Deepsec is an agent-powered vulnerability scanner that runs in your own infrastructure to find security issues in codebases.
The tool addresses the problem of hard-to-find vulnerabilities that persist undetected in large applications by deploying AI agents configured to use advanced models at maximum reasoning levels to perform deep code review. It scans entire repositories on demand, with work distributed across parallel worker machines for large codebases. If a scan is interrupted, rerunning the command resumes from where it left off, skipping already-analyzed files. The scanner stores all state and findings in a `.deepsec/` folder within your repository.
Deepsec suits teams willing to invest in thorough security audits of existing large-scale codebases where the cost of deep AI analysis is justified by the value of catching long-standing vulnerabilities. The tool is designed for on-demand comprehensive review rather than continuous scanning. You can supply your own OpenAI or Anthropic API credentials or use Vercel AI Gateway for payment, and you can set spending limits or time constraints on scans. The command-line interface guides you through model selection with benchmark scores and pricing information, then runs unattended to completion. After scanning, it generates a readable report of findings.
The project maintains comprehensive documentation covering setup, CI integration, supported technologies, custom matcher authoring, configuration options, plugins, model selection, and architecture details. Development activity shows consistent attention to user experience through detailed guides and error messages that expose machine-readable paths for integration with coding agents. The tool includes sample configurations and a contributing guide for community involvement.
