Deepsec Security Scanner
Agent-powered vulnerability scanner for on-demand review of large-scale codebases, surfacing hard-to-find security issues.
- Source repo
- vercel-labs/deepsec
- Stars
- ★ 8.2k
- Last updated
- 19d ago
- License
- Apache-2.0
- Primary language
- TypeScript
- FA score
- 61/100 · Some gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformOpenAI API
- Cost
- Free software; you pay for model usage
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- Engineering teams with large codebases who need periodic deep security scans to identify latent vulnerabilities.
- Not a fit if
- Teams with tight budgets who cannot spend thousands on scans
- Teams expecting out-of-the-box coverage for every tech stack
- Source review
- 61/100 · Some gaps
What does this agent do, and when should you use it?
Deepsec is an agent-driven vulnerability scanner that runs in your own infrastructure, optimized for on-demand review of all code in existing large-scale repositories. It employs top-tier AI models at maximum thinking levels to uncover hard-to-find issues that have lurked for long. Parallel execution across worker machines scales for large codebases, and interrupted runs can be resumed. Deepsec maintains all state and findings in a .deepsec/ directory. It offers commands like scan, process, revalidate, and export. By default, it routes through Vercel AI Gateway but also supports bring-your-own OpenAI/Anthropic keys. Licensed under Apache 2.0.
Deepsec initializes with npx deepsec init to guide model selection and payment. It then studies the codebase, uses regex matchers for fast pattern scanning (scan), and AI-based investigation (process) to emit findings and recommendations. Additional operations include diff-specific review (process --diff), lightweight triage classification, revalidation that checks git history for fixes, enrichment with committer info, and exporting reports in Markdown/JSON. For distributed execution, pnpm deepsec sandbox process can fan out to Vercel Sandbox microVMs.
- Engineering teams with large codebases who need periodic deep security scans to identify latent vulnerabilities.
- Security auditors performing comprehensive reviews of legacy code, leveraging AI to accelerate analysis.
- CI/CD pipelines using
process --diffto gate pull requests, scanning only changed files to prevent new vulnerabilities. - Open-source maintainers using the free fast pattern scan to get candidate sites for potential issues.
- Users with budget constraints, who can set caps via
--max-cost-usdand--max-duration.
How do you install or deploy this agent?
Run npx deepsec init in the root of the repository you want to scan. The command guides you through setting up the model, payment method, and initializes the tool. No separate installation needed.
How do you use this agent?
After initialization, change into .deepsec/ and use pnpm deepsec scan for fast pattern scanning, pnpm deepsec process for AI review, and pnpm deepsec export --format md-dir --out ./findings to generate a readable report. For distributed scanning, run pnpm deepsec sandbox process --project-id my-app --sandboxes 10 --concurrency 4.
What are this agent's strengths and limitations?
- Deep AI analysis can uncover complex, long-standing vulnerabilities that traditional tools miss.
- Resumable scans save work on interruption, continuing from the last checkpoint.
- Supports parallel distributed execution for scaling to very large repositories.
- Offers budget controls and a suite of commands for targeted, efficient review cycles.
- High cost for large codebases due to extensive AI usage, potentially thousands of dollars.
- Default dependency on Vercel AI Gateway, though direct API keys are possible.
- Requires Node.js/pnpm and network access to model APIs, with hidden environment dependencies.
- Built-in coverage may not include all tech stacks; custom matchers require additional effort.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Deepsec Security Scanner This agent | 61 · Some gaps | CLIFree + model costs | ★ 8.2k | 19d ago | TypeScript | OpenAI API |
| Bug Hunter | 79 · Good | Agent plugin / skillFree + model costs | ★ 526 | 2mo ago | JavaScript | Codex · Claude Code |
| OpenCode Swarm | 74 · Some gaps | Agent plugin / skillFree + model costs | ★ 506 | today | TypeScript | — |
| ECC Engineering Harness | 66 · Some gaps | Agent plugin / skillFreemium | ★ 283k | 3d ago | JavaScript | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows: README explicitly states deepsec runs with least privilege, only adds .deepsec/ directory, does not modify other files; user must explicitly initialize via init command, and can set --max-cost-usd and --max-duration limits; data flow transparency, state and findings stored in .deepsec/, API keys only store environment variable names; sensitive data handling, keys not stored, injected in sandbox; dependency security has overrides for known vulnerabilities; external effects documented, e.g., network egress restrictions; rollback supported by re-running command; source attribution has SECURITY.md and NOTICE file. Deductions: user confirmation mechanism only via init interaction, not explicit per-action confirmation; source attribution does not verify publisher identity.
Evidence shows: README and CI config consistent, commands and docs match; dependencies locked via pnpm, overrides for vulnerabilities; failure messages documented, e.g., graceful stop on quota exhaustion. Deductions: no specific examples of detailed error messages for failure scenarios.
Evidence shows: README clearly targets security teams for large codebases, scenarios include CI and coding agents; capability boundaries documented for supported tech stacks and matchers; trigger precision via --diff and --max-cost parameters; environment fit supports Node 22+, runs in CI and sandbox. Deductions: no detailed configuration differences across environments.
Evidence shows: information architecture clear, docs/ directory and SKILL.md; install notes detailed, guided via npx deepsec init; naming stable, commands and parameters consistent; examples and FAQ docs present; known limitations in security model section; license Apache-2.0; versioning and changelog not explicitly provided; maintenance responsibility has CONTRIBUTING.md and SECURITY.md. Deductions: version number not explicit, no CHANGELOG; maintenance responsibility does not specify update frequency.
Evidence shows: output usable, supports multiple export formats (md-dir, JSON); marginal value high, finds long-lurking vulnerabilities; cost-benefit documented, users find it worth it. Deductions: no specific cost data or comparisons.
Evidence shows: README claims supported by doc links, e.g., architecture and data layout; cross-source corroboration limited, relies on own docs; fact and inference separation, clearly distinguishes scan and AI review. Deductions: no independent verification or third-party testing.
- Publisher identity unverified; be cautious about supply chain risks.
- Scan costs can reach thousands to tens of thousands of dollars; set budget limits.
- AI models may produce false positives or negatives; manual review required.
- Sandbox mode reduces risk but is not fully isolated.
FAQ
What is the cost of a scan?
--max-cost-usd.Do I need a Vercel account?
--model-auth direct; no Vercel account is required in that mode.