Start with the survey. Add scanners where it says you need them.

A scanner reviews one repo, or one pull request, in one language. Watchdog reviews the product — every repo you ship as a unit, in every language you ship it in, breaking a monorepo down into a CAI per deployable service: each service scored by the same lenses as the whole product, then rolled up into one survey. The API, the front end and the worker end up in one report, not three.

At the line and the pull request Watchdog defers to the specialists. It reads their output and places it in the system picture; it never replaces a deep SAST engine or your live IDE lint.

Same code in, same CAI out under the same rubric and advisory data — re-run the survey and the number holds. That's what makes a trend real, a contract floor you can set and verify at each scheduled scan, and a compliance number an auditor can rely on.

Conditional lenses for DDD, event-driven and event-sourced designs, ADR conformance, and a maturity ladder. Watchdog surveys what the code is *trying to be* — not just what it literally says.

Every repo you ship together — down to the services inside a monorepo — rolls up into one CAI, with each repo's compliance declaration bundled in. Not a pile of disconnected per-repo reports.

Watchdog never edits your code and never certifies you — it assembles the evidence; a human signs. The measurer never sits at the table.

SonarQube + a tech lead's judgement + a spreadsheet. It works — until the tech lead leaves or the spreadsheet is the only place the verdict lives. Watchdog is that exact stack, made reproducible, independent and signable — the rubric outlives the person.

A consultancy reads the code for a fortnight and writes a verdict. Watchdog issues the same kind of verdict deterministically, the day you ask — and re-issues it every scan instead of once, so the trend is real.

The M&A equivalent: excellent, billed per engagement, frozen the day they stop reading. Watchdog gives a CAI comparable from LOI to close, re-derivable by your own advisors from the code itself.

Sonar goes wide across 30+ languages at the line level, with thousands of rules, dataflow SAST and a live IDE gate. We go deep on architecture and domain modelling across the languages we cover, and join the whole product into one number — one roll-up instead of a report per repo, signed compliance, and tasks your coding agent can act on. Sonar goes wide; we go deep and then join it all up. We never re-scan the line.

NDepend is the deepest .NET-native analyser there is: custom CQLinq rules, 100+ metrics, and hands-on exploration inside Visual Studio. Watchdog measures the same architectural core and now draws the same pictures — a module dependency graph and a dependency-structure matrix, alongside Martin coupling, dependency cycles, complexity, abstractness and its own emitted-IL read (Mono.Cecil) — plus a debt model that prices a fix against what not doing it costs per year. The difference is where the graph comes from: NDepend reads compiled .NET assemblies, so its graph is bounded by that ecosystem; Watchdog builds it from a language-neutral code model, so the same graph, matrix and cycle detection apply to every language it models deeply — see the language matrix for exactly which, and how deeply. Around that Watchdog adds what NDepend has no equivalent for at all: git and process mining, security and supply-chain, domain-intent lenses and an ADR maturity ladder. An instrument and a survey, not two of the same thing: NDepend is the microscope an engineer drives by hand; Watchdog is the report that arrives on a cadence.

CodeScene pioneered behavioural code analysis, and its ACE auto-refactoring and method-level X-Ray go deeper than we do. But the overlap runs almost entirely one way: hotspots, change coupling, ownership concentration and knowledge loss are Watchdog dimensions too — and where CodeScene attributes ownership from git blame, Watchdog uses decayed commit attribution, so a mechanical reformat cannot silently reassign a file's owner. That same churn signal now drives the roadmap itself: the same fix ranks higher on code the team edits every week than on code nobody has opened in three years. Around that shared core Watchdog adds architecture and ADR conformance, security, supply-chain and compliance — none of which CodeScene offers — folded into one signed, commit-pinned CAI. The remediation split is open vs closed: CodeScene fixes inside its own ACE engine; Watchdog stays read-only and hands every finding to whatever agent you already run — then re-measures.

Snyk gives the deepest SCA database, container & registry scanning and automated fix-PRs. Watchdog runs its own SCA across every ecosystem you ship — NuGet, npm, Maven, PyPI, Go modules, Cargo, Composer, RubyGems, Hex and pub — plus IaC, secrets and licences; a CycloneDX SBOM every survey; all folded into one reproducible number and CWE-tagged for an auditor. We don't out-scan a specialist on line-level dataflow, and we don't open PRs.

Coverity gives path-sensitive dataflow defect detection, C/C++ breadth, safety-critical rigor and MISRA / CERT compliance. Watchdog adds architecture and domain lenses and one reproducible system-level score across the languages it covers, including the .NET and Java parts of a mixed estate — where security findings map to the CWE taxonomy an auditor recognises, and are emitted in SARIF so your code-scanning tools show them too. For safety-critical C and C++, Coverity is the right tool and we don't claim otherwise.

CodeRabbit gives AI review of the PR diff in the moment — conversational inline comments, issues caught as written, and a summary of that pull request. Watchdog describes change at a different grain: a product changelog and system overview over a release or sprint window, grounded in the commit messages and the diff — and where the two disagree it trusts the diff, so an entry says what was actually implemented rather than what was intended. The deterministic core fuses the commit range with the architecture map and the structural delta; the model only narrates on top, and a window whose changes cannot be grounded in a readable diff is reported as such instead of dressed up as a confident release note. Different time, different altitude — zero collision.