Your Developers Picked Their AI Coding Tool. Now You Have to Buy It.

The request that reaches procurement is three words long. We want Cursor. What procurement has to answer is a security questionnaire, a seat forecast, and a clause about what happens to the source code, and the pricing page carries none of the three.

That gap is the whole problem with buying AI coding tools right now. A developer evaluates one of these by using it for a week and noticing whether the work goes faster. That is a legitimate way to pick a tool for one person. It is not a way to pick a tool for two hundred people, because the questions that decide a company purchase never come up in a single-user trial. What does a seat cost on the business tier, not the individual one. Does unused usage pool across the team or evaporate per person. Who can restrict which models and which repositories. What happens to the code after it leaves the editor. Who pays if the model emits something that turns out to be somebody else's intellectual property.

This is a comparison of six tools most shortlists converge on - GitHub Copilot, Cursor, Claude Code, OpenAI Codex, Windsurf, and Gemini Code Assist - read through the plan rather than the product. Every price and plan detail below was checked against the vendor's own published page on 2 October 2026. Where a vendor does not publish a figure, that is what it says. Nothing here is estimated and presented as fact.

Two things to flag before the tables. First, the headline per-seat number has become the least informative figure on the page, and the credit-billing section explains why. Second, the market is moving faster than the content written about it, which is why two of the URLs you would type from memory now resolve to different companies.

What each of these six tools actually is

Form factor drives almost everything downstream - which developers can adopt it without changing habits, whether it runs in CI, how much of the repository it can hold in its head. Worth getting straight before the pricing, because it predicts the adoption fight better than any feature row.

GitHub Copilot is an extension inside editors you already use, plus a CLI and a coding agent that opens pull requests. It is the default-adoption option because it meets developers where they are, and because many companies are already paying GitHub for something else.

Cursor is a fork of VS Code. Developers install a new editor rather than a plugin, which is a bigger adoption ask and buys tighter agent integration and repository-wide context in return.

Claude Code is an agent that lives primarily in the terminal, with IDE, web, and Slack surfaces around it. It assumes a developer comfortable delegating a whole task rather than accepting line-by-line suggestions.

OpenAI Codex runs across CLI, IDE, desktop, and web, and is bundled into ChatGPT subscriptions rather than sold as a separate product. That bundling matters for procurement in a way we come back to.

Windsurf was an IDE fork competing directly with Cursor. It is now part of Cognition, and this is where a comparison written from memory goes wrong.

Gemini Code Assist is Google's IDE assistant plus CLI, free for individuals and sold to businesses in Standard and Enterprise tiers through Google Cloud.

Three tools on your shortlist changed hands

Visit windsurf.com/pricing today and the page that loads is Devin's plan list, under Cognition. Visit tabnine.com/pricing and it redirects to a Tricentis contact form. Amazon CodeWhisperer, which still appears in search queries and in roundups published last year, no longer exists under that name - its capabilities moved into Amazon Q Developer and Kiro.

None of this is trivia. It means a shortlist assembled from a blog post, or from a colleague's memory of last year's evaluation, can contain a product that no longer has the owner, the roadmap, or the pricing it had when the recommendation was written. Check the vendor page. Not the roundup, not the blog post, not the slide somebody made in spring. Check it on the day you build the shortlist.

The six tools, read through the business tier

Four criteria separate these plans in ways that change a purchase decision: what a business seat costs, how much included usage comes with it, whether that usage pools, and which administrative controls arrive at which tier. Everything else is secondary.

Three observations that matter more than the numbers themselves.

Copilot and Cursor are not actually $19 and $40 apart. Copilot Business at $19 requires nothing else. Copilot Enterprise at $39 requires GitHub Enterprise Cloud underneath it, so the real comparison depends entirely on whether you already pay for that. If you do, Copilot is cheaper than the table suggests. If you do not, it is more expensive.

Codex is the awkward one on a procurement spreadsheet, because there is no Codex line item. You buy ChatGPT seats and Codex comes with them. That is good news if the company already standardized on ChatGPT company-wide, and an odd conversation with finance if it has not, because the tool your engineers want arrives attached to a general-purpose assistant for everybody.

Windsurf is the row with the most blanks, and the blanks are the finding. Google (2026) does publish Code Assist pricing on its product page, at $19 per user per month for Standard and $45 for Enterprise on annual commitments. A tool that does not publish its business-tier price, as Cognition currently does not for a Windsurf-branded enterprise tier, is a tool you cannot budget for without a sales call. That is not disqualifying. It is a timeline item.

How credit billing works, and why your seat price stopped predicting the bill

GitHub announced on 27 April 2026 that Copilot was moving to usage-based billing, effective 1 June 2026. Premium requests went away. AI Credits replaced them. One AI credit is worth one cent.

The mechanism is simpler than the anxiety around it. When a developer uses Copilot, the interaction consumes input tokens, output tokens, and cached tokens. Each model has its own per-token rate. The total converts into credits at a published rate per million tokens. Copilot Business grants 1,900 credits per user per month, which is $19 of credit against a $19 seat. Enterprise grants 3,900 against $39.

Two details change the forecast substantially, and most coverage skips both.

Standard code completions stay included on every paid plan. They do not consume credits. If your developers mostly accept inline suggestions, the credit allowance is close to irrelevant and your bill is basically the seat price.

Credits pool. Each Copilot license contributes its credits into a shared enterprise pool, and usage past the pool is charged beyond it. This is the single most consequential line in Copilot's billing documentation, and it cuts in the company's favor. In a pooled model, the three platform engineers running agents all day are funded by the forty developers who use completions and little else. In a per-user model those same three engineers hit a wall in week two and file a ticket.

That is the actual difference between the pricing models in this category, and it is why "pooled or per-user" earns a column in the table above. Cursor charges $40 per user on Teams with usage included per plan and on-demand usage billed in arrears, and reserves pooled usage for the Enterprise tier. Claude does something different again: rather than pooling, it sells two seat types in the same Team plan, with a premium seat at roughly five times a standard seat's usage, so you buy the heavy users a bigger allowance instead of sharing one.

Three vendors, three answers to the same question. Nobody's comparison chart has that column.

Why agentic tools broke seat pricing

A completion costs a few hundred tokens. An agent asked to migrate a module reads dozens of files, writes several, runs tests, reads the failures, and tries again. The ratio between a light user and a heavy user used to be maybe three to one. With agents it can be orders of magnitude. Flat per-seat pricing cannot absorb that, which is why every vendor in this category has moved toward metering, and why the industry commentary on usage-based developer-tool pricing has converged on the same conclusion from several directions at once.

The clause worth asking for before you sign

Allotments in this category have been re-cut mid-plan more than once, sometimes with the pricing page changing before any announcement reached customers. The headline number held steady while the thing it bought got smaller .

So ask for two things in writing. A notice period before any change to the credit allotment or the overage rate. And price-and-allotment lock for the contract term. Neither is exotic. Both are much easier to get before you sign than after.

What this costs at 25, 100, and 400 developers

The figures below are a model, not a quote. They exist to show which variable moves your bill, because that is what a budget conversation needs.

Assumptions, stated plainly so you can disagree with them: 20 percent of developers are heavy agent users, each consuming roughly three times their included allowance. The remaining 80 percent stay inside their allowance. Seat prices are the published business-tier prices above. Annual commitment discounts and negotiated enterprise rates are excluded, both of which push real numbers down. The figures below also charge every unit of heavy-user excess in full, with no pooling credit applied, so they are the un-pooled worst case rather than the expected bill. And the 20 percent is a placeholder, not a measurement: it is the one number here with no source, so substitute your own once a pilot shows you where credit burn actually lands in the vendor's admin console.

One caveat on the Claude column: Claude Team is sold for 2 to 150 seats, so the 400-seat figure is an extrapolation of the per-seat rate rather than a plan you could buy. At that headcount you are in Enterprise pricing, which is quoted.

The sensitivity is the point. Raise the heavy-user share from 20 percent to 30 percent and the pooled model absorbs most of it, because the light users' unused credits are still in the pot, which would pull the Copilot column below the figure printed above. Do the same on a per-user model and the overage lands directly on the heavy users' lines. At 400 seats that difference is larger than the gap between any two vendors' seat prices.

Which means the first number to establish is not a price. It is how many of your developers will actually run agents, and how hard. If you do not know that, you are not ready to model the cost, and a 30-day pilot that measures credit burn per developer per week will tell you more than another week of comparing feature lists.

The feature comparison that still separates these tools

Completions converged. Every tool in this list produces competent inline suggestions, and a demo built around autocomplete will not distinguish them. What separates them now is how much autonomy the agent has, how much of the repository it can hold in context, and whether an administrator can route work to a specific model .

Criteria, declared before the table: agent autonomy, editor and terminal surfaces, codebase context, model choice and whether it can be restricted, built-in code review, and integration surface including MCP.

Best for, and not for, which is usually more useful than any row above.

Copilot is best for broad adoption across a mixed team that will not change editors, and for companies already inside GitHub Enterprise Cloud. It is not the pick if you want the most aggressive agent autonomy available.

Cursor is best for teams willing to standardize on one editor in exchange for repository-wide context and strong agents. It is not the pick where developers are committed to JetBrains or to a heavily customized Vim or Emacs setup.

Claude Code is best for terminal-comfortable engineers doing migrations, refactors, and multi-file work where the task is delegated rather than supervised line by line. It is not the pick for a team that wants a completion-first experience inside an IDE.

Codex is best where ChatGPT is already the company's standard assistant, because the marginal cost of adding it is low. It is not the pick if you need a separately governed, separately billed developer tool.

Gemini Code Assist is best for teams already on Google Cloud, where the IDE assistant and the cloud account share an administrative boundary. It is not the pick for a company with no existing Google Cloud footprint, because you would be buying into a second console to manage one tool.

Every row above is a preference. The next section is where vendors get eliminated.

The enterprise requirements that eliminate vendors

This is the section that decides a company purchase, and it is close to absent from the comparison content available online. Features get you onto the shortlist. These get you off it.

Identity

Cursor puts SAML and OIDC SSO on the Teams plan and holds SCIM seat management for Enterprise. That gap matters more than it sounds: SSO gets people in, SCIM gets them out. Without SCIM, offboarding is a manual seat-removal task somebody has to remember on the day someone leaves.

Claude places SCIM at Enterprise, alongside role-based access with fine-grained permissioning. Copilot's identity story runs through GitHub Enterprise Cloud, which is another reason the effective price depends on what you already own.

Ask for the tier, not the capability. Every vendor here supports SSO somewhere. The question is whether it is on the plan you were going to buy.

Audit logs and observability

Claude Enterprise lists audit logs plus a compliance API for observability and monitoring. Cursor lists audit logs at Enterprise. The distinction to probe is whether logs are viewable in a console or exportable through an API, because a security team that cannot pull these into its own SIEM will treat the console as a box unchecked.

Data retention and what happens to your code

This is the question the pricing page will not answer, and the one that most often stops a purchase.

Claude's pricing page shows model-training opt-out across its consumer tiers and custom data retention as an Enterprise capability. For every other vendor on this list, the commitments live in a trust center, a DPA, or an enterprise agreement rather than on the plan comparison.

Three things to insist on, in writing, from every vendor you shortlist. Whether prompts and code are used for model training, and what the default is rather than what is possible. Whether zero data retention is available on the tier you are actually buying, and whether it requires a negotiated contract. What happens to stored data on termination.

A setting is not a commitment. A toggle in an admin console can be changed by anyone with admin access, including by a future administrator who does not know why it was set. Get the contractual version.

IP indemnity

Several vendors in this category offer indemnification against intellectual-property claims arising from generated code, and the terms vary enough that the word alone tells you nothing. What is covered, what is excluded, and what you must have enabled for cover to apply are three separate questions, and the third one catches people. Indemnity conditioned on a duplication filter being active is worth exactly nothing if a developer with admin rights turned the filter off.

Where a vendor does not publish indemnity terms, ask for them and read them. Do not accept a summary from a sales deck as the commitment.

Administrative policy controls

Cursor's Enterprise tier is the most explicit published list here: repository, model, and MCP access controls, auto-run, browser, and network controls, plus invoice and purchase-order billing. Claude Enterprise lets administrators set user and organization spend limits. Copilot Business includes policy control for organizations.

The control that saves the most money is the spend limit, and it is the one most often left unconfigured. The control that saves the most arguments is the model allowlist, because without it the answer to "which model wrote this" is "whichever one the developer picked that day." That answer is fine right up until somebody from legal asks it.

Questions to ask, in both directions

Ask the vendor

• Is the included usage allotment per user or pooled across the organization?
• What is the overage rate, and can we cap it?
• Will you lock the price and the allotment for the contract term?
• Is zero data retention available on the tier we are buying, and does it require a negotiated agreement?
• Do you train on our prompts or our code, and what is the default setting rather than the available setting?
• Exactly what does your IP indemnity cover, what does it exclude, and what must we keep enabled?
• Can we restrict which models, repositories, and MCP servers developers can reach?
• Are audit logs exportable through an API, or console-only?
• What happens on SCIM deprovisioning, and how fast?
• What happens to our stored data on termination?
• Is there a genuine pilot tier, or does evaluation require an annual commitment?

Ask yourselves

• How many developers will actually run agents heavily, and who are they?
• Which editors are in use today, not which ones we standardized on three years ago?
• Do we have a regulated workload that makes zero data retention non-negotiable?
• Do we already pay for GitHub Enterprise Cloud or Google Cloud, and how much does that change the effective price?
• Who administers the policy controls once this is live?
• What does success look like at day 90, stated as something measurable?

Red flags

• A quote that covers seats and says nothing about usage.
• The word unlimited with no published definition of the rate limiting behind it.
• Training opt-out offered as a console setting rather than a contractual term.
• No audit-log export, or logs with no API.
• Indemnity that lapses if any filter is disabled.
• A vendor that changed its credit allotment in the past year and will not offer a notice clause.
• A pilot you cannot exit, or an annual commitment demanded before any trial.
• A pricing page with no last-updated date. In this category, trust the vendor's page over any article about it, including this one, and check the date on both.

Choosing by company size and team profile

Five situations, with the constraint that would rule each option out. The right answer depends far more on what you already own and what you are regulated to do than on which tool scored highest in somebody's benchmark.

Under 25 developers, no compliance pressure. Optimize for adoption speed and the ability to change your mind. Buy a self-serve team tier month to month, skip the enterprise conversation entirely, and revisit in two quarters. Rule out anything that needs a sales call to quote, not because it is worse, but because the procurement overhead exceeds the spend. Copilot Business and Cursor Teams both work here. Claude Team works if the engineers are terminal-comfortable.

25 to 100 developers, already on GitHub Enterprise Cloud. The incumbent has a real structural advantage - the identity layer, the policy controls, and the pooled credits all sit on infrastructure you already pay for. Start with Copilot Enterprise as the default and make an alternative justify the switching cost. Override that default if your developers' actual complaint is agent autonomy rather than completion quality, because that is the axis where the fork-based editors and the terminal agents are ahead.

100 to 400 developers, mixed editors, security review required. Stop trying to find one tool for everyone . The pattern that works at this size is one IDE-native assistant available to all developers, plus one agent licensed to the smaller group doing migrations and platform work. Budget for the security review as a four-to-six-week item, not a formality. Rule out any vendor that cannot produce a DPA and an indemnity document inside that window.

Regulated workload, or EU data residency. Requirements come first and price comes second. Build the shortlist from the vendors that can contractually commit to zero data retention, data residency, and audit-log export on the tier you can afford, then compare only those. This usually means the Enterprise tier regardless of headcount, and it usually means a longer procurement cycle. Plan for it rather than discovering it in week three.

Heavy agentic workload, platform teams, large migrations. Pooled usage and spend controls dominate everything else, because this is the profile where per-user allotments fail loudly. Copilot's shared pool and Cursor's Enterprise pooled usage are both designed for exactly this. Claude's premium seat is the alternative shape, buying a bigger individual allowance rather than sharing one. Rule out any arrangement where a single heavy user can exhaust their month in week one with no way to draw on the team's unused capacity.

If the shortlist is clear but the cost model is not, that is the normal place to get stuck. An AI Readiness Snapshot is a free 30-minute call where we pressure-test a shortlist and a usage forecast against what your team actually does, including the heavy-user share that drives the whole budget. Get an AI Readiness Snapshot .

Running a pilot that produces a defensible decision

A pilot that generates opinions is worse than no pilot, because it ends in a meeting where the loudest preference wins. A few constraints turn it into evidence.

Pick two tools, not five. Eight to twelve developers, thirty days, the same repository and the same kinds of task on both.

Instrument before you start. Baseline cycle time, pull-request review time, and change-failure rate. Without a baseline you cannot tell a real improvement from a motivated one.

Measure credit burn per developer per week. Satisfaction scores are the easy number to collect and the wrong one to decide on, because they tell you whether developers enjoyed the pilot, not whether the rollout budget survives it.

Run the security review inside the pilot window rather than after it. A vendor that cannot produce a DPA in thirty days will not produce one in ninety, and finding that out in month one is cheaper than finding it out after you picked them.

Expect a result that is real but smaller than the vendor's case studies, and understand why before it disappoints anyone. These tools change the coding step. They do not change code review, deployment, coordination, or the wait for a decision from someone in another timezone. Teams that gave their engineers Copilot and saw no change in delivery speed often had a bottleneck somewhere other than typing, and no tool on this list fixes that.

The two numbers that decide this purchase are not on any comparison chart. They are the share of your developers who will run agents hard, and the retention commitment your security team will accept. Establish those two, and the shortlist narrows itself. Prices and plans in this article were verified against each vendor's published page on 2 October 2026, and in this category that date matters more than any recommendation. Check them again on the day you buy.