deepsec is an AI-agent-driven security scanner that performs on-demand, parallel vulnerability reviews of large-scale repositories. It uses regex matchers to find candidate sites quickly and then applies AI investigation to surface difficult-to-find issues.
Project overview
By combining fast regex-based candidate discovery with AI investigation across distributed microVMs, deepsec addresses hard-to-find security vulnerabilities that have been lurking in large-scale codebases.
Project type
AI Agent · AI Coding · Workflow · Evaluation & Observability
Use cases
Coding & Development
Deployment
Refer to project documentation
License
Apache-2.0
Best for
Developers and teams who need AI-agent-driven vulnerability reviews of large-scale repositories.
Key capabilities
Initiates a scan to find candidate sites with regex matchers, then processes them with AI investigation to emit findings and recommendations.
Reviews only files changed in a diff for PR review and CI gating.
Provides lightweight P0/P1/P2 classification using a cheaper model.
Re-checks existing findings and checks git history for fixes to reduce the false positive rate.
Fans out work across Vercel Sandbox microVMs for large monorepos.
Skips files already analyzed if a run is interrupted and picks up where it left off.
Generates cross-project metrics, markdown/JSON summaries, and per-finding exports.
Allows a coding agent to bootstrap installation and configure context by reading SKILL.md and SETUP.md.
Limitations and risks
Scans can cost thousands or even tens of thousands of dollars for large codebases. Paid AI provider services are required.
Subscriptions such as Claude Pro/Max or ChatGPT Plus generally do not have enough headroom for full repository scans.
Running locally with external dependencies or vendored code introduces a prompt injection risk.
Getting started
Navigate to the repository root, run npx deepsec init, cd into .deepsec and run pnpm install, prompt a coding agent to read SKILL.md and SETUP.md to configure INFO.md, then run pnpm deepsec scan and pnpm deepsec process. Setup requires API keys for AI providers.
Evidence and sources
README: deepsec is an agent-powered vulnerability scanner that you can run in your own infrastructure, optimized to perform on-demand review of all code in existing large-scale repos. dee…
README: Navigate to the root of the repository that you want to scan, then: ```bash npx deepsec init # creates .deepsec/ with this repo as the first project cd .deepsec pnpm install # ins…
README: ``` Now have your coding agent bootstrap your installation. Open the agent of choice and prompt: > Read `.deepsec/node_modules/deepsec/SKILL.md` to understand the > tool. Then rea…
README: When running locally, deepsec falls back to your existing claude / codex subscription if you've logged in on this machine. Subscriptions (Claude Pro/Max, ChatGPT Plus) are useful…
README: Large monorepos can fan work across [Vercel Sandbox](https://vercel.com/docs/vercel-sandbox) microVMs: ```bash pnpm deepsec sandbox process --project-id my-app --sandboxes 10 --co…