Qodana From $5/mo · Free plan 8.8 Visit 
DeepSource
deepsource.com
What it is
DeepSource is an AI code review platform for teams writing code with AI. It reviews pull requests through static analysis and an AI review agent, looking for bugs, anti-patterns, and security vulnerabilities. The review process uses more than 5,000 deterministic rules, while Autofix can provide verified, pre-generated patches for many detected issues. Other checks include secrets detection, open-source dependency vulnerability scanning, and infrastructure-as-code review for Terraform and CloudFormation. Teams can track code coverage and set thresholds for tested code. Supported version-control systems include GitHub, GitLab, Bitbucket, and Azure DevOps; listed integrations also include Jira, Okta, OneLogin, Slack, and Vanta. The service is available through web, API, Linux, macOS, Windows, and self-hosted deployment. Its GraphQL API has a documented limit of 5,000 requests per hour per user. The Open Source tier costs nothing and includes unlimited public repositories and members, plus monthly limits for reviews and formatting runs. Team costs $24 a year, billed yearly, with a stated rate of $24 per user per month. A 14-day trial is available. Enterprise uses custom pricing and offers cloud or self-hosted deployment, among other listed features.
Spec sheet
- What it does
- DeepSource analyzes commits for code-health problems, security vulnerabilities and supply-chain risks, then helps remediate them.Read 14 Oct 2026 · docs.deepsource.com
- Product
- DeepSource describes itself as an AI code review platform that automates code reviews for teams writing code with AI.Read 8 Oct 2026 · deepsource.com
- Deployment
- Enterprise customers can choose self-hosted deployment, and the pricing page also lists airgapped deployment as an Enterprise capability.Read 8 Oct 2026 · deepsource.com
- API
- DeepSource provides a GraphQL API with a documented limit of 5,000 requests per hour per user.Read 8 Oct 2026 · docs.deepsource.com
- Integrations
- The directory lists integrations for Azure DevOps Services, Bitbucket, GitHub, GitLab, Jira, Okta, OneLogin, Slack, and Vanta.Read 8 Oct 2026 · deepsource.com
- Support
- The Team plan includes priority support, while Enterprise includes priority support with an SLA.Read 8 Oct 2026 · deepsource.com
- Founded
- 2018Read 28 Sep 2026 · deepsource.com
- Autofix
- AI-powered Autofix supplies automated remediation for many detected code issues.Read 14 Oct 2026 · docs.deepsource.com
- CLI
- The command-line client retrieves issues, metrics, vulnerabilities and reviews, submits coverage artifacts, and supports JSON output for automation.Read 14 Oct 2026 · docs.deepsource.com
- CLI availability
- DeepSource CLI binaries are documented for Linux amd64 and arm64, macOS amd64 and arm64, and Windows amd64.Read 8 Oct 2026 · docs.deepsource.com
- CLI license
- DeepSource's public CLI repository is licensed under the BSD 2-Clause Simplified License.Read 14 Oct 2026 · github.com
- Company profile
- LinkedIn lists DeepSource as a privately held software-development company headquartered in San Francisco, with 11–50 employees and a 2018 founding year.Read 14 Oct 2026 · linkedin.com
- Company scale
- Y Combinator's profile says DeepSource has a 12-person team and serves more than 7,000 teams.Read 14 Oct 2026 · ycombinator.com
- Compliance reporting
- Reporting includes OWASP Top 10, CWE/SANS Top 25 and MISRA C reports.Read 14 Oct 2026 · docs.deepsource.com
- Coverage
- Code Coverage tracks line, branch and composite coverage on pull requests and can enforce merge thresholds.Read 14 Oct 2026 · docs.deepsource.com
- Dependency security
- OSS Vulnerability Scanning performs dependency analysis with reachability information and one-click remediation.Read 14 Oct 2026 · docs.deepsource.com
- Documentation and support
- Documentation includes product guides, API reference, CLI installation and usage, self-hosting, billing and troubleshooting FAQs.Read 14 Oct 2026 · docs.deepsource.com
- Free tier limits
- The Open Source tier lists unlimited public repositories and members, with 1,000 pull request reviews and 1,000 automated formatting runs per month.Read 8 Oct 2026 · deepsource.com
- Funding
- Wellfound reports $7.7 million raised in one round, with the latest funding dated October 2021.Read 14 Oct 2026 · wellfound.com
- GraphQL API
- DeepSource exposes a GraphQL API at https://api.deepsource.com/graphql/ for cloud accounts and a corresponding hostname-based endpoint for on-premise deployments.Read 14 Oct 2026 · docs.deepsource.com
- Infrastructure-as-code review
- Infrastructure-as-Code Review checks Dockerfiles, Terraform plans and Ansible playbooks for security and best-practice problems.Read 14 Oct 2026 · docs.deepsource.com
- License compliance
- License Compliance evaluates full transitive dependency trees against team policies using SPDX identifiers.Read 14 Oct 2026 · docs.deepsource.com
- Limit: advanced rules
- A Gartner-listed critical review says advanced rules can be difficult for beginners.Read 14 Oct 2026 · gartner.com
- Limit: free-plan automation
- A Software Advice reviewer complained that the free plan did not include automated analysis and required manual pull-request review.Read 14 Oct 2026 · softwareadvice.com
- Limit: reporting maturity
- A G2 reviewer said insights and reporting were still early in development.Read 14 Oct 2026 · g2.com
- Ownership news
- Y Combinator lists DeepSource as acquired and reports news dated September 8, 2026 that it is joining Harness.Read 14 Oct 2026 · ycombinator.com
- Praise: analysis depth
- Capterra's highlighted reviewer praised ease of setup, a comprehensive dashboard and customizable analysis rules.Read 14 Oct 2026 · capterra.com
- Praise: dashboards and auto-fix
- Gartner's listed positive feedback mentions auto-fix suggestions, useful metric dashboards and broad language coverage.Read 14 Oct 2026 · gartner.com
- Praise: integration and Autofix
- G2 reviewers repeatedly describe setup and Git integration as easy and Autofix as valuable for reducing review work.Read 14 Oct 2026 · g2.com
- Pull request review
- Its hybrid static analysis and AI review checks pull requests for bugs, anti-patterns, and security vulnerabilities.Read 8 Oct 2026 · deepsource.com
- Rating on Capterra
- 4.8 out of 5 from 10 reviewsRead 14 Oct 2026 · capterra.com
- Rating on G2
- 4.6 out of 5 from 22 reviewsRead 14 Oct 2026 · g2.com
- Rating on Gartner Peer Insights
- 3.3 out of 5 from 0 reviewsRead 14 Oct 2026 · gartner.com
- Rating on GetApp
- 4.8 out of 5 from 10 reviewsRead 14 Oct 2026 · getapp.com
- Rating on Software Advice
- 4.8 out of 5 from 10 reviewsRead 14 Oct 2026 · softwareadvice.com
- Rating on TrustRadius
- 9.7 out of 10 from 2 reviewsRead 14 Oct 2026 · trustradius.com
- Rule library
- The product page says pull request reviews use more than 5,000 deterministic rules alongside an AI review agent.Read 8 Oct 2026 · deepsource.com
- Secrets detection
- Secrets Detection scans for credentials, API keys and tokens using a hybrid engine that DeepSource says has 97% precision and 93% fewer false positives.Read 14 Oct 2026 · docs.deepsource.com
- Security and compliance
- DeepSource's Trust Center lists SOC 2 and GDPR compliance resources plus encryption, penetration testing and access-control controls.Read 14 Oct 2026 · trust.deepsource.com
- Security scanning
- DeepSource offers secrets detection, open-source dependency vulnerability scanning, and infrastructure-as-code review for Terraform and CloudFormation.Read 8 Oct 2026 · deepsource.com
- Self-hosted requirements
- The documented baseline is two servers or virtual machines, each with 16 CPU cores, 32 GiB memory and 500 GiB disk.Read 14 Oct 2026 · docs.deepsource.com
- Self-hosting
- Enterprise Server runs inside a customer's firewall, private cloud or data center and requires a license key.Read 14 Oct 2026 · docs.deepsource.com
- Static analysis
- The product provides static analysis for 18 languages and flags bugs, security issues, anti-patterns and style violations on pull requests.Read 14 Oct 2026 · docs.deepsource.com
- Version-control integrations
- The service supports GitHub, GitLab, Bitbucket and Azure DevOps, including cloud and enterprise variants documented in its FAQ.Read 14 Oct 2026 · docs.deepsource.com
- Webhooks
- Webhooks cover analysis, Autofix, repository activation, issue and team-member events, and payloads can be HMAC-signed.Read 14 Oct 2026 · docs.deepsource.com
Plans and prices
Individual Free free public and private repositories · unlimited static-analysis and formatter runs · AI features metered Read 14 Oct 2026 · docs.deepsource.com
Open Source Free Not stated Unlimited public repositories · Unlimited team members · 1,000 pull request reviews/month · 1,000 automated formatting runs/month · AI Review and Autofix pay-as-you-go Read 8 Oct 2026 · deepsource.com
Open Source Free free public repositories only · 1,000 static-analysis runs/month · 1,000 formatter runs/month · AI features metered Read 14 Oct 2026 · docs.deepsource.com
AI Review Standard $8, paid once per 10,000 processed lines of code after included credits default AI Review tier Read 14 Oct 2026 · deepsource.com
SCA add-on $8 a month per dependency target; $96 per target annually Team and Enterprise only · three targets included in those plans Read 14 Oct 2026 · docs.deepsource.com
AI Review Advanced $15, paid once per 10,000 processed lines of code after included credits multi-pass analysis and extended reasoning; listed as coming soon Read 14 Oct 2026 · deepsource.com
Team $24 a year Billed yearly; $24 per user/month Unlimited repositories and pull request reviews · $100 annual AI Review credit per user · 3 OSS dependency scanning targets included · $8/month per additional target · priority support Read 8 Oct 2026 · deepsource.com
Team $30 a month monthly per active contributor; $24 per contributor when billed annually public and private repositories · unlimited analysis and formatter runs · $10 monthly or $100 annual AI credits per contributor · three SCA targets included Read 14 Oct 2026 · docs.deepsource.com
Enterprise Priced on request custom pricing Team features · BYOK AI · SSO/SCIM · self-hosted deployment · IP allowlisting · SLA support Read 14 Oct 2026 · docs.deepsource.com
Strong points and limits
Strong points
- Pull-request reviews use more than 5,000 deterministic rules.
- Autofix supplies verified patches for many issues.
- Scans secrets, dependencies, and infrastructure code.
- Supports GitHub, GitLab, Bitbucket, and Azure DevOps.
Limits
- GraphQL API is limited to 5,000 requests hourly per user.
- Open Source review and formatting allowances are monthly.
- Enterprise pricing is custom and not listed.
Who it suits
DeepSource suits software teams that want automated pull-request checks, security scanning, and code coverage controls. Its Open Source tier is oriented toward public repositories, while Team and Enterprise add paid or custom-priced options.
DeepSource in depth
Read the full write-up
DeepSource is an AI-assisted code review and security platform for software teams. It is most compelling for teams that want pull-request checks, fixes, dependency and infrastructure scanning, and coverage controls in one workflow. The breadth is a strength, but review quotas on the free tier and finite AI credits on Team make usage a real part of the buying decision.
Overview
Founded in 2018, DeepSource combines static analysis with an AI review agent to identify bugs, anti-patterns, and security vulnerabilities in pull requests. Its reviews draw on more than 5,000 deterministic rules alongside AI, giving teams a broad set of repeatable checks plus an AI review layer. That makes it a stronger fit for teams consolidating code-quality and security work than for those seeking only a narrow secrets scanner.
Key features
Pull-request review and fixes
DeepSource scans pull requests for code and security issues, then provides verified, pre-generated Autofix patches for many findings. That can shorten the path from review to correction, though patches are not promised for every issue. AI Review and Autofix are pay-as-you-go on Open Source; Team includes an annual AI Review credit, but not unlimited AI review.
Security and coverage
Security capabilities include secrets detection, open-source dependency vulnerability scanning, and infrastructure-as-code review for Terraform and CloudFormation. Coverage tracking and enforceable thresholds let teams make tested-code expectations part of the workflow. This combination is useful when teams want these checks alongside pull-request review; it is less compelling if they need only one specialized security function.
Integrations and controls
Integrations include GitHub, GitLab, Bitbucket, Azure DevOps Services, Jira, Okta, OneLogin, Slack, and Vanta. A GraphQL API has a limit of 5,000 requests per hour per user. DeepSource's Trust Center describes SOC 2 and GDPR compliance, with controls including encryption, restricted production access, and penetration testing.
Pricing
Open Source
The free Open Source tier allows unlimited public repositories and team members, with 1,000 pull request reviews and 1,000 automated formatting runs per month. AI Review and Autofix are pay-as-you-go. It is a generous starting point for public projects, but the monthly review and formatting caps can constrain heavier use, and unlimited public repositories does not mean unlimited review volume.
Team
Team costs $24 a year, billed yearly at $24 per user/month. It includes unlimited repositories and pull request reviews, a $100 annual AI Review credit per user, three open-source dependency scanning targets, and priority support. Additional targets cost $8/month each. This suits teams needing uncapped pull-request reviews and paid support, but per-user billing and the limited AI credit should be weighed against team size and expected AI usage.
Enterprise
Enterprise has custom pricing and includes Team features, Enterprise Cloud or self-hosted deployment, BYOK for AI Review, SSO, priority support with an SLA, a dedicated account manager, and migration assistance. Airgapped deployment is also an Enterprise capability. It is the appropriate tier for organizations that need these deployment or support options, rather than a lower-cost substitute for teams that do not.
A 14-day trial is available. The Open Source plan is free; the Team plan's stated annual billing term is important when comparing its per-user monthly rate.
Platforms
DeepSource supports API, Linux, macOS, self-hosted, web, and Windows. Its CLI binaries are documented for Linux amd64 and arm64, macOS amd64 and arm64, and Windows amd64. Self-hosted deployment is an Enterprise option, so platform support alone does not mean every plan can be deployed in-house.
Who it's for
DeepSource is best suited to software teams already working in GitHub, GitLab, Bitbucket, or Azure DevOps that want code review, security checks, fixes, and coverage controls together. Public projects can start without a subscription, while teams needing unlimited pull-request reviews, dependency scanning targets, and priority support have a clear Team upgrade path. Organizations requiring self-hosting, airgapping, or SLA-backed support should consider Enterprise. Teams that need only secrets detection may prefer a more focused tool.
Pros and cons
Broad review coverage: More than 5,000 deterministic rules and an AI review agent address bugs, anti-patterns, and security issues in pull requests.
Findings can come with fixes: Verified, pre-generated Autofix patches are available for many detected issues, though not all.
Security and coverage in the same workflow: Secrets, dependency, and infrastructure scanning sit alongside coverage tracking and threshold enforcement.
Free-tier caps matter: Open Source limits pull-request reviews and automated formatting runs to 1,000 each per month.
AI use can add cost: Open Source AI Review and Autofix are pay-as-you-go, and Team's AI Review credit is $100 annually per user.
Paid deployment flexibility is gated: Self-hosted and airgapped deployment are Enterprise capabilities with custom pricing.
Alternatives
GitGuardian is worth considering when secrets scanning is the priority; its free Starter tier supports up to 25 developers, unlimited real-time scanning, and up to 500 historical scan detections.
ggshield is an alternative when an open-source secrets-scanning CLI is the main requirement; its CLI is open source, while the detection library behind GitGuardian's public API is closed source.
Vooda AI is an alternative with a free self-hosted plan for production use, any company size, and no seat limits; it requires Docker.
Semgrep Code is an alternative when a free code and supply-chain plan capped at 10 repositories and 10 contributors is a better fit.
Amazon Deequ is a free, open-source library to consider for data-quality checks when Apache Spark is already part of the stack; its release must match the Spark version.
ByteHide Secrets offers a free plan capped at 2,000 secrets and is an alternative for a narrower secrets-management need.
Endor Labs offers a free Developer plan for individual developers, with local scans via its AURI MCP server and no account required; it has no UI, policies, or scan history.
Kingfisher is another free alternative.
For a secrets-first shortlist, see Secrets Scanning Software. Teams comparing code-analysis approaches can browse Static Analysis Tools or Code Quality Management Software; for AI-led review products, see AI Code Review Tools.
Verdict
Choose DeepSource if your team wants pull-request review, security scanning, fixes, and coverage controls under one roof, and can match its plan limits to expected usage. Its broad workflow and large deterministic rule library are the main reasons to choose it; the free tier's monthly caps, Team's per-user annual billing and finite AI credit, and Enterprise-only deployment options are reasons to look elsewhere or budget carefully.
Verdict
DeepSource combines pull-request review, security scanning, fixes, and coverage controls across supported code hosts. Review the free tier's monthly allowances and the annual billing terms for Team when choosing a plan.
Where Specifiction places it
- Static Analysis Tools#1 of 389.2
- Secrets Scanning Software#1 of 249.3
- Ruby Static Analysis Tools#1 of 219.3
- Dart Flutter Static Analysis Tools#1 of 209.1
- AI Code Review Tools#3 of 489.3
- IaC Security Scanners#1 of 169.3
- Code Quality Management Software#2 of 269.2
