Head to head
Same commit, same diff. Every finding below is what each tool actually reported.
Coduck
Greptile
CodeRabbit
Every finding, from all three
Row four is a defect Greptile found and Coduck did not.
timeout= the client does not acceptEvery collector raises TypeError on its first call.quotes_expiry unusedThe routes it serves do not exist.dict[str, Any], no schema.None conflates three different failuresAll three are written down as found: false.Two of the seven
The one every tool caught, and the one only Coduck did.
All three found this
+ resp = client.get(url, timeout=30)
PoliteClient.get takes no timeout.
Every collector raises TypeError on its first call.
Only Coduck found this
result = client.get(url) if result is None:+ return {"found": False}A robots refusal, a timeout and a 500 all arrive as None.
All three are filed as the company having no breaches.
The second is a claim about what the stored data means, not about the code, and making it meant reading the docstring of a function the diff never touched.
What this does not show
One pull request, one codebase. A different change could rank these differently.
We chose the pull request and judged the findings. Nobody independent has checked it.
Greptile found the unvalidated JSON. Coduck did not.
CodeRabbit’s checks are a policy layer. A team that wants docstring coverage enforced is served by them.
The CLI is free, local, and takes one command. Compare it yourself.
Read the docs