Category guide · criteria, not a leaderboard
How to choose a repository audit tool
We are not going to tell you we are the best repository audit tool. We will publish the criteria we think matter, say plainly where SHPBL meets them and where it does not, and hand you a free keyless run so you can judge it against anything else you are looking at.
Nine criteria — and where we land on each
Does it read the repository before it recommends anything?
A tool that suggests before it surveys is pattern-matching your language, not your codebase.
SHPBL: Yes — the survey step runs first: files, languages, spine files and risk signals, before any candidate is raised.
Is it allowed to conclude nothing should change?
A tool that always finds work is a tool that always sells work.
SHPBL: Yes. Five of our six published runs did not return a clean buy, and the reports are downloadable unedited.
Does every finding carry a file and a line?
Findings without locations are opinions.
SHPBL: Yes — findings and capabilities both carry file, line and the stated contract.
Does anything it applies carry provenance?
Generated code with no source, licence status or supersession record becomes tomorrow's unknown.
SHPBL: Yes: source, parents, licence status and acceptance rule travel with each capability.
Can it write to your repository without asking?
The answer should be no, enforced in code rather than promised in a prompt.
SHPBL: No. The build stage requires a signed, expiring, single-use Build Authorization bound to the caller, or the write is refused.
Does the reasoning survive the run?
If the result lives in a chat window, the next repository pays for the same discovery again.
SHPBL: On a licensed run, yes — harvested capabilities are retained in your own library. On a free run, deliberately not.
Can you verify what you downloaded?
Sealed artifacts let you check that the file you have is the file that was published.
SHPBL: Yes — every release carries a published SHA-256 checksum you can verify yourself.
Can you own it, or only rent it?
Tooling that dies with a subscription is not infrastructure.
SHPBL: Both are offered: $39 a month hosted, or $499 once for the files under a perpetual licence.
Does the vendor hold the certifications your procurement needs?
For many teams this decides the evaluation before anything technical does.
SHPBL: No. SHPBL holds no SOC 2 or ISO certification. If that is a hard gate for you, this is where we fail the criterion.
Compared with the tools you are probably also looking at
SHPBL vs Bito
Choose Bito if what you want is continuous AI review on incoming pull requests, an IDE assistant, and a vendor with SOC 2 Type II for procurement.
SHPBL vs GitHub Copilot
Keep Copilot for writing code. It is a generation tool and it does that job well.
Questions people actually ask
What is a repository audit tool?
Software that reads an existing codebase as it is and reports what exists, what works, what is risky and what must not be touched — as opposed to a generator, which writes new code, or a linter, which checks rules file by file.
How is a repository audit different from static analysis?
Static analysis returns findings ordered by its own severity model. An audit returns a verdict with evidence: what the repository contains, what should change, in what order, and what should be left exactly as it is.
Can I audit a repository for free?
Yes. SHPBL's evaluation tools are keyless over MCP and the HTTP API — no card, no sign-up — and the home-page runner needs only a free account.
Can I try SHPBL without a card or an account?
Yes. Over MCP or the HTTP API the evaluation tools are keyless: no card, no sign-up. A free run writes nothing back and retains no reusable library for you. The runner on the home page needs a free account and allows one run every 72 hours.
Does SHPBL write to my repository?
Only when you authorise it. A run reaching the build or composition stage must obtain a signed, expiring, single-use Build Authorization bound to the caller, and the server refuses the write without it. Write-back arrives as a branch and a pull request on a licensed run.
What does SHPBL cost?
Evaluation is free. Practitioner is $39 a month for licensed execution, write-back and retention, with 25,000 tool calls a month. The Complete Master Library is $499 once for a perpetual licence to that release as files.
Test the criteria against your own repository
One free keyless run tells you more than any comparison page — including whether the honest answer is that nothing should change.