audytx
What it is
audytx analyzes AWS infrastructure code and Terraform pull requests, presenting security and cost findings in GitHub and to coding agents. Its engine models relationships among resources, including invocation topology, encryption chains, network exposure, resource lifetimes, and IAM trust graphs. The maker describes a deterministic, non-AI detection engine with 303 AWS Terraform checks and 27 cross-resource reasoning axes. The GitHub App can post pull request digests, inline reviews, and SARIF. A hosted MCP server exposes the engine to Claude Code, Cursor, and Codex, and its autofix tool applies line-anchored changes and rescans for up to three passes. CloudFormation is supported through the hosted MCP server and GitHub App review. The Free plan includes 100 scans per month. Plus costs $20 a month for 200 scans, while Pro costs $100 a month for 1,000 scans and adds custom checks, org-wide policy controls, and audit log export. The maker says Terraform files are analyzed in memory and discarded, but the product does not yet hold SOC 2 or ISO 27001 certification.
For and against
For
- Free plan includes 100 monthly scans
- Presents findings in GitHub and to coding agents
- Supports Terraform and CloudFormation through hosted tools
- GitHub App does not write repository code
- Autofix can rescan for up to three passes
Against
- Does not support Azure, GCP, or Pulumi
- Offline CLI is Terraform-only
- No SOC 2 or ISO 27001 certification
- Plus costs $20 a month
The verdict
audytx combines infrastructure analysis with GitHub review and coding-agent access, with stated scan limits across its plans. Its stated cloud and infrastructure scope is AWS, Terraform, and selected CloudFormation workflows; certification is not yet in place.
Who it suits
audytx suits teams reviewing AWS infrastructure changes in Terraform pull requests and users who want findings surfaced in GitHub or coding agents. Teams using Azure, GCP, or Pulumi should note that these are not supported.
Plans and prices
Free
Unlimited repositories / files · Unlimited users · 100 scans / month · Email support
Read 21 Oct 2026 · audytx.com
Plus
Unlimited repositories / files · Unlimited users · 200 scans / month · Priority Email support
Read 21 Oct 2026 · audytx.com
Pro
Unlimited repositories / files · Unlimited users · 1,000 scans / month · Priority Email support
Read 21 Oct 2026 · audytx.com
On the record
- Autofix
- The MCP autofix tool applies line-anchored fixes, rescans, and loops for up to three passes.audytx.com · read 30 Sep 2026
- Autofix behavior
- Autofix applies only line-anchored safe replacements, rescans the result and loops for up to three passes.audytx.com · read 21 Oct 2026
- Board size
- The company record lists two directors, Sabari Sinha and Victor Sinha.companyseekers.com · read 21 Oct 2026
- Capital
- The public filing record lists authorised capital of ₹1 lakh and paid-up capital of ₹1 lakh.companyseekers.com · read 21 Oct 2026
- Changelog: CloudFormation
- The July 2026 v1.18 release added CloudFormation pull-request and MCP scanning, including SAM and CDK-synthesized output.audytx.com · read 21 Oct 2026
- Changelog: first stable release
- The June 2026 v1.0 release introduced the pull-request scanner, MCP server, Cost Sampler, Client IDs and security hardening.audytx.com · read 21 Oct 2026
- CloudFormation support
- CloudFormation scanning covers JSON, YAML short tags, SAM and synthesized CDK templates through GitHub App and MCP surfaces, while the offline CLI remains Terraform-only.audytx.com · read 21 Oct 2026
- Company incorporation
- The company record gives 25 May 2026 as the incorporation date.companyseekers.com · read 21 Oct 2026
- Company legal name
- A public Indian company record lists the legal name as Rexstart Labs Private Limited.companyseekers.com · read 21 Oct 2026
- Company registration
- The company record lists CIN U62099WR2026PTC294296 and ROC Kolkata II.companyseekers.com · read 21 Oct 2026
- Company status
- The company record describes Rexstart Labs Private Limited as active, private, Indian and non-government.companyseekers.com · read 21 Oct 2026
- Compliance references
- Findings can carry AWS FSBP, SOC 2 CC6, PCI-DSS and HIPAA references.audytx.com · read 21 Oct 2026
- Context analysis
- The engine models relationships between resources, including invocation topology, encryption chains, network exposure, resource lifetimes, and IAM trust graphs.audytx.com · read 30 Sep 2026
- Context reasoning
- The engine models invocation topology, encryption variants, network exposure, resource lifetimes and IAM trust graphs before deciding whether checks apply.audytx.com · read 21 Oct 2026
- Cost analysis
- Pull-request output includes cost opportunities such as gp2-to-gp3 changes, idle NAT gateways, oversized non-production resources and missing cost-allocation tags.audytx.com · read 21 Oct 2026
- Delivery stages
- The engine is offered at code-time through MCP, review-time through pull requests, and plan-time through resolved plan uploads.audytx.com · read 21 Oct 2026
- Detection engine
- The documentation describes a deterministic Rust engine with 306 checks and 27 cross-resource reasoning axes.audytx.com · read 21 Oct 2026
- GitHub App
- The GitHub App posts one pull-request comment with security and cost findings, supports inline suggestions, and can upload SARIF to GitHub Code Scanning.audytx.com · read 21 Oct 2026
