CrossCheck by zFinia
People, AI coding agents and bots each change your repository without the whole picture. CrossCheck shows the package-manager configuration evidence a change introduces, and an explicit repository contract can turn your team's declared decisions into enforceable policy. It reports the files it relied on instead of guessing maintainer intent.
Connect GitHub and check a real repository in seconds.
One successful repository scan per GitHub account. No card required. Additional repositories and continuous monitoring are paid.
Plans start at US$29/month for 3 repositories. Want us to implement it across your repositories? US$499 one-off.
Example pull request
1 · Your repository
Uses pnpm to install packages.
package.json and pnpm-lock.yaml agree.
2 · An AI coding tool opens a pull request
It ran npm install and added package-lock.json.
Now the project has two package managers.
3 · CrossCheck warns on that pull request
“Package manager conflict: npm vs pnpm. Introduced by package-lock.json.”
Fix: remove package-lock.json and reinstall with pnpm.
Public maintainer validation
The maintainer confirmed the scheduled release workflow was forgotten and deprecated, then authored and merged the cleanup removing that workflow, the stale package-lock.json and related dead references. The pull request explicitly thanks @thebigcheeseorama-ship-it for catching it.
Maintainer confirmation →Maintainer-authored merged PR #1032 →
The owner confirmed pnpm-only intent, then authored and merged the cleanup.
The maintainer confirmed the repository root is npm-only and the Yarn references were leftovers.
These are maintainer-validation outcomes from public GitHub threads—not customers, installations, or evidence that these repositories use CrossCheck.
Why teams need it
Your team chose pnpm. An AI tool asked to add a library runs npm install instead, and a second lockfile appears in the pull request.
With two lockfiles, CI, teammates and AI tools can each install different versions of the same dependencies. Bugs then appear on some machines and not others.
Lockfiles are thousands of generated lines, so people skim past them. CrossCheck reads them for you and points at the exact file.
What the fix looks like in real repositories
Commit messages from public repositories that later removed a contradicting lockfile. CrossCheck flagged the commit before each of these fixes.
14 of 14 such fixes were caught beforehand in our benchmark. Methodology
CrossCheck: a1b2c3d4e5f6 → f6e5d4c3b2a1
Packages evaluated: 1
Package manager: CONFLICT (npm vs pnpm)
ORM: none detected
Database: not established
Authentication: none detected
Agent instructions: none found
NEW contradictions introduced by this change: 1
1. Package manager conflict: npm vs pnpm
- package-lock.json → npm (lockfile present)
- package.json → pnpm ("packageManager": "pnpm@10.12.1")
- pnpm-lock.yaml → pnpm (lockfile present)
Fix: "packageManager" declares pnpm. Remove package-lock.json and reinstall with pnpm, or change "packageManager" if you are deliberately migrating.
Introduced by: package-lock.jsonGenerated by @zfinia/crosscheck@0.1.0 when this page was built.
Pricing
Your first successful repository scan is free. Continuous monitoring is priced by the number of repositories you protect — not by developers, agents or scan count.
Free
US$0once
One successful repository scan per GitHub account. No continuous monitoring.
Starter
US$29/month
Continuous CrossCheck protection for small projects and solo builders.
Team
US$79/month
Continuous monitoring for engineering teams using AI coding tools across multiple repositories.
Scale
US$299/month
A broad repository allowance for larger engineering organisations and multi-product teams.
Paid plans cover continuous monitoring on the listed repository allowance. The US$499 implementation package is optional and separate from the recurring monitoring plan.
We install CrossCheck across your repositories, record what's already there, decide with you how strict it should be, and tailor the first checks to how your team works.
You do not upload source code to zFinia. CrossCheck runs inside your GitHub environment. You choose whether to grant temporary setup access or have us provide the exact files and pull requests for your team to apply.
White-glove implementation
US$499 one-off
One-off implementation fee. Choose a recurring monitoring plan separately for ongoing protection after rollout.
Secure checkout via Stripe. We contact you after purchase to confirm scope and rollout details.
Why you can trust it
A check people learn to ignore is worse than no check. CrossCheck therefore keeps its default signal narrow and deterministic: it shows the exact package-manager configuration state it found, while maintainer intent still belongs to the repository owner.
47 / 47 emissions had verified evidence
Across four untouched holdout samples (947 public repositories), every cited lockfile, declaration or install-step signal was checked at its frozen commit. This does not mean every emission was a repository mistake.
Transparent evidence
Every finding links back to the exact repository files and commit that produced it, and our benchmark methodology is public.
Your code stays with you
The one-time web scan uses read-only access and retains no repository contents. Paid monitoring runs inside your GitHub environment.
Honest about its limits
It covers one kind of problem well. It is not a general code reviewer.
We sampled public repositories that contain AI-agent instruction files, froze each sample before running CrossCheck on it, and checked every finding by hand. A finding we could not confirm counts as wrong.
| Measure | Default check | Experimental checks |
|---|---|---|
| Default emissions with cited configuration evidence verified on 4 untouched holdouts (947 repositories) | 47 of 47 | 23 of 27, about 85% (samples 3 and 4) |
| Package-manager contradictions that maintainers later fixed, caught beforehand | 14 of 14 | — |
| Control commits wrongly flagged | 0 of 36 | 0 of 36 |
| Can block a merge | Only if you turn it on | Never |
47 of 47 means the cited repository state existed as reported at the frozen commits. It does not establish maintainer intent or that every emission required remediation. Interpretation corrected 21 September 2026. Full method: methodology on GitHub.
How it works
On each pull request, CrossCheck compares supported configuration files before and after the change and reports new package-manager signals with exact evidence. When the repository has an explicit CrossCheck contract, it can separately identify violations of the decision the team declared.
Multiple package-manager configuration signals in one project: for example package-lock.json next to pnpm-lock.yaml, or a lockfile that differs from the packageManager field. CrossCheck reports the evidence; multiple managers can be deliberate. It also checks package.json files that are not valid JSON.
ORM, database, sign-in provider, CI install steps and AI-agent instruction files. Off by default, shown as notes, and never able to block a merge.
Not a general code reviewer and not a merge-conflict tool. It doesn't install or run anything in your project.
Questions
A repository consistency service for teams using AI coding tools. It reports supported configuration evidence, can enforce decisions that a repository explicitly declares in a CrossCheck contract, and paid plans keep protected repositories monitored as they change.
Development teams where AI coding tools such as Claude Code, Codex, Cursor or Copilot change code alongside people. Those tools don't know your team's past decisions, so they can quietly undo them.
A second lockfile can be a real problem when it appears accidentally, because CI, teammates and AI tools may install different dependency trees. Some repositories deliberately support or maintain more than one package manager, so CrossCheck surfaces the state and evidence without treating lockfile coexistence alone as proof of an error.
One successful repository scan per GitHub account. It gives you the full baseline and evidence for that repository. The free scan is a proof of value, not ongoing monitoring: additional repositories and continuous pull-request monitoring require a paid plan.
Starter is US$29/month for up to 3 repositories, Team is US$79/month for up to 10, and Scale is US$299/month for up to 100. Each paid plan includes continuous monitoring on protected repositories with unlimited developers, AI coding agents and CrossCheck runs.
The CrossCheck Implementation is US$499 one-off. We implement CrossCheck across up to 10 repositories, establish the baseline, configure enforcement and support the rollout for 30 days. Ongoing monitoring requires a recurring CrossCheck plan. It includes baseline reports, enforcement setup, edge-case review, up to 2 organisation-specific checks and 30 days of rollout support.
The one-time web scan uses read-only access to repositories you choose and retrieves only the supported configuration files needed for that scan; those contents are not stored. Paid monitoring is designed to run inside your GitHub environment so source code does not need to be uploaded to zFinia.
Not unless you ask it to. By default findings are advisory. Blocking should be enabled only after your team reviews the baseline and, where intent matters, declares the repository decision it wants enforced.
There are optional experimental checks for ORM, database, sign-in provider, CI install steps and AI-agent instruction files. They were right about 85% of the time in testing, which is below our bar for a default check, so they are off unless you turn them on and they can never block a merge.
Going deeper: technical documentation · testing methodology · monitoring plans
Subscribed to an earlier CrossCheck plan? Email support@zfinia.com.