Can a model replace static analysis for security review?

Not as a gate. A model answers differently between runs, which a baseline, a suppression, and a CI threshold cannot use reliably. Use model review for authorisation, business rules, and other work that needs judgement.

How much do local static checks cost per run?

Nothing per token. --format agent puts the report on a budget of about 1500 tokens so the checks a parser can answer stop being asked of a frontier model.

owlwarden and model review

owlwarden vs a model reviewing your code

The tools cover different jobs. The table compares scope and default behavior so you can decide whether to run one or both.

See owlwarden rules Review the gaps

Capabilitymodel reviewowlwarden

Novel bugsStrongRule-bound

Same answer twiceNoYes

Always runsWhen askedHost gate

Cost per scanTokensNone

Scope and defaults differ. Run both when you need both sets of checks.

Use model review for

Judgement. Authorisation logic, business rules, whether this particular endpoint should be public. No AST shape exists for any of it.
Novelty. A bug nobody wrote a rule for.
Context. It can read the ticket, the tests, and the migration in one pass.

Use static rules for

It gives the same answer twice. A baseline, a suppression, and a CI gate all require that. A reviewer that changes its mind between runs cannot be a gate.
It always runs. A hook fires on the host's event; a model reviews when it is asked, and mid-refactor it often is not.
Low-cost repeated checks. A parser can check the same known pattern after every edit without using tokens.
Checks outside the prompt. Host hooks run independently of model instructions.

Run both

Run static checks locally, then use model review for architecture, authorisation, payments, and data handling. --format agent keeps the static report within a token budget.

owlwarden scan --format agent --budget 1500

Other comparisons

All rules / Coverage, gaps included / Offline