jscodeshift vs Sourcery

jscodeshift is a free toolkit for developers who build and run codemods across JavaScript, TypeScript, or Flow projects. A codemod parses source into an abstract syntax tree, changes that tree, and generates source code. The runner applies a transform to each file and reports files that were not transformed. Its command line accepts a local transform, a URL, or paths from standard input. Parser choices include Babel, Babylon, Flow, TypeScript, and TSX, with Babel as the default. Users can set child-process limits, choose extensions, exclude paths with ignore patterns or configuration files, and preview changes in dry-run mode. The API supports traversal, filtering, finding, replacing, inserting, removing, and renaming syntax-tree nodes, with optional formatting during output. jscodeshift wraps recast to help preserve source style. Jest and Jasmine utilities support fixture or inline tests, and VS Code debugging guidance is documented. It runs on Linux, macOS, Windows, or self-hosted environments under an MIT license.

Sourcery reviews pull requests with AI, returning a summary, review comments and suggested fixes within minutes. Users can apply a suggestion as a change and commit it to the pull request. Security checks cover committed secrets, static-analysis vulnerabilities, infrastructure-as-code misconfigurations, dependencies and licenses. The extension works in VS Code, Cursor, Windsurf and JetBrains editors, and Sourcery supports GitHub, GitLab, GitHub Enterprise Server and self-hosted GitLab. Open Source checks security on every pull request; Open Source and Pro also scan twice a week, while Team includes nightly scans. The public REST API, for listing, reading, counting and bulk-updating security findings and groups, is a Team feature. Open Source is free; Pro is $12 a month billed annually, or $15 per developer per month billed monthly. Team is $24 a month billed annually, or $30 per developer per month billed monthly. A 14-day Team-feature trial is available organization-wide after installation, without a credit card. Sourcery says it does not retain customer code after reviews or use it to train models.