Verified project record

vercel-labs/deepsec

deepsec is an agent-powered vulnerability scanner that runs on your own infrastructure to surface hard-to-find security issues in large-scale codebases. It performs on-demand code review using regex matchers and AI investigation, fanning work across worker machines in parallel.

Project overview

It tackles the expensive, difficult problem of finding lurking vulnerabilities across sprawling monorepos by combining distributed execution with AI coding models, bringing agentic security analysis directly onto self-hosted infrastructure.

Project type: AI Agent · AI Coding
Use cases: Coding & Development
Deployment: Refer to project documentation
License: Apache-2.0

Best for

Developer and enterprise teams needing agent-powered vulnerability scanning on their own infrastructure for large-scale codebases.

Key capabilities

Performs on-demand review of code in large-scale repos using regex matchers and AI investigation.
Fans work out across worker machines or microVMs in parallel for large monorepos.
Picks up where it left off after an interruption, skipping already analyzed files.
Classifies vulnerabilities, checks git history for fixes, and exports findings to JSON or Markdown.

Limitations and risks

Scans can cost thousands or even tens-of-thousands of dollars for large codebases.
Standard subscriptions such as Claude Pro/Max and ChatGPT Plus generally do not have enough headroom for full repository scans.
There is a risk of prompt injection from external dependencies or vendored code because the tool treats inputs like a coding agent with full shell access.

Getting started

Setup requires pnpm/npm installation, configuration of external AI credentials, and a coding agent to bootstrap and configure project-specific files. The first success path is: run `npx deepsec init`, enter the `.deepsec` directory, run `pnpm install`, prompt a coding agent to set up the project, run `pnpm deepsec scan`, and run `pnpm deepsec export`.

Evidence and sources

README: `deepsec` an agent-powered vulnerability scanner that you can run in your own infrastructure, optimized to perform on-demand review of all code in existing large-scale repos.
README: It is configured to use the best models at maximum thinking levels (tunable via `--thinking-level`, see [docs/models.md](./docs/models.md)), meaning scans can cost thousands or ev…
README: Navigate to the root of the repository that you want to scan, then: ```bash npx deepsec init # creates .deepsec/ with this repo as the first project cd .deepsec pnpm install # ins…
README: Now have your coding agent bootstrap your installation. Open the agent of choice and prompt:
README: For real scans, use Vercel AI Gateway. One key covers both Claude and Codex, and the gateway's default quotas are sized for highly concurrent research.

Reviewed at: 2026-07-21T23:36:42Z