Coccinelle vs Sourcery

Coccinelle is a free program matching and transformation engine for working with C code. It uses SmPL to describe code patterns and the transformations to apply when matches are found. A single semantic patch can change code at many sites across hundreds of files while allowing for differences in spacing, variable names, irrelevant code, and coding style. The project describes uses including automating collateral changes after library API evolution and finding and fixing bugs in systems code. Coccinelle semantic patches and bug fixes have been integrated into the official Linux tree, and semantic patches are available in the Linux scripts directory for use with coccicheck. It supports C and C++, with C++ mode invoked using --c++; the project says its C++ support is still being extended, including for high performance computing. The download page lists version 1.3.3, dated September 2, 2026, with source code and precompiled spatch builds. It is available for Linux and macOS as desktop software. Source builds require OCaml, with Python and Menhir needed in specified cases.

Sourcery reviews pull requests with AI, returning a summary, review comments and suggested fixes within minutes. Users can apply a suggestion as a change and commit it to the pull request. Security checks cover committed secrets, static-analysis vulnerabilities, infrastructure-as-code misconfigurations, dependencies and licenses. The extension works in VS Code, Cursor, Windsurf and JetBrains editors, and Sourcery supports GitHub, GitLab, GitHub Enterprise Server and self-hosted GitLab. Open Source checks security on every pull request; Open Source and Pro also scan twice a week, while Team includes nightly scans. The public REST API, for listing, reading, counting and bulk-updating security findings and groups, is a Team feature. Open Source is free; Pro is $12 a month billed annually, or $15 per developer per month billed monthly. Team is $24 a month billed annually, or $30 per developer per month billed monthly. A 14-day Team-feature trial is available organization-wide after installation, without a credit card. Sourcery says it does not retain customer code after reviews or use it to train models.