The gist

deepsec is an open-source, agent-powered vulnerability scanner from Vercel Labs. It is designed to run in your own infrastructure for on-demand security reviews of large-scale code repositories. The tool focuses on surfacing hard-to-find issues that may have gone unnoticed for a long time by using powerful AI models for deep analysis.

What it does

Scans large codebases for security vulnerabilities using AI agents.
Initializes a project with a guided setup to select AI models and credentials.
Resumes interrupted scans automatically, skipping already analyzed files.
Distributes analysis work across multiple machines for parallel processing.
Exports findings into readable reports, including Markdown directories or JSON files.
Re-validates existing findings against git history to reduce the false-positive rate.

How it works

deepsec is a self-hosted command-line tool that you run from the root of your code repository. After an init command, it studies the codebase and uses AI models (via OpenAI, Anthropic, or Vercel AI Gateway) to perform a deep security review. The tool is open-source, but AI usage for large scans can be costly. It outputs security findings into a local .deepsec/ directory.

Best for

This tool is ideal for security teams and developers needing to perform a deep, comprehensive security audit on a large, existing codebase.

Watch out for

Be aware of the potential cost. The documentation explicitly states that scans for large codebases can cost thousands or even tens of thousands of dollars in AI model usage fees.