Skip to content
SPECIFICTION
Get listed

Sourcery

sourcery.ai

From $12/mo Free plan WebWindowsmacOSLinuxAPISelf-hosted
Visit sourcery.ai
Spec score 8.6 #3 of 22 in Code Refactoring Tools

What it is

Sourcery reviews pull requests with AI, returning a summary, review comments and suggested fixes within minutes. Users can apply a suggestion as a change and commit it to the pull request. Security checks cover committed secrets, static-analysis vulnerabilities, infrastructure-as-code misconfigurations, dependencies and licenses. The extension works in VS Code, Cursor, Windsurf and JetBrains editors, and Sourcery supports GitHub, GitLab, GitHub Enterprise Server and self-hosted GitLab. Open Source checks security on every pull request; Open Source and Pro also scan twice a week, while Team includes nightly scans. The public REST API, for listing, reading, counting and bulk-updating security findings and groups, is a Team feature. Open Source is free; Pro is $12 a month billed annually, or $15 per developer per month billed monthly. Team is $24 a month billed annually, or $30 per developer per month billed monthly. A 14-day Team-feature trial is available organization-wide after installation, without a credit card. Sourcery says it does not retain customer code after reviews or use it to train models.

Spec sheet

What it does
Sourcery automatically reviews pull requests and posts summaries, review comments, and suggested fixes.Read 15 Oct 2026 · sourcery.ai
Deployment
cloud, self hosted, desktopRead 22 Sep 2026 · sourcery.ai
Trial
Installing Sourcery gives the whole organization 14 days of Team features without requiring a credit card.Read 28 Sep 2026 · sourcery.ai
Integrations
GitHub, GitLab, GitHub Enterprise Server, self-hosted GitLab, VS Code, Cursor, Windsurf, JetBrains, JiraRead 22 Sep 2026 · sourcery.ai
Compliance
The company states that Sourcery is SOC 2 Type II compliant.Read 15 Oct 2026 · sourcery.ai
Support
Support is offered through in-app chat and email, with documentation covering setup, reviews, scanning, IDEs, administration, API, and compliance.Read 15 Oct 2026 · docs.sourcery.ai
API availability
The public REST API is a Team-plan API for listing, reading, counting, and bulk-updating security findings and groups.Read 28 Sep 2026 · docs.sourcery.ai
API scope
The only public API is a Team-plan REST API for listing, reading, counting, and bulk-updating security findings; the GraphQL endpoint is internal.Read 15 Oct 2026 · docs.sourcery.ai
Auto approval
Low-risk pull requests with no blocking findings can be automatically approved.Read 15 Oct 2026 · sourcery.ai
Billing model
Paid seats are assigned to specific developers, and organizations can cancel or downgrade while retaining features through the paid period.Read 15 Oct 2026 · sourcery.ai
Bring-your-own LLM
Enterprise customers can use their own LLM keys, including controlled Anthropic or Azure OpenAI deployments.Read 15 Oct 2026 · docs.sourcery.ai
Bug detection
Its reviews look for logic errors, missed edge cases, and security problems and explain remediation.Read 15 Oct 2026 · sourcery.ai
Code retention
Sourcery says it keeps no copy of code after a review and does not use code to train models.Read 15 Oct 2026 · sourcery.ai
Code review actions
Suggested fixes can be applied as changes that users commit directly to a pull request.Read 28 Sep 2026 · sourcery.ai
Company size fit
solo, small, mid market, enterpriseRead 22 Sep 2026 · sourcery.ai
Custom rules
Users can define project-wide review rules in a .sourcery.yaml file and use public rulesets such as the Google Python Style Guide.Read 15 Oct 2026 · marketplace.visualstudio.com
Data retention
Sourcery says it does not retain customer code after a review and does not use code to train models.Read 28 Sep 2026 · docs.sourcery.ai
Deployment choices
Team supports bring-your-own LLM, and self-hosted Sourcery is available through sales.Read 28 Sep 2026 · docs.sourcery.ai
Extension capabilities
The VS Code extension provides AI chat, on-demand reviews, GitHub and GitLab reviews, refactoring suggestions, and continuous quality feedback.Read 15 Oct 2026 · marketplace.visualstudio.com
Extension license
The VS Code listing says the source code is MIT-licensed but packaged binaries are not covered by that license.Read 15 Oct 2026 · marketplace.visualstudio.com
Extension recipes
The extension can generate Mermaid diagrams, unit tests, docstrings, and code explanations.Read 15 Oct 2026 · marketplace.visualstudio.com
Founders
Runa Capital identifies Brendan Maginnis, Nicholas Thapen, and Timothy Gilboy as founders.Read 15 Oct 2026 · runacap.com
Funding
Runa Capital reports a $120,000 Techstars-led pre-seed round in 2021 and a $1.75 million Forward Partners-led seed round in 2022.Read 15 Oct 2026 · runacap.com
Git hosting
Sourcery runs on GitHub, GitLab, GitHub Enterprise Server, and self-hosted GitLab.Read 28 Sep 2026 · docs.sourcery.ai
Headquarters and size
LinkedIn lists London, England headquarters and a company size of 2–10 employees.Read 15 Oct 2026 · linkedin.com
IDE support
Documentation names VS Code, Cursor, Windsurf, and JetBrains IDEs for in-editor reviews and suggestions.Read 15 Oct 2026 · docs.sourcery.ai
Jira integration
Jira is included as an integration in the Pro plan.Read 15 Oct 2026 · sourcery.ai
Language coverage
Sourcery says it reviews any programming or markup language recognized by GitHub, while skipping lockfiles and generated files.Read 15 Oct 2026 · docs.sourcery.ai
Legal entity
Companies House lists the maker as SOURCERY.AI LIMITED, an active private limited company incorporated on 19 January 2018.Read 15 Oct 2026 · find-and-update.company-information.service.gov.uk
Limit: cross-file analysis
The DEV review said file-by-file analysis can miss architectural issues spanning multiple modules.Read 15 Oct 2026 · dev.to
Limit: forge coverage
The DEV review identified no Bitbucket or Azure DevOps support, limiting the product to GitHub and GitLab integrations.Read 15 Oct 2026 · dev.to
Limit: narrow scope
A G2 reviewer said the product was too simple and lacked reporter information and additional media sources.Read 15 Oct 2026 · g2.com
Limit: performance and filters
G2 reviewers reported slow query loading, removed sorting options, inaccurate dofollow or nofollow labels, and difficulty pitching from the platform.Read 15 Oct 2026 · g2.com
Limit: review noise
The same DEV review reported that roughly half of review comments were actionable, with some being nitpicky or noise.Read 15 Oct 2026 · dev.to
Notable news
Runa Capital dates the announcement of Sourcery’s $1.75 million seed round to 14 January 2022.Read 15 Oct 2026 · runacap.com
Praise: ease of use
G2 reviewers praised Sourcery’s simple interface, email-like workflow, filtering, and time savings for finding relevant requests.Read 15 Oct 2026 · g2.com
Praise: Python refactoring
An independent DEV review described the Pro plan’s refactoring suggestions as useful for readability and idiomatic Python patterns.Read 15 Oct 2026 · dev.to
Product purpose
Sourcery provides automated AI code reviews designed for security and speed.Read 28 Sep 2026 · sourcery.ai
Pull request reviews
It reviews every pull request within minutes and posts a summary, review comments, and suggested fixes.Read 28 Sep 2026 · sourcery.ai
Pull-request hosts
Sourcery runs on GitHub, GitLab, GitHub Enterprise Server, and self-hosted GitLab.Read 15 Oct 2026 · docs.sourcery.ai
Rating on G2
3.5 out of 5 from 5 reviewsRead 15 Oct 2026 · g2.com
Rating on GetApp
4.8 out of 5 from 16 reviewsRead 15 Oct 2026 · getapp.com
Review limits
Reviews use a diff-character cap and rolling seven-day budget, and automatic re-reviews stop after five per pull request.Read 15 Oct 2026 · docs.sourcery.ai
Scan cadence
Team includes nightly scans, while Open Source and Pro scan twice a week.Read 28 Sep 2026 · sourcery.ai
Scanner coverage
The documentation lists secrets, SAST, infrastructure-as-code, dependencies, and license scanning.Read 15 Oct 2026 · docs.sourcery.ai
Security scanning
Scheduled scans cover exposed secrets, vulnerable code, infrastructure misconfiguration, and dependencies with known CVEs.Read 15 Oct 2026 · sourcery.ai
Self-hosting
Enterprise can run Sourcery inside the customer’s own infrastructure.Read 15 Oct 2026 · sourcery.ai
Suggested fixes
Suggested changes can be committed directly to a pull request.Read 15 Oct 2026 · sourcery.ai
Support channels
email, docsRead 22 Sep 2026 · sourcery.ai
Support contact
Sourcery lists [email protected] as its contact email.Read 28 Sep 2026 · sourcery.ai

Plans and prices

Open Source Free forever Public repositories on GitHub or GitLab · AI reviews · PR summaries and diagrams · One-click fixes · Custom review rules · Auto-approve · Security checks on every PR Read 15 Oct 2026 · sourcery.ai
Pro $12 a month annually ($15 billed monthly) Private repositories · Higher review limits · Jira integration Read 15 Oct 2026 · sourcery.ai
Team $24 a month annually ($30 billed monthly) Everything in Pro · Nightly scans of 50 repositories · Issues dashboard · On-demand scans · Team analytics Read 15 Oct 2026 · sourcery.ai
Enterprise Priced on request annually Self-hosting · GitHub Enterprise Server · SSO · Bring your own LLM keys · Dedicated success manager · Invoice billing Read 15 Oct 2026 · sourcery.ai

Every Sourcery plan and price →

Strong points and limits

Strong points

  • Reviews pull requests within minutes.
  • Suggested fixes can be committed to pull requests.
  • Security checks cover secrets, vulnerabilities, dependencies and licenses.
  • Works with four listed Git hosts.
  • No customer code retained after a review, says Sourcery.

Limits

  • Open Source covers public repositories.
  • Open Source and Pro scan twice a week.
  • Pro costs $12 a month billed annually.
  • Self-hosted Sourcery is available through sales.

Who it suits

Sourcery suits individuals and organizations looking to automate pull request reviews and security checks across supported Git hosts. Teams needing nightly scans, Jira integration or the public REST API should note those are Team or Pro plan features.

Sourcery in depth

Read the full write-up

Overview

Sourcery is an AI code-review service that adds security checks to pull requests and supports several code hosts and editors. It suits developers and teams that want proposed fixes alongside review comments; it is less compelling if nightly scans or broader security-management features are essential but Team pricing is beyond reach.

Its strongest draw is combining pull-request review with checks for secrets, vulnerabilities, infrastructure configuration, dependencies, and licenses. The main compromise is that scan cadence and team-level tools vary substantially by plan.

Key features

Sourcery reviews pull requests within minutes, adding a summary, comments, and suggested fixes. A developer can apply a suggested fix as a change to the pull request and commit it, keeping straightforward corrections within the existing review flow. Open Source also includes custom review rules and automatic approval for low-risk pull requests.

Security scanning covers committed secrets, static-analysis vulnerabilities, infrastructure-as-code misconfigurations, dependencies, and licenses. Every plan checks pull requests, but scheduled scans run twice a week on Open Source and Pro, compared with nightly scans on Team. Team also adds on-demand scans, a full issues dashboard, and team analytics, making it the stronger fit for teams that need visibility between pull requests.

The extension supports VS Code, Cursor, Windsurf, and JetBrains. Git hosting works with GitHub, GitLab, GitHub Enterprise Server, and self-hosted GitLab. Jira integration is part of Pro, while Team provides a public REST API for listing, reading, counting, and bulk-updating security findings and groups.

Sourcery says it does not retain customer code after a review and does not use code to train models. Team supports bring-your-own LLM; self-hosted Sourcery is available through sales.

Pricing

Open Source is free, billed forever. It supports public repositories and includes AI reviews, PR summaries and diagrams, one-click fixes, custom review rules, low-risk auto-approval, and security checks on every PR. It is a useful starting point for public projects, but it does not include private repositories, higher review limits, or nightly scans; scheduled scans run twice a week.

Pro is $12 a month, billed annually, or $15 / developer / month billed monthly. It adds private repositories, higher review limits, and Jira integration. Its twice-weekly scheduled scans make it a better fit for developers or small teams that need private-repository reviews but can do without nightly scanning and team analytics.

Team is $24 a month, billed annually, or $30 / developer / month billed monthly. It includes everything in Pro, nightly scans of 50 repos, a full issues dashboard, on-demand scans, higher review limits, and team analytics. Those tools make the higher tier more suitable for teams managing security findings across repositories; the stated nightly-scan allowance is 50 repos.

Enterprise has custom pricing and is billed annually. It includes self-hosting, GitHub Enterprise Server, SSO, bring-your-own LLM keys, a dedicated success manager, and invoice billing. This is the relevant tier for organizations that need those deployment and administration options.

Installing Sourcery gives the whole organization 14 days of Team features without a credit card. Paid plans are offered with annual billing or the stated monthly per-developer rates.

Platforms

Sourcery is offered as an API, extension, self-hosted deployment, and web product. Deployment options include cloud, self-hosted, and desktop. Its editor extensions cover VS Code, Cursor, Windsurf, and JetBrains; supported hosts include GitHub, GitLab, GitHub Enterprise Server, and self-hosted GitLab. Support channels are email and documentation, and the product has SOC 2 compliance.

Who it's for

Sourcery spans solo developers through enterprise teams, with the right plan depending on repository privacy and how much ongoing security oversight is needed. Public-repository contributors can start free; private-repository users need Pro or above. Teams that want nightly checks, an issues dashboard, on-demand scans, or analytics need Team. Organizations seeking self-hosting, SSO, or GitHub Enterprise Server should consider Enterprise.

Pros and cons

Combined review and security checks: pull-request feedback and scans for secrets, vulnerabilities, configuration, dependencies, and licenses live in one workflow.

Fixes can stay in the PR: suggested changes can be applied and committed directly, while custom rules and low-risk auto-approval are available even on the free plan.

Broad host and editor coverage: it supports four Git-hosting options and extensions for four editor families.

Free tier is public-repository only: private repositories require a paid plan, and scheduled scans on the free tier run twice weekly rather than nightly.

Team features cost more: nightly and on-demand scanning, analytics, and the issues dashboard require Team rather than Pro.

Alternatives

For a wider shortlist, see Code Refactoring Tools, AI Code Review Tools, and Code review software.

Choose ReSharper instead if you want C# support in VS Code and compatible editors, including a free non-commercial plan. ast-grep is a free alternative. CodeRush is another alternative. Moderne is an alternative with a fully managed service priced on request. OpenRewrite offers a free core framework and Apache-licensed recipes that run one repository at a time. Roslynator is a free alternative. CodART is MIT-licensed, though SciTools Understand requires a separate professional license. jSparrow is an open-source alternative that requires no license from version 4.20.0.

Verdict

Choose Sourcery if you want AI pull-request reviews and multi-area security checks in the same workflow, with editor and Git-host support broad enough for varied teams. Its free plan makes public projects an easy entry point, but private repositories start at Pro and the most useful ongoing security-management features sit in Team. Look elsewhere if nightly scans and team oversight are priorities but Team’s price or 50-repository scan allowance does not fit.

Verdict

Sourcery combines automated pull request feedback with security scanning, IDE extensions and support for several Git hosts. Check scan cadence and plan features against your needs: Jira is listed for Pro, while nightly scans and the public REST API are Team features.

Where Specifiction places it

Alternatives to SourceryAll alternatives →