Sentrint vs GitHub code security: what a private repo needs (2026)

Start with what you already have. On a public repository, GitHub's CodeQL scanning, AI autofix and push protection are free, and you should switch them on before buying anything, Sentrint included. On a private repository GitHub charges $30 per active committer a month for Code Security, while Sentrint charges $10 for 6 scans.

Prices and features on this page were read from GitHub's and Sentrint's own sites on 11 November 2026. GitHub changes this product often, and several features are marked as previews, so check the plans page before you rely on any one of them.

How they compare

GitHub's security features live inside the repository you already use, run on pull requests and need no new account. Sentrint is a separate service that reads a pushed commit when you ask and writes a report on it. The table sets them side by side:

Choose GitHub code security if

• Your repository is public. CodeQL, AI autofix for CodeQL alerts, secret scanning and push protection cost nothing there.
• You want a leaked key stopped before it lands. Push protection blocks a secret at push time, which no after-the-fact scan can do.
• Your organisation already pays for GitHub Team or Enterprise and adding a new vendor means a procurement review.
• You want fixes as pull requests. Agentic autofix takes up to 25 code scanning alerts and makes the changes, using AI credits on paid plans.
• You run several scanners and want their findings in one place through SARIF upload.

Choose Sentrint if

• Your repository is private, you are one or two people, and paying per committer every month is more than an occasional check is worth to you.
• You want each finding explained in plain English with a prompt you can hand to your coding agent. The sample report shows one.
• Your app runs on Supabase or a similar backend, where Sentrint has rules for unverified JWTs, public storage buckets and row level security left off.
• You want an MCP server at https://sentrint.com/mcp that your agent reaches with nothing installed, or npx -y @sentrint/mcp locally.

Pricing, as each vendor lists it

GitHub sells two products for private repositories. Code Security is $30 per active committer a month and covers CodeQL, AI autofix for CodeQL alerts and security campaigns. Secret Protection is $19 per active committer a month and adds validity checks, AI-detected secrets, custom patterns and push protection controls. A solo developer buying both pays $49 a month for one committer.

The plans table puts those paid features under its Team and Enterprise columns, and limits the Free column to public repositories. We read that as meaning a private repository needs a Team or Enterprise organisation, though the page does not say it in a sentence, and we did not read GitHub's own plan prices. Some features, including AI scan for pull requests and agentic autofix, draw AI credits, and the credit price was not on the page we read.

Sentrint's pricing page lists Free at 1 scan a month for a GitHub account at least 30 days old, Top-up at $10 for 6 scans, and Founder at $22 a month for 36 scans across 15 repositories. The MCP server and REST API are on every plan, Free included, and only the scan allowance limits them.

Where Sentrint is worse

Sentrint cannot block anything. It reads a commit after the push, so a secret it finds is already in your history and needs rotating, while GitHub's push protection can refuse it at the door. It also runs only when asked, while GitHub's checks sit on every pull request.

For a public project GitHub gives away far more than we do: CodeQL, autofix, secret scanning and push protection at no cost, against a single free Sentrint scan a month. GitHub's secret scanning also reads pull requests, issues and wikis, which Sentrint never looks at.

Sentrint is a code scan, not a pentest: nothing is executed, no login is tested, and your running site and cloud account are never touched. It has no custom rules, no editor plugin and no enterprise compliance features, and GitHub offers custom secret patterns on its paid plans.

A sensible order

Turn on what GitHub gives you for free first. Then, if the repository is private or you want a report you can act on without reading CodeQL output, run the free Sentrint scan and see whether it tells you anything new.

Is GitHub code scanning free?

On public repositories, yes. CodeQL, AI autofix for CodeQL alerts, secret scanning and push protection are listed at no charge there, and private repositories need the paid products.

Does GitHub have an MCP server for security alerts?

It does. GitHub's official MCP server has a code security toolset for code scanning and secret scanning alerts, and GitHub's documentation says the secret scanning tools are only available through its remote MCP server.

Do I need Sentrint if I already use GitHub's security features?

Perhaps not. If your alerts are already triaged and fixed, a second scanner adds little, and the case for Sentrint is the plain-English report and the fix prompt rather than a promise of finding more.

Does Sentrint work outside GitHub?

It does not. Sentrint reads GitHub repositories only, so code hosted elsewhere needs a different tool.

Sources

Read on 11 November 2026:

• GitHub Advanced Security plans: https://github.com/security/plans
• GitHub docs, scanning for secrets with the GitHub MCP server: https://docs.github.com/en/code-security/how-tos/use-ghas-with-ai-coding-agents/scan-for-secrets-with-github-mcp-server
• GitHub MCP Server repository: https://github.com/github/github-mcp-server
• Sentrint pricing: https://sentrint.com/pricing
• Sentrint sample report: https://sentrint.com/sample