Sourcery vs Spoon

Sourcery reviews pull requests with AI, returning a summary, review comments and suggested fixes within minutes. Users can apply a suggestion as a change and commit it to the pull request. Security checks cover committed secrets, static-analysis vulnerabilities, infrastructure-as-code misconfigurations, dependencies and licenses. The extension works in VS Code, Cursor, Windsurf and JetBrains editors, and Sourcery supports GitHub, GitLab, GitHub Enterprise Server and self-hosted GitLab. Open Source checks security on every pull request; Open Source and Pro also scan twice a week, while Team includes nightly scans. The public REST API, for listing, reading, counting and bulk-updating security findings and groups, is a Team feature. Open Source is free; Pro is $12 a month billed annually, or $15 per developer per month billed monthly. Team is $24 a month billed annually, or $30 per developer per month billed monthly. A 14-day Team-feature trial is available organization-wide after installation, without a credit card. Sourcery says it does not retain customer code after reviews or use it to train models.

Spoon is a free, open-source library for analyzing, rewriting, transforming, and transpiling Java source code. It parses source files into an abstract syntax tree (AST), then exposes APIs for inspecting and changing that model. Processors can perform source-level static analysis on selected AST element types, while architectural rules can be expressed as AST checks and run as JUnit tests in continuous integration. Transformation facilities cover instrumentation and refactoring, including helpers for local and generic variables and removing deprecated methods. Spoon can also provide shared analysis of binary and source code through CtClass objects as an alternative to Java reflection. The project supports Java source up to Java 25, but runtime requirements vary: Spoon 11.x needs JDK 17 or later, 10.x needs JDK 11 or later, and 9.x needs Java 8. It is available through Java, the command line, Maven, and Gradle, with a dependency JAR on Maven Central. Command-line use requires manual classpath handling and source dependencies specified with --source-classpath. Spoon is an official Inria project and an OW2 consortium member.