DeepSource
Static analysis and code security platform that reviews every commit and PR, with an AI review agent and Autofix remediation.
Deployment
Cloud · Self-Hosted · Air-Gapped
Languages
18+
Pricing model
Per developer seat, Usage-based credits, Per lines of code, Quote-based
Free plan
Yes
Partial means the documentation covers only part of a capability, a related capability, or a beta. The description next to it says what is covered.
Workflow coverage
Where in the development lifecycle DeepSource operates.
4 yes 2 partial 2 no
| Feature | Availability | Description |
|---|---|---|
| Real-Time IDE Feedback | No | API schema exposes IDE subscriptions (FREE/PRO/SPONSORED) and IDE device auth; no IDE extension guide documented. |
| AI Agent Guardrails | Yes | 30-tool MCP server plus JSON-output CLI and a packaged DeepSource Skill for terminal agents. |
| Local Analysis (Pre-Commit) | Partial | CLI queries results and uploads coverage; analysis runs on DeepSource infrastructure, no local pre-commit scan documented. |
| Inline PR Comments | Yes | Summary comment on every PR plus optional inline comments highlighting exact lines. |
| Quality Gates (Merge Blocking) | Yes | Quality Gates fail checks on category, severity, or metric thresholds; AI Review status can be a required check. |
| Full Repo Scan | Yes | Every commit to the default branch is analyzed; languages auto-detected on repository activation. |
| Scheduled Rescans | Partial | Newly published CVEs affecting existing dependencies trigger automatic notifications; no scheduled full rescan. |
| Runtime Monitoring | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
Security scanning
6 yes 2 partial 5 no
| Feature | Availability | Description |
|---|---|---|
| SAST | Yes | Bug risk, security, anti-pattern, performance, and typecheck issues across 18 core analyzers. |
| Taint Analysis (Data-Flow) | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Secrets Detection | Yes | Hybrid regex plus 'Narada' AI classifier; PR checks fail on detection. Team or Enterprise plan required. |
| Secrets Validation | Partial | AI classifier judges each match in context to exclude test values and placeholders; no live credential validation. |
| SCA | Yes | Full transitive tree checked against NVD and other advisories, but billed pay-as-you-go per active dependency target on all plans. |
| Reachability Analysis | Yes | Call-graph tracing to the vulnerable function; REACHABLE/UNREACHABLE/UNKNOWN with call-path visualization. |
| Malicious Package Detection | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| License Compliance | Yes | SPDX license identification, category rules and custom overrides across transitive dependencies; rides on SCA billing. |
| SBOM Generation | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| IaC Scanning | Yes | Dedicated Dockerfile, Terraform, and Ansible analyzers; community analyzers add CloudFormation and Kubernetes. |
| Container Scanning | Partial | Dockerfile analyzer flags root user, latest tags, missing health checks, exposed ports; no image or layer scanning. |
| CSPM | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| DAST | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
Code quality
6 yes 1 partial 2 no
| Feature | Availability | Description |
|---|---|---|
| Code Smell Detection | Yes | Anti-pattern category covers code smells, unused variables, dead code, and unnecessary complexity. |
| Complexity Metrics | Yes | Configurable cyclomatic complexity thresholds (low to critical) plus a Complexity Report Card dimension. |
| Duplication Detection | Yes | Duplication is measured and reported inside the Report Card 'Hygiene' dimension. |
| Dead Code Detection | Yes | Dead code and unused imports raised under the anti-pattern category and the Hygiene dimension. |
| Test Coverage Tracking | Yes | Line, branch, condition, and composite coverage tracked; untested lines raised as actionable issues. |
| Diff Coverage (New Code) | Yes | New-code metrics NLCV, NBCV, NCCV, NCPCV measure changeset coverage and gate merges on thresholds. |
| Architecture Governance | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Technical Debt Quantification | Partial | Code health score, Code Health Trend, and Issues Prevented reports; no time or cost debt quantification. |
| Behavioral Code Analysis | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
AI review & fixes
5 yes
| Feature | Availability | Description |
|---|---|---|
| AI Logic Bug Detection | Yes | AI Review agent runs on PRs with issues tagged AI vs STATIC; the bug classes it finds are not enumerated. |
| PR Summaries & Walkthroughs | Yes | Report Card carries AI-generated narrative feedback plus a pull-request summary comment. |
| Autofix Suggestions | Yes | Autofix button generates fixes for all occurrences of an issue; metered by AI credits, usage-priced on Open Source. |
| Autofix Pull Requests | Yes | Autofix opens a PR or commits onto an existing PR branch; vulnerability autofix opens PRs with a breakage score. |
| AI Triage (False-Positive Filtering) | Yes | Narada model filters false-positive secrets (Team+); AI Review has a dedicated false-positive reporting flow. |
Rules & repo support
1 yes 1 partial
| Feature | Availability | Description |
|---|---|---|
| Custom Rule Authoring | Partial | No custom rule authoring documented; third-party SARIF analyzers plug in via the Community Analyzer framework. |
| Monorepo Support | Yes | All tiers provide monorepo support alongside unlimited pull request reviews. |
AI capabilities
5 yes 1 partial 1 no
| Feature | Availability | Description |
|---|---|---|
| AI Code Review | Yes | AI Review agent runs hybrid with static analysis, governed by a team-level AI & Agents policy. |
| Bring Your Own Model | Yes | Enterprise Server v5.0.0+ BYOK routes inference through Vertex AI, Bedrock, Azure OpenAI, OpenAI, Google AI, or Anthropic. |
| MCP Server | Yes | mcp.deepsource.com with 30 tools, OAuth and PAT auth; optional admin toggle on Enterprise Server v5.1.0+. |
| AI Code Governance | No | No AI-generated-code inventory; AI and Agents policy plus autofix toggles govern AI tool use instead. |
| Conversational Review | Partial | AI Review can be invoked by mentioning @deepsourcebot in a PR comment; no conversational thread documented. |
| Learning From Feedback | Yes | Marking an AI Review issue a false positive opens a comment modal that feeds back into AI Review accuracy. |
| Code Excluded From Training | Yes | Privacy Policy: code not used to train AI models unless customer explicitly opts in via account settings |
Models used
Narada (DeepSource's own open-source secrets classification model)
Compliance & governance
3 yes 1 partial
| Feature | Availability | Description |
|---|---|---|
| Audit Logs | Yes | Audit logs listed in the Team plan; Enterprise Control Panel adds audit logging for enterprise admins. |
| SSO (SAML) | Yes | SAML SSO supported on DeepSource Enterprise Server only. |
| Role-Based Access Control | Partial | GraphQL API exposes access control and WRITE-access checks; Enterprise Control Panel adds global policy controls. No role matrix documented. |
| Compliance Reporting & Exports | Yes | Always-current OWASP/CWE-SANS/MISRA C reports shareable via optionally password-protected link; Team or Enterprise required. |
Standards mapping
OWASP Top 10CWE/SANS Top 25MISRA C
Integrations
8 yes 2 partial
| Git provider | Availability |
|---|---|
| GitHub | Yes |
| GitHub Enterprise Server | Partial |
| GitLab | Yes |
| GitLab Self-Managed | Yes |
| Bitbucket | Yes |
| Bitbucket Data Center | Yes |
| Azure DevOps | Yes |
| API & CLI | Availability |
|---|---|
| REST API | Partial |
| CLI | Yes |
| Webhooks | Yes |
CI/CD systems
GitHub Actions (with OIDC auth)GitLab CICircleCITravis CIHeroku CIAzure Pipelines
Issue trackers
Jira Cloud (Enterprise Server only, OAuth 2.0 app, ticket creation from issues)
Chat & notifications
Slack (Enterprise Server, via app manifest)Webhooks (organization accounts only)
Languages
Languages and frameworks named in DeepSource's documentation.
GoRustJavaScalaC#JavaScriptTypeScriptPHPPythonRubyCC++SwiftKotlinDockerShellSQLTerraformAnsible
Pricing & plans
$24/user/month billed yearly ($30/user/month if billed monthly)
Minimum seats: None documented — billed per user, pro-rated when users are added or removed mid-cycle
Trial: 14 days, no credit card required; up to $50 in bundled AI Review credits for new users
Open Source$0Open-source and public-repo projects
- PR reviews for public repos, stated as unlimited but capped at up to 1,000 monthly
- Static analysis for 18 languages
- Basic issue detection
- Code formatters, PR diffing, and Quality Gates
- Monorepo support
- AI Review charged at $8/10K LOC (Standard) or $15/10K LOC (Advanced) with no included credit
- OSS dependency scanning is pay-as-you-go
- No secrets detection
- No compliance reporting (OWASP, CWE/SANS, MISRA C)
- No advanced security features
Team$24/user/month billed yearly (monthly billing also available)Private-repo engineering teams
- Unlimited repositories and PR reviews
- All Open Source features
- $100 annual AI Review credit per user
- Secrets detection with the hybrid AI engine
- Compliance reporting (OWASP Top 10, CWE/SANS Top 25, MISRA C)
- API access, audit logs, priority support, advanced security features
- AI Review overage billed at $8/10K LOC (Standard) or $15/10K LOC (Advanced)
- OSS dependency scanning still pay-as-you-go per active target
- No self-hosted deployment, SAML SSO, SCIM, Enterprise Control Panel, or BYOK
- GitHub Enterprise Server, GitLab self-managed, and Bitbucket Data Center are documented only for Enterprise Server
EnterpriseCustom pricingOrganizations with compliance or security requirements needing operation inside their firewall
- All Team features
- Self-hosted DeepSource Enterprise Server, including air-gapped install
- SAML SSO and SCIM provisioning (Okta documented)
- Enterprise Control Panel with cross-team user management, license monitoring, global policy, audit logging
- Bring-Your-Own-Key AI routing
- Dedicated account manager and priority SLA support
- No published price
- Self-hosting requires Kubernetes plus a customer-managed PostgreSQL and backup strategy
- AI Review and SCA usage costs still apply
Who it's for
Best for teams that want code quality and dependency security with fixes attached, without changing their CI.
A good fit if
- You want reachability analysis to show whether a vulnerable dependency is actually called
- You want Autofix pull requests for both code issues and dependency upgrades
- You want to turn it on without YAML or CI changes
Consider alternatives if
- You need predictable costs, since AI review and dependency scanning are billed by usage
- Your code is on a self-hosted git platform and you don't want to run DeepSource Enterprise Server
Similar tools
Other Code Quality Platform tools in the directory.
CodacyCode quality and security platform aggregating third-party analyzers across 40+ languages, with SAST, SCA, secrets, coverage and a free IDE extension.CodeSceneBehavioral code analysis platform scoring Code Health, hotspots, knowledge distribution and delivery risk from version-control history.QltyGitHub-only static analysis, security scanning and code coverage platform, split between a free open-source CLI and hosted Qlty Cloud.SonarQubeCode quality and security analysis platform for 40+ languages, delivered as SonarQube Cloud SaaS or self-managed SonarQube Server.
FAQ
When should you choose DeepSource?
DeepSource is best for teams that want code quality and dependency security with fixes attached, without changing their CI. It's a good fit if:
- You want reachability analysis to show whether a vulnerable dependency is actually called
- You want Autofix pull requests for both code issues and dependency upgrades
- You want to turn it on without YAML or CI changes
Consider alternatives if:
- You need predictable costs, since AI review and dependency scanning are billed by usage
- Your code is on a self-hosted git platform and you don't want to run DeepSource Enterprise Server
What languages does DeepSource support?
DeepSource supports 18+ languages and frameworks, including Go, Rust, Java, Scala, C#, JavaScript, TypeScript, PHP, Python, Ruby, and 9 more.
What does DeepSource integrate with?
DeepSource integrates with:
- Source control: GitHub, GitHub Enterprise Server (partial), GitLab, GitLab Self-Managed, Bitbucket, Bitbucket Data Center and Azure DevOps
- CI systems: GitHub Actions, GitLab CI/CD, CircleCI, Travis CI, Heroku CI and 1 more
What tools are similar to DeepSource?
Other code quality platforms tracked here:
What are DeepSource's plans and pricing?
DeepSource has a free plan, and paid plans start at $24/user/mo. Enterprise pricing is by quote.
Opens deepsource.com in a new tab. Review Radar is not affiliated with DeepSource.