature; Kodus if the code can't leave your infra.
- What your code imports: Renovate for freshness, Socket for safety. They work together.
- What your code calls: Manifest API Bot. Nothing else on this list looks there.
Three bots, one afternoon, and most of the Saturday pages go away.
Which ones are already on your repo? Let me know in the comments.
Top comments (0)