curtail.com

What It Is

Curtail’s core product, ReGrade, is a runtime behavior regression detection tool for AI-generated code, automated refactoring, and merge request reviews. Built on Curtail’s patented NCAST technology, it does not rely solely on static code analysis or unit test results. Instead, it records real requests, replays them against a candidate version, and compares responses between the current and candidate versions at the field level to detect regressions, vulnerabilities, and performance changes.

Core Capabilities

ReGrade follows a Record, Replay, Compare workflow: it can capture requests from production traffic, CI tests, or security scans, replay them against a candidate version, and then automatically analyze field-level differences. It emphasizes finding unknown issues “without human-written tests,” including zero-day-like behavioral anomalies, API response leaks, and P95/P99 latency regressions. For AI coding workflows, ReGrade provides an MCP Server that can feed findings back into tools and model ecosystems such as Claude Code, Cursor, Qwen Code, OpenAI, Gemini, Cline, and Windsurf, creating a self-correction loop. The site also mentions automated merge request analysis and validation for language refactoring, making it suitable for API service migrations and equivalence testing after rewrites such as C to Python.

Pricing and Deployment

The website offers “Try For Free Now,” but does not disclose specific plans, seats, usage limits, or enterprise pricing. In terms of deployment, NCAST is described as an inline proxy that can handle TLS proxying, with no code changes, SDK, or Agent required. However, the site does not clearly state whether it is delivered as SaaS, private deployment, or self-hosted software. Its open-source status is also not specified; given the patent and trademark language, it appears more likely to be a commercial closed-source product.

Pros and Cons

Its main advantage is that it fills a blind spot left by traditional testing: tests validate expected behavior, while ReGrade compares differences in real behavior, which is especially useful for hidden regression risks introduced by AI-generated code. Field-level diffs are also more valuable for code review and root-cause analysis than a simple pass/fail result. The downside is that the publicly available information is still fairly marketing-oriented, with limited full documentation, compatibility matrices, installation steps, and pricing transparency. The ReCover production protection product is still under development and should not be considered a mature capability yet.

Who It’s For and Access from China

It is best suited for mid-sized to large engineering teams, security teams, and refactoring or migration projects that have real API traffic, frequently use AI coding tools, and care about pre-release regression validation. Access, payment, and procurement options for mainland China are not explained on the site, so availability should be considered unknown. If you need alternatives, consider Diffy, Keploy, traditional API regression testing, contract testing, or building an in-house traffic replay system.