Analysis & detection

What is Autofix Suggestions?

Proposing a concrete code change that resolves a finding, usually as a one-click suggestion in the pull request.

A finding tells you something is wrong; an autofix tells you what to write instead. For mechanical issues, such as formatting, simple refactors, known-safe API swaps, dependency version bumps, this collapses remediation to a click.

Quality varies sharply by issue class. Deterministic transformations are reliable; model-generated fixes for logic or security issues need review, because a fix that silences the scanner without addressing the underlying flaw is worse than the original finding.

Top 20 Autofix Suggestions tools

Every tool in the directory documented as supporting Autofix Suggestions, with what its own documentation says.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

  1. 1
    CodacyQuality Platform

    One-click and batch fixes for ESLint, Opengrep, markdownlint; free IDE autofix for four languages.

  2. 2
    AikidoCode Security PlatformPro

    AutoFix suggests dependency, SAST, IaC and secret-rotation fixes; compatibility tested

  3. 3
    ChatGPT / CodexAgent Coding ToolPlus

    Findings carry remediation guidance; '@codex fix the P1 issue' starts a cloud chat with PR context.

  4. 4
    Checkmarx OneCode Security Platform

    AI Security Champion gives confidence score, explanation, and proposed remediation; KICS and IDE auto-remediation.

  5. 5
    Claude CodeAgent Coding Tool

    /code-review --fix edits the working tree; /claude-security drafts F<n>.patch files for manual git apply.

  6. 6
    CodeAnt AIPR Review

    Suggested fixes applied before merge, including fix-in-IDE direct application and auto-apply

  7. 7
    CodeRabbitPR ReviewPro

    One-click fixes for linter findings and committable code suggestions; autofix listed under Pro

  8. 8
    CodeSceneQuality Platform

    CodeScene ACE proposes AI refactorings in the IDE, validated by a secondary fact-checking AI

  9. 9
    CorgeaCode Security Platform

    AI generates and quality-checks a fix; auto-fix quota included from Free upward

  10. 10
    Cursor (Bugbot)PR ReviewPro

    Findings include fix suggestions plus Fix in Cursor, Fix in Web, or ask the in-PR agent.

  11. 11
    DeepSourceQuality Platform

    Autofix button generates fixes for all occurrences of an issue; metered by AI credits, usage-priced on Open Source.

  12. 12
    Gemini Code AssistAgent Coding ToolGating not documented (preview)

    Inline code suggestions in PR reviews that can be committed directly from GitHub.

  13. 13
    GitHub Advanced SecurityCode Security PlatformFree on public repos; add-on: Code Security for private

    Copilot Autofix generates code fix plus explanation for CodeQL alerts; no Copilot subscription required

  14. 14
    GreptilePR Review

    Most inline comments include an applicable code suggestion

  15. 15
    QltyQuality PlatformFree (CLI); AI Autofix per-workspace opt-in

    Single-line Autofixes as GitHub suggestions; opt-in AI Autofixes via OpenAI, and qlty check --fix locally

  16. 16
    QodoPR Review

    Committable suggestions when inline, single file and five lines or fewer

  17. 17
    SemgrepCode Security Platform

    Rule-defined deterministic fixes commit from the PR; AI remediation guidance and prose fixes need credits.

  18. 18
    SnykCode Security Platform

    Snyk Agent Fix returns up to five AI fix suggestions via `@snyk /fix`, applied with `@snyk /apply #`.

  19. 19
    SonarQubeQuality PlatformTeam

    AI CodeFix proposes LLM fixes for CRITICAL, HIGH, MEDIUM issues; Cloud Team/Enterprise, Server Enterprise/Data Center.

  20. 20
    VeracodeCode Security Platformadd-on

    Veracode Fix suggests up to five RAG-matched patches per flaw in CLI and IDE; Pipeline Scan findings only

What to look for

  • Which issue types have fixes, and whether they are deterministic or generated
  • Whether fixes apply as review suggestions you can accept inline
  • Bulk application across many findings at once
  • Whether the fix is re-scanned to confirm it resolved the issue

Related terms

SASTTaint / Data-Flow AnalysisSecrets DetectionSecrets ValidationSCA (Software Composition Analysis)Reachability Analysis

FAQ

What is Autofix Suggestions?

Proposing a concrete code change that resolves a finding, usually as a one-click suggestion in the pull request.

How many tools support Autofix Suggestions?

20 of the 20 tools tracked in this directory support Autofix Suggestions, including Codacy, Aikido, ChatGPT / Codex, Checkmarx One, Claude Code. Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

What should you look for in Autofix Suggestions?

Which issue types have fixes, and whether they are deterministic or generated. Whether fixes apply as review suggestions you can accept inline. Bulk application across many findings at once. Whether the fix is re-scanned to confirm it resolved the issue.