audytx
audytx analyzes AWS infrastructure code and Terraform pull requests, presenting security and cost findings in GitHub and to coding agents.
What audytx is
audytx analyzes AWS infrastructure code and Terraform pull requests, presenting security and cost findings in GitHub and to coding agents. Its deterministic, non-AI engine is described as having 303 AWS Terraform checks and 27 cross-resource reasoning axes. The analysis models relationships such as invocation topology, encryption chains, network exposure, resource lifetimes, and IAM trust graphs. The GitHub App can add a pull request digest, inline review, and SARIF; it uses read-only repository contents permission and does not write repository code. An optional GitHub Actions step uploads a resolved Terraform plan over OIDC without shared secrets. A hosted MCP server exposes the engine to Claude Code, Cursor, and Codex, and its autofix tool can apply line-anchored fixes and rescan for up to three passes. audytx supports AWS and Terraform, plus CloudFormation through the hosted MCP server and GitHub App review. Free includes 100 scans per month. Plus is $20 a month for 200 scans; Pro is $100 a month for 1,000 scans and adds custom checks, organization-wide policy controls, and audit log export.
Good
- GitHub reviews include security findings, cost analysis, and SARIF.
- Hosted MCP server supports Claude Code, Cursor, and Codex.
- Source files are analyzed in memory and discarded.
- Free plan includes 100 scans per month.
Watch out
- Does not support Azure, GCP, or Pulumi.
- Offline CLI is Terraform-only.
- No SOC 2 or ISO 27001 certification yet.
- Plus costs $20 a month.
Who it suits
It suits teams reviewing AWS infrastructure changes in Terraform or CloudFormation and developers who want findings in GitHub or coding agents. The Free plan offers 100 monthly scans; larger scan allowances and additional controls are listed on paid plans.
Verdict
audytx combines infrastructure analysis with GitHub review and coding-agent access for AWS-focused workflows. Check its cloud and infrastructure-as-code limits, along with scan allowances, before choosing a plan.
Plans and prices
From audytx's own pricing page, checked 21 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Free | Free | Unlimited repositories / files · Unlimited users · 100 scans / month · Email support · $0 / month |
| Plus | $20 a month | Unlimited repositories / files · Unlimited users · 200 scans / month · Priority Email support · $20 / month |
| Pro | $100 a month | Unlimited repositories / files · Unlimited users · 1,000 scans / month · Priority Email support · Custom checks and org-wide policy controls · Centralized suppression management · Audit log export · $100 / month |
The facts
Each one read from audytx's own pages, with the date it was checked.
What it does
- Autofix
- The MCP autofix tool applies line-anchored fixes, rescans, and loops for up to three passes.checked 30 Sep 2026
- Autofix behavior
- Autofix applies only line-anchored safe replacements, rescans the result and loops for up to three passes.checked 21 Oct 2026
- Board size
- The company record lists two directors, Sabari Sinha and Victor Sinha.checked 21 Oct 2026
- Capital
- The public filing record lists authorised capital of ₹1 lakh and paid-up capital of ₹1 lakh.checked 21 Oct 2026
- Changelog: CloudFormation
- The July 2026 v1.18 release added CloudFormation pull-request and MCP scanning, including SAM and CDK-synthesized output.checked 21 Oct 2026
- Changelog: first stable release
- The June 2026 v1.0 release introduced the pull-request scanner, MCP server, Cost Sampler, Client IDs and security hardening.checked 21 Oct 2026
- CloudFormation support
- CloudFormation scanning covers JSON, YAML short tags, SAM and synthesized CDK templates through GitHub App and MCP surfaces, while the offline CLI remains Terraform-only.checked 21 Oct 2026
- Compliance references
- Findings can carry AWS FSBP, SOC 2 CC6, PCI-DSS and HIPAA references.checked 21 Oct 2026
- Context analysis
- The engine models relationships between resources, including invocation topology, encryption chains, network exposure, resource lifetimes, and IAM trust graphs.checked 30 Sep 2026
- Context reasoning
- The engine models invocation topology, encryption variants, network exposure, resource lifetimes and IAM trust graphs before deciding whether checks apply.checked 21 Oct 2026
- Delivery stages
- The engine is offered at code-time through MCP, review-time through pull requests, and plan-time through resolved plan uploads.checked 21 Oct 2026
- Detection engine
- The documentation describes a deterministic Rust engine with 306 checks and 27 cross-resource reasoning axes.checked 21 Oct 2026
- GitHub permissions
- Installation requests read-only repository contents, pull-request read/write, metadata read-only and code-scanning alert read/write permissions.checked 21 Oct 2026
- GitHub workflow
- The GitHub App posts a pull request digest with security findings and cost analysis, plus inline review and SARIF.checked 30 Sep 2026
- IAM analysis
- Its IAM engine evaluates effective permissions, wildcard expansion, trust relationships and multi-hop privilege-escalation attack paths.checked 21 Oct 2026
- Licence
- The terms say audytx's check catalog, engine and associated software are proprietary property of Rexstart Labs Pvt Ltd.checked 21 Oct 2026
- Limits
- The maker says it does not support Azure, GCP, or Pulumi, and its offline CLI is Terraform-only while CloudFormation support rolls out there.checked 30 Sep 2026
- Listing status
- The filing record says the company is unlisted on a stock exchange.checked 21 Oct 2026
The company
- Company incorporation
- The company record gives 25 May 2026 as the incorporation date.checked 21 Oct 2026
- Company legal name
- A public Indian company record lists the legal name as Rexstart Labs Private Limited.checked 21 Oct 2026
- Company registration
- The company record lists CIN U62099WR2026PTC294296 and ROC Kolkata II.checked 21 Oct 2026
- Company status
- The company record describes Rexstart Labs Private Limited as active, private, Indian and non-government.checked 21 Oct 2026
Money
- Cost analysis
- Pull-request output includes cost opportunities such as gp2-to-gp3 changes, idle NAT gateways, oversized non-production resources and missing cost-allocation tags.checked 21 Oct 2026
Where it runs
- GitHub App
- The GitHub App posts one pull-request comment with security and cost findings, supports inline suggestions, and can upload SARIF to GitHub Code Scanning.checked 21 Oct 2026
Alternatives to audytx
- 1
Kubescape
Free planOpen sourceAPILinuxmacOSSelf-hosted8.2From $30 a month - 2
Aikido CSPM
Free planWebAPILinuxmacOS7.9From $300 a month - 3
AWS CloudFormation
Free planiOSWebAPILinux7.7Free plan - 4
Kyverno
Free planOpen sourceWebAPILinuxmacOS7.7Free plan - 5
CFRipper
Free planOpen sourceWebLinuxmacOSSelf-hosted7.5Free plan - 6
Fairwinds Polaris
Free planWebLinuxmacOSSelf-hosted7.1Free plan