audytx vs kube-score

audytx analyzes AWS infrastructure code and Terraform pull requests, presenting security and cost findings in GitHub and to coding agents. Its deterministic, non-AI engine models resource relationships such as invocation topology, encryption chains, network exposure, resource lifetimes, and IAM trust graphs. The maker lists 303 AWS Terraform checks and 27 cross-resource reasoning axes. A GitHub App posts pull-request digests, inline review, and SARIF, using read-only contents permission while writing comments, reviews, statuses, and SARIF uploads. An optional GitHub Actions step uploads a resolved Terraform plan over OIDC without shared secrets. A hosted MCP server exposes the engine to Claude Code, Cursor, and Codex; autofix applies line-anchored changes and rescans for up to three passes. AWS, Terraform, and CloudFormation are supported in stated hosted workflows. Free includes 100 scans monthly; Plus costs $20 a month and Pro $100 a month.

kube-score statically analyzes Kubernetes object definitions and recommends changes intended to improve application security and resilience. Its checks cover container limits, NetworkPolicy targeting, PodDisruptionBudget, Pod anti-affinity, container probes, security context, and stable APIs. Optional checks include matching resource requests and limits, container ports, and seccomp profile configuration. You can configure tests to be ignored or enabled globally or for individual objects. kube-score works with Helm, Kustomize, static YAML files, Docker, and resources retrieved from a Kubernetes cluster. Its browser demo accepts Kubernetes YAML or JSON and, according to the maker, processes it in the browser without sending data to a server. Local options include prebuilt binaries for Linux, macOS, and Windows, along with Docker, Homebrew, and Kubernetes Krew. Output formats include human-readable, JSON, CI, and SARIF. In CI/CD, critical errors return exit code 1; warnings can also be set as the exit threshold. The free, MIT-licensed project recommends analyzing all applications deployed to the same namespace together. Building from source requires Go 1.21 or later.