These tools solve different problems. ShipGate is merge-path policy enforcement and audit trail — not a CVE scanner. Use what fits your threat model. This table is maintained by the ShipGate team; we welcome corrections.
| Feature | This ShipGate | Snyk Code | SonarQube / Cloud | GitHub Advanced Security | Cursor |
|---|---|---|---|---|---|
| Positioning | |||||
Primary purpose | Merge-gate enforcement + PR audit trail | Vulnerability scanning (SCA + SAST) | Code quality + SAST at PR time | SAST + secret scanning + dependency review | AI coding assistant (IDE) |
AI-code focus ShipGate is positioned around governing AI-generated code at the merge point. | Generates AI code (different layer) | ||||
| CI / PR Integration | |||||
Native GitHub Actions gate | |||||
Blocks merge on policy fail All CI-integrated tools require you to mark the check as required in your repo. ShipGate is deliberately different: a spec-free repository scan never reports a green check, so it is advisory and must not be made a required check. The blocking gate applies to a WholeStack build with an approved spec. | Advisory check by default | When required check enabled | When required check enabled | When required check enabled | |
Per-gate result on the pull request | Check run, every gate named | ||||
Machine-readable run record The ShipGate workflow writes a readiness report as a JSON build artifact. It does not emit SARIF today. | JSON report artifact | JSON / SARIF | JSON / SARIF | SARIF | |
| Security Analysis | |||||
SAST (static analysis) | Focused on merge-path policy | ||||
SCA (dependency vulnerabilities) ShipGate is not a CVE scanner. Use Snyk or Dependabot alongside it for SCA. | Via Dependabot | ||||
Secret scanning Use GHAS or a dedicated secret scanner; ShipGate focuses on policy enforcement. | |||||
Merge-path policy enforcement | |||||
| Audit & Compliance | |||||
Verdict history bound to commits | With ShipGate CI | ||||
Signed audit-log export ShipGate exports the audit log as an NDJSON bundle with a manifest, hash chain, and HMAC signature, so the export can be re-verified rather than merely trusted. | Enterprise | Enterprise tier | Enterprise tier | GitHub Enterprise | |
Signed provenance / proof chain A signed certificate comes from running the exact revision through the WholeStack pipeline. A static repository scan is advisory and never issues one. | On a WholeStack build | ||||
SSO — SAML 2.0 or OIDC | Enterprise | Enterprise tier | Enterprise tier | GitHub Enterprise | |
SCIM 2.0 directory sync | Enterprise | Enterprise tier | Enterprise tier | GitHub Enterprise | |
| Deployment | |||||
Public CLI package ShipGate publishes no CLI. The free tier is the hosted scan, and continuous CI is a GitHub workflow — there is no command to install. | |||||
Self-hosted option SonarQube Community Edition is free and self-hostable. SonarCloud is SaaS-only. | VPC / dedicated, where contracted | Enterprise | SonarQube on-prem | GitHub Enterprise Server | |
Analysis runs on your runners The CI workflow runs in your own GitHub Actions and asks only for read access to repository contents. The free hosted scan is the other way round — you hand us the repository to scan it. | ShipGate CI does | Processed by the model provider | |||
| Pricing | |||||
Free tier ShipGate free scans are capped per month. ShipGate CI unlocks unlimited scans and the merge-path check. | Yes — unlimited repository scans | Yes — limited scans | Yes — SonarQube Community | No — licensed add-on | Yes — limited |
Recurring price ShipGate CI is $50/month and is included with every paid WholeStack plan. Competitor rates change often enough that quoting them here would go stale silently — the vendor links below are the authority. | $50 / mo for ShipGate CI | See vendor pricing | See vendor pricing | See vendor pricing | See vendor pricing |
Enterprise pricing | Contact sales | Custom | Custom | Custom (GitHub Enterprise) | See vendor pricing |
ShipGate is not trying to replace your CVE scanner — it fills the merge-gate and audit-trail gap that existing tools leave open. Scan a repository for free and judge the output yourself, or talk to us about your stack.