dif.sh Review (2026): Pricing, Features & Honest Verdict

dif.sh is an open-source feature flag and A/B testing tool that keeps every flag as a markdown file in your repo, plus a $50/month hosted layer. Verdict: a sharp idea for agent-driven teams, held back by a JavaScript-only SDK. Best for: TypeScript teams shipping experiments with coding agents. Price: From $50/mo (free plan: yes, CLI only). Rating: 7/10.

What is dif.sh?

We found dif.sh at the top of Product Hunt on 5 September 2026, where it took the number one spot with 353 upvotes. It is a feature flag and experimentation tool built around one idea: every flag, A/B test, holdout and staged rollout is a markdown file that lives in your repository next to the code. YAML frontmatter holds the id, status, surface, audience rules, variants and metrics. The body holds the hypothesis, the rationale and, once the test ends, the decision. Reviewing a flag means reviewing a pull request.

The CLI is written in Rust and released under an unmodified MIT licence. We read the LICENSE file, not just the badge. It compiles the active experiments into a typed TypeScript client, an audience module, and a context.json file that coding agents read at the start of a session. The vendor calls that file “a CLAUDE.md for experiments”, and that framing is the whole pitch: your agent knows which flags exist and what past tests found before it writes a line. The company behind it publishes almost nothing about itself. The footer reads “2026 Dif”, and there is no about, team, terms or privacy page anywhere on the marketing site. We come back to that below.

What Are dif.sh’s Key Features?

Flags and experiments as markdown files

One file per experiment sits under dif/experiments/, split into active and concluded folders. Frontmatter declares audiences with include and exclude predicates on attributes you declare once in dif/config.yaml, such as country, plan or returning_visitor. Values arrive at runtime, so no customer list is ever committed to git. The body is freeform, and the vendor’s own example carries a Brief, a Rationale and a Decision block that the conclude command fills in. Surfaces get their own files too, each carrying a running log of what earlier tests found on that part of the product, so the next draft starts from evidence rather than a blank page.

A build step that fails on collisions

The validate command runs every check in one pass and prints source locations on errors. The build command compiles the runtime artefacts. The part we liked most: the build resolves an exclusion graph and refuses to compile when two live tests would bucket the same user. You put one exclusion_group line in the frontmatter and the clash breaks in CI rather than in production. A qa command lets you force a variant for a given user id or attribute set, and there is a preview URL flag for staging environments. This is the kind of guardrail that usually only shows up in enterprise experimentation platforms.

context.json and the agent skills

Every build regenerates dif/context.json with the active flags, their variants and recent learnings. The init command also writes guidance blocks into CLAUDE.md, AGENTS.md and .cursorrules, and installs three Claude Code skills for authoring an experiment, concluding one, and generating surfaces. The blog has a walkthrough of an agent creating a flag, gating the code and running validate on its own work so that a broken flag fails the PR. This is the feature that separates dif.sh from every incumbent, and it ships in the free CLI.

Dif Cloud, which writes back as pull requests

The optional hosted layer reads your repo and shows exposures, lift and a 95 percent confidence interval for each experiment, with a ready-to-conclude flag when a variant clears the bar. At that point Cloud drafts the verdict into the file’s Decision block and opens a pull request against your repo. It also keeps a shared metrics catalog, watches guardrail metrics for drift, and drafts the next experiment from the surface log. Nothing edits your files without a PR, and git stays canonical. That is the right call, and it is rarer than it should be.

What Did We Find in the Repo and the Packages?

Package metadata tells a clearer story than the launch page. The CLI and SDK packages were first published on 22 and 29 May 2026 and both sit at version 0.6.1. The CLI package was last modified on 6 August, and the GitHub repository’s last push carries the same date. So the code that launched on 5 September had not changed in 30 days. The repo has 13 stars, zero forks and zero open issues. None of that is a defect. But it is not the community traction some open-source launches carry, and you should know you would be an early adopter.

Its SDK is JavaScript only. It is pure TypeScript with zero dependencies, with React and Svelte adapters and a server entrypoint. There is no Python, Go, Ruby, Swift or Kotlin SDK, and the docs do not mention one on a roadmap. For a feature flag tool that is a hard limit: a backend written in anything other than Node cannot evaluate a dif flag today. LaunchDarkly and Statsig each ship dozens of SDKs. If your stack is not TypeScript end to end, stop reading here.

One more thing we could not find: a terms of service or a privacy policy. The /terms and /privacy routes both return 404, the marketing pages link to neither, and the Cloud app redirects every path, including /terms, to a login screen. Dif Cloud takes payment and ingests your exposure events. We would want to read the contract before that, and right now there is nothing to read.

How Does the Event Meter Actually Work?

Cloud bills one thing: events. Each exposure the SDK records and each result you track is one event. A 500-row batch bills as 500, and deduped retries and rejected payloads never bill. The Pro plan includes 1 million events for $50, which works out at 5 cents per thousand, and overage is 2 cents per thousand. So the marginal event costs 60 percent less than the included ones, which means the $50 is mostly buying the dashboard and the seats rather than the traffic. Compare Statsig, where Pro includes 5 million events for $150 (3 cents per thousand) and overage is 5 cents per thousand. dif’s overage is less than half of Statsig’s, but its included rate is higher.

The guardrails are the best part of the pricing page. A spend cap is on by default. At the cap, ingest returns 429 and events shed, so the bill cannot exceed the number you set. Usage alerts fire at 50, 80 and 100 percent of the allowance by email and Slack. Per-project client-side sampling lowers the bill. Seats are unlimited on every plan. One loose end: the FAQ says raw events age out “at 30 or 90 days by plan”, but the only two plans on the page are Pro at 90 days and Enterprise at a negotiated retention. Whichever plan gets 30 days is not on the page.

How Much Does dif.sh Cost?

The CLI and SDK are free and open source, and Dif Cloud starts at $50 per month per workspace. That includes 1 million events, unlimited seats, unlimited projects with events pooled across them, 90-day raw history with aggregated results kept forever, and email support. Overage is $0.02 per 1,000 events. Annual billing gives two months free, so $500 a year. Enterprise is custom, with negotiated event pricing, SSO and SAML, audit logs, region pinning, an SLA and invoicing.

There is no free hosted tier and no trial listed. That is the gap against the field. GrowthBook’s Starter plan is free for up to three users, Statsig’s Developer tier gives you 2 million events a month at no cost, and PostHog’s free tier covers 1 million rows a month. dif.sh answers that with “the CLI is free”, which is true, but the CLI alone gives you no results dashboard. You either run init with custom events and forward them to Segment, Amplitude or your warehouse and compute lift yourself, or you pay the $50 from day one.

Who is dif.sh Best For?

Use dif.sh if your product is TypeScript with React or Svelte on the front end, you already lean on coding agents for feature work, and you want flags reviewed in pull requests like everything else. It also suits small teams where unlimited seats matter more than a free tier, and anyone who has been burned by two experiments colliding on the same users.

Skip dif.sh if your backend is Python, Go or the JVM, you need mobile SDKs, you want a free hosted dashboard to start with, or your procurement process needs a terms of service before events leave your app. Skip it too if you want a large community around the tool. Thirteen stars means you will be filing the first issues yourself.

Best dif.sh Alternatives

GrowthBook is the closest open-source rival and has the SDK breadth dif lacks. The Starter plan is free for up to three users with unlimited flags and experiments, and Pro is $40 per seat per month with 2 million CDN requests included and $10 per million after that. Seat-based pricing cuts the other way from dif’s unlimited seats.

Statsig is the value pick if you want a hosted platform with a real free tier. The Developer plan includes 2 million events a month at no charge. Pro is $150 a month with 5 million events included, then $0.05 per 1,000. It has more than 30 SDKs and bundles analytics and session replay.

Unleash is the self-hosting option. The open-source edition is free with no seat limit, capped at 1 project, 2 environments and 5,000 flags per instance. Pay-as-you-go on Unleash Cloud is $75 per seat per month with 53 million API requests included and $5 per million after that. No experimentation stats engine, though. It is flags first.

Final Verdict: Is dif.sh Worth It?

The idea is right and the execution on the CLI is tight. Build-time collision checks, an agent context file regenerated on every build, and decisions written back as pull requests are things the incumbents do not do, and the MIT licence means you can read all of it. The event meter is honest, capped by default, and cheap at the margin. If you run experiments the way this tool assumes, it will feel like someone finally built the thing you kept sketching.

But it ships with a JavaScript-only SDK, a repo that had not moved in a month at launch, no free Cloud tier, and no published terms or privacy policy for a paid service that ingests your traffic. That is why it lands at 7 out of 10 rather than higher. Try the free CLI today if you are a TypeScript team running agents. Wait for a second SDK and a legal page before you put Cloud in the budget.