Ross ROSS = Recommend OSS · open-source software intelligence for agents

vercel-labs/deepsec

Deepsec is a security harness for finding vulnerabilities in your codebase powered by coding agents observed · 2026-08-28

github.com/vercel-labs/deepsec · homepage · TypeScript · Apache-2.0 (permissive) observed · 2026-08-28

Health v2 · maintenance only

58/100

  • Activity 99
  • Release rhythm 35
  • Longevity 8

Flags: no_releases young

How is this computed?

round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.

  • gap_med: n/a
  • age_days: 125
  • days_rel: n/a
  • days_push: 7
  • n_releases_24m: 0

Full methodology

Adoption not part of the score

7828 stars · 469 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Deepsec is an open-source, agent-powered vulnerability scanner that runs AI coding agents over your entire existing codebase to find hard-to-detect security issues. It is distributed as an npm CLI, runs in your own infrastructure with VM fanout for large repos, and supports resumable scans, cost caps, and CI gating.

Use cases

  • scan my whole repository for security vulnerabilities with AI
  • find hidden security bugs in a large legacy codebase
  • run an AI security review on all existing code, not just pull requests
  • self-host a vulnerability scanner using my own OpenAI or Anthropic API key
  • gate pull requests on AI security review in CI
  • audit a codebase for SQL injection, XSS, SSRF, and auth issues

When to choose

  • you want a deep, whole-repository security review rather than per-PR linting
  • you can tolerate high LLM costs (potentially thousands of dollars) in exchange for thorough findings
  • you need the scan to run in your own infrastructure with agent sandboxing
  • you want resumable, interruptible scans with cost and duration caps

When to avoid

  • you need fast, free, deterministic static analysis on every commit
  • your budget cannot absorb large LLM inference costs
  • you need compliance-certified or signature-based SAST tooling rather than AI-driven review
  • your codebase is small enough that a manual or lightweight scanner review suffices

Facets

cli-tool · maturity active

security vulnerability-scanning agent-framework cli developer-tools security developer-tools artificial-intelligence large-language-models cli cross-platform ai-security-review vulnerability-scanner code-review llm-agent self-hosted-security sast codebase-audit nodejs docker

10 sources

Member repositories

RepositoryRoleHealth v2
vercel-labs/deepsecmain58

For agents

markdown · JSON · MCP: product_card(name="vercel-labs/deepsec")

Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem