Aikido secures the stack.
Hyrax evaluates six domains.
Aikido consolidates code, dependency, container, cloud and secrets scanning into one security platform with strong noise reduction. Hyrax covers security as one of six domains, and verifies every change against the project test suite before a pull request opens.
- Hyrax audits roughly 400 of its own repositories.
- Free plan: full access, up to 100 PR reviews a month, a $30 starter credit, and $10/month ongoing.
Verified end to end, with no Aikido handoff
What changes when Hyrax runs above the tools.
Six domains, not one
Aikido covers its own scanning domain well. Hyrax evaluates security, correctness, maintainability, performance, architecture and operations together.
Verified against the project tests
A rules engine confirms a change satisfies its own rules. Hyrax runs the project test suite and build, so a change is proven against the real system.
Context that compounds
The map of the codebase lives in the repository and strengthens with every merge, so the next decision starts from everything learned before it.
How Hyrax and Aikido make decisions.
| Decision criteria | Aikido | Hyrax |
|---|---|---|
| Unit of work | Code, dependencies, containers, cloud configuration and secrets. | The whole repository, audited continuously across six domains. |
| Codebase context | Scanners matched against vulnerability data and cloud configuration. | A durable map committed to the repository as HYRAX.md and .hyrax/discovery, so it strengthens as the codebase changes. |
| Output type | Security issues, with autofix pull requests for some classes. | Verified pull requests, plus issues ranked by severity and effort. |
| Verification | Autofix pull requests run whatever CI the repository already has. | Baseline tests, build, lint and a second reviewer agent run against the project itself before a pull request opens. |
| Human control | The team merges every change. | A human approves and merges every pull request. Hyrax never merges on its own. |
| Delivery surface | Git providers, CI, cloud accounts and the Aikido app. | GitHub pull requests, with issues and posture in the Hyrax console. |
| Pricing model | Free plan, then per developer, commonly a few hundred dollars per month for teams. | Free plan with a $30 starter credit and $10/month ongoing. Paid is $30 per user per month and each paid user gets $30/month of credits. |
Read how Aikido describes itself: www.aikido.dev(opens in a new tab)
Comments on a diff, or a verified pull request.
- 01Aikido scans the project against its rule set.
- 02Issues arrive as a list to triage, with severity attached.
- 03The team decides what is worth resolving, makes the edits, and merges.
- 01Maps the codebase and keeps the map in the repository
- 02Applies architectural judgment across six domains
- 03Opens a verified pull request that a human merges
GitHub-native. Human-controlled. Verified before merge. No training on customer code.
From install to the first verified pull request.
Install the GitHub App
Grant read access to the repositories in scope. No card is required to start.
Hyrax maps the repository
Discovery writes HYRAX.md and .hyrax/discovery into the repository, so humans and AI tools read the same context.
Review the first pull request
Approved upgrades arrive as verified pull requests. A human merges every one.
Both tools solve real problems.
Choose Aikido if
The requirement is consolidated application and cloud security with compliance reporting. Aikido covers a wider security surface than Hyrax does, and the two coexist.
Choose Hyrax if
The concern is the health of the codebase, not only its exposure. Hyrax evaluates six domains together and delivers changes proven against the project test suite.
Free plan, then priced per developer with platform add-ons.
Free plan with a $30 starter credit and $10/month ongoing. Paid is $30 per user per month, and each paid user gets $30/month of credits.
Questions about Aikido and Hyrax.
Does Hyrax work alongside Aikido?
Yes, and most teams run both. Aikido keeps doing its job. Hyrax works at the level of the whole codebase, decides what is worth changing, and delivers verified pull requests. Nothing about the Aikido setup has to change.
What does Hyrax change in the repository?
Discovery writes HYRAX.md and a .hyrax/discovery directory, which document the architecture, conventions and risk areas of the codebase. Everything else arrives as a normal pull request on its own branch. Hyrax has no write access to the default branch.
How does pricing work?
The free plan includes full access, a $30 starter credit and $10/month of credits ongoing, with no card required. The paid plan is $30 per user per month, and each paid user gets $30/month of credits. Pull request reviews are included on every plan.
What happens after signup?
Installing the GitHub App and granting access to a repository takes a few minutes. Hyrax maps the codebase, then runs the first audit and returns issues ranked by severity and effort. The first verified pull requests follow once an audit is approved.