perch vs Endor Labs

The two tools differ in kind, not degree. Endor Labs is a verification engine: its AURI engine mixes deterministic program analysis with data flow tracing to cut what the vendor claims is 95-97% of traditional SAST/SCA false positives, then prioritizes by reachability (including code-to-image reachability for containers). Its AI SAST extends to C as of August 2026 and covers first-party and business-logic scanning; secrets detection runs before commit; Package Firewall blocks malicious packages at install. Its distinguishing layer is agent governance: it inventories every AI coding agent, model, MCP server, and skill, learns your architecture from AGENTS.md and CLAUDE.md context files, and enforces policy at the moment of action — allow, block, or ask a human — with an audit trail. Perch has none of that. It is a CLI that runs perch scan over a source tree and returns findings with rule ID, file:line, severity, a confidence percentage, and enclosing method. Its differentiator is authoring: you define rules in perch.yaml with perch rules add, scope them with --each method, --each file, or --where "src/**/*.ts", and state them as plain-language --ensure guarantees. It filters to one rule, checks a single symbol, scans only changed files with --since origin/main, and exits 3 to fail CI. Perch detects off-by-one loops, weak crypto, and unhandled nulls; Endor Labs detects the same broad class of issues but as one input into a governed enterprise workflow.

Endor Labs is freemium in the least generous sense: the only self-serve option is the Developer tier, which does local scanning with no account required, and everything else is a quote-based enterprise purchase. Its own 'not for' list says it plainly — buyers who need instant self-serve paid plans. Budget for a sales cycle, a deployment inside infrastructure you control, and onboarding alongside a security or DevSecOps function; several capabilities assume CI/CD pipelines exist. Perch costs nothing. You install it with npm install -g @lakeday/perch and run it. The hidden cost isn't licensing, it's labor: Perch ships no vendor rule pack worth speaking of, so the return depends entirely on the perch.yaml rules your team writes and maintains. Filtering with perch scan --filter rule=<name> and gating with perch scan --since origin/main keeps CI minutes near zero, and findings stay in the local .perch directory rather than a hosted dashboard you'd pay for. So the cost comparison is enterprise contract plus implementation effort versus zero dollars plus rule-authoring effort — not two tiers of the same product.