How much does DeepSource cost?

The Open Source plan is free for public repositories. Team is $30 a user a month or $24 a user a month billed yearly, with $10 of monthly AI credit per user, three dependency scanning targets and $8 to $10 a month per extra target. AI review is metered at $8 per 10,000 processed lines for Standard and $15 for Advanced, from pooled credits that roll over. Enterprise is custom and can be bought through Google Cloud Marketplace. A 14 day trial includes up to $50 of AI review credit.

Does DeepSource support MCP and tool calling?

Full under the Agentic Index verification standard. DeepSource publishes public evidence of Model Context Protocol (MCP) support, tool calling, and API or SDK extensibility for connecting agents to external tools. Evidence basis: A GraphQL API with personal access tokens, limited to 5,000 requests an hour, reads and changes repositories, analyzer and metric settings, thresholds and issue suppressions, and webhooks signed with an HMAC header report analysis runs, Aut. Graded from public evidence only against the Agentic Index 14 point capability taxonomy. No vendor pays for placement.

Does DeepSource have SOC 2, SSO and role based access control?

Full under the Agentic Index verification standard. DeepSource publishes public evidence of enterprise security and identity controls, covering a compliance posture such as SOC 2 or ISO 27001, single sign on (SSO or SAML), and role based access control (RBAC). Evidence basis: Enterprise accounts sign in through SAML 2.0 with Okta, OneLogin, Azure AD or Google Workspace, with SCIM provisioning and several identity providers at once, and roles run at team and repository level with granular base permissions. Audit. Graded from public evidence only against the Agentic Index 14 point capability taxonomy. No vendor pays for placement.

Can DeepSource be self hosted or run in a private VPC?

Full under the Agentic Index verification standard. DeepSource publishes public evidence of self hosted or private VPC deployment, along with data residency options for controlling where agent data is processed and stored. Evidence basis: Beyond DeepSource Cloud and Enterprise Cloud, Enterprise Server installs on Kubernetes inside the customer's firewall, in a private cloud on AWS, Google Cloud or Azure, or in a data center, and an air gapped installation path exists for net. Graded from public evidence only against the Agentic Index 14 point capability taxonomy. No vendor pays for placement.

Back to vendors

DeepSource

Also known as: DeepSource Autofix, DeepSource AI Code Review, DeepSource Corp

Visit site

Coding agentacquiredVerified 2026-11-08

Entry priceFree Open Source plan for public repositories, or Team at $30 a user a month, $24 billed yearly, plus metered AI review.Full pricing detail

DeepSource is an AI code review platform that Harness acquired in September 2026 and still sells under its own name. It reviews every pull request on GitHub, GitLab, Bitbucket and Azure DevOps with an AI agent working beside more than 5,000 static analysis rules, writes fixes it commits once a developer accepts them, and adds secrets detection, dependency scanning with reachability, coverage and quality gates. Team costs $24 a user a month billed yearly, plus metered AI review.

DeepSource is built by DeepSource Corp., a Delaware company in San Francisco founded by Sanket Saurav and Jai Pradeesh and backed by Y Combinator and 645 Ventures. Harness announced in September 2026 that it had acquired DeepSource, and DeepSource says existing workspaces, integrations and support continue unchanged, that new customers can still sign up for the self serve cloud product, and that its capabilities will join the Harness platform over time, with enterprise deals now handled within the Harness ecosystem. DeepSource reports more than 7,500 teams on the platform, with NASA, Ancestry and Babbel among its named customers.

On every pull request in GitHub, GitLab, Bitbucket or Azure DevOps, cloud or server, DeepSource runs a static pass across more than 5,000 rules for over 30 languages, sends a subagent to filter false positives, then runs an AI review agent that reads the code with search and graph tools while a taint analysis subagent follows insecure data. It comments inline and posts a Report Card grading security, reliability, complexity, hygiene and coverage.

Autofix writes a fix that the developer reviews before DeepSource commits it to the pull request branch or opens a new pull request, never touching the default branch. Quality gates fail runs that miss coverage or issue thresholds, secrets checks fail pull requests across more than 165 providers, and dependency scanning weighs reachability, CVSS and EPSS, with reports for the OWASP Top 10, CWE Top 25 and MISRA C.

The Open Source plan is free for public repositories, and Team costs $30 a user a month or $24 billed yearly, with $10 of monthly AI credit per user, audit logs, the API, webhooks, Slack and Jira. AI review is metered at $8 per 10,000 processed lines for Standard and $15 for Advanced, and a 14 day trial includes up to $50 of AI review credit.

Enterprise adds SAML single sign on with SCIM, IP restrictions, a self hosted server on Kubernetes that can run air gapped, and bring your own keys for Anthropic, OpenAI or Google models. DeepSource states SOC 2 Type II compliance, purges source code once each analysis finishes and does not train on customer code without an opt in. A GraphQL API, signed webhooks, an open source CLI and an MCP server with 30 tools let other agents read its findings.

It fits engineering teams that want AI review and deterministic static analysis in one pull request check, security minded teams that want secrets, dependency and code scanning beside review, and regulated buyers who need a self hosted or air gapped deployment. It fits less well for buyers wary of a product being folded into Harness over time, teams that want reviews to learn their preferences from feedback, or those who want to choose the model behind the cloud reviewer.

Vendor details

Canonical URL

https://deepsource.com

Subcategory

AI code review platform pairing an AI review agent with 5,000+ static analysis rules, Autofix, secrets and dependency scanning, and quality gates

Funding status

Acquired by Harness, announced in September 2026 with terms undisclosed; earlier a $2.6 million seed round led by 645 Ventures with Y Combinator, FundersClub, Pioneer Fund and Liquid2 Ventures.

Company status

acquired

Use cases & customers

Primary use cases

AI code review on every pull requeststatic analysis with quality and coverage gatesaccepted fixes committed to pull request branchessecrets detection and dependency vulnerability scanningsecurity and compliance reporting such as the OWASP Top 10

Target customers

engineering teams on GitHub, GitLab, Bitbucket or Azure DevOpssecurity minded teams that want code, secrets and dependency scanning in reviewregulated enterprises that need self hosted or air gapped deploymentopen source maintainers on public repositories

Deployment options

DeepSource CloudEnterprise CloudEnterprise Server self hosted on Kubernetes in a private cloud or data centerAir gapped installation on Enterprise

Integrations

GitHub, GitLab, Bitbucket and Azure DevOps, cloud and server editions, for inline comments, checks, Autofix commits and pull requests; Jira issue creation and linked GitHub or GitLab tickets; Slack notifications; Vanta for SAST and dependency data; SAML single sign on with Okta, OneLogin, Azure AD and Google Workspace plus SCIM; and a GraphQL API, signed webhooks, an open source CLI and a hosted MCP server for coding agents.

In practice

A platform team turns on DeepSource for 200 repositories on GitHub. Each pull request gets inline comments from the static pass and the AI review agent, a Report Card with a letter grade, and a required check that blocks merging when coverage drops below the team's threshold.

A developer opens an issue DeepSource flagged in a pull request, starts Autofix, reviews the proposed change and commits it to the pull request branch, while a teammate files a Jira issue for a dependency vulnerability that DeepSource marked as reachable.

A bank installs DeepSource Enterprise Server on its own Kubernetes cluster in an air gapped data center, runs AI review on Anthropic models through its own Amazon Bedrock account, and exports OWASP Top 10 and CWE Top 25 reports for its auditors.

Sources & related URLs

Related / legacy domains

https://docs.deepsource.com https://deepsource.com/pricing https://deepsource.com/blog/deepsource-joins-harness https://docs.deepsource.com/docs/developers/mcp/tools

Research sources

Agentic Index coverage score

12.0 / 14 capabilities · 86%

Integrations & Tool Calling	Full
Across GitHub, GitLab, Bitbucket and Azure DevOps, in both cloud and server editions, DeepSource posts inline comments and commit checks, commits accepted Autofix changes to a pull request branch or opens a new pull request, and adds formatter commits. From any issue a user can create a Jira Cloud issue or a linked GitHub or GitLab ticket, Slack receives notices of new and resolved issues and Autofix runs, and SAST and dependency findings flow to Vanta. Sourcedocs.deepsource.com/docs/platform/integrations/jiraread 2026-11-08
Workflow Orchestration	Full
Each review runs in stages: a static pass over a syntax tree built for the pull request and a whole project graph, a subagent that filters false positives for the context, then an AI review agent with code search and graph lookup tools, alongside a taint analysis subagent that tracks insecure data through the code. The Advanced tier adds multiple passes with extended reasoning for harder changes. Sourcedeepsource.com/llms.txtread 2026-11-08
Knowledge Grounding & RAG	Partial
Context comes from a syntax tree built for each pull request and a whole project graph, with no full repository index built ahead of time. Teams steer it with a configuration file or dashboard settings, glob patterns that mark test and excluded files, analyzer specific options and community analyzers fed through CI as SARIF. Custom checkers live in Globstar, a separate open source toolkit, and no documentation, wiki or past pull request knowledge feeds the AI review agent. Sourcedocs.deepsource.com/docs/platform/dashboard/repository/settingsread 2026-11-08
Human Oversight & Guardrails	Full
Autofix changes no code until a developer reviews the proposed changes in its session and chooses to commit them to the pull request branch or open a new pull request, and it never writes to the default branch. Teams can require the AI review status as a merge check through branch protection everywhere except Bitbucket Cloud, switch all AI and agent features off with one toggle, and limit who may ignore issues, change thresholds or suppress failing metrics. Sourcedocs.deepsource.com/docs/platform/getting-started/fix-issuesread 2026-11-08
Security, Identity & Governance	Full
Enterprise accounts sign in through SAML 2.0 with Okta, OneLogin, Azure AD or Google Workspace, with SCIM provisioning and several identity providers at once, and roles run at team and repository level with granular base permissions. Audit logs are searchable and exportable on Team and Enterprise, and Enterprise adds IP allowlisting. DeepSource states SOC 2 Type II and GDPR compliance, purges source code when each analysis finishes and does not train on customer code unless a customer opts in. Sourcedocs.deepsource.com/docs/platform/integrations/ssoread 2026-11-08
Observability & Auditability	Full
Team and repository dashboards track code health, coverage, issues prevented and issues fixed by Autofix, with reports for the OWASP Top 10, CWE and SANS Top 25 and MISRA C that can be shared through password protected links. A usage page shows AI review spend and lines analyzed, each pull request carries a Report Card that can be copied as Markdown, and audit logs and software bills of materials export in SPDX, CSV or JSON. Sourcedocs.deepsource.com/docs/platform/dashboard/team/reportsread 2026-11-08
Memory & State Persistence	Partial
Ignore rules persist at the level of one occurrence, a file, a pattern, test files or a whole repository, and admins can suppress issues across a team through the API, so dismissed findings stay dismissed. Reporting a false positive on an AI review comment feeds DeepSource's own accuracy work rather than a store the agent reads for that team, and no learned preferences or organization facts carry from one review to the next. Sourcedocs.deepsource.com/docs/platform/dashboard/repository/historyread 2026-11-08
Deployment & Data Residency	Full
Beyond DeepSource Cloud and Enterprise Cloud, Enterprise Server installs on Kubernetes inside the customer's firewall, in a private cloud on AWS, Google Cloud or Azure, or in a data center, and an air gapped installation path exists for networks with no outside access. The server edition works with GitHub Enterprise Server, GitLab Enterprise Edition, Bitbucket Data Center and Azure DevOps Server, so code can stay on hosts the customer runs. No cloud regions or residency choices are named for the hosted service. Sourcedocs.deepsource.com/docs/self-hosted/installation/airgapread 2026-11-08
Prebuilt Agents / Templates / Packs	Full
More than 5,000 built in rules ship across analyzers for over 30 languages and infrastructure formats, from Python, Java, Go and C# to Terraform, Docker and Ansible, plus community analyzers such as KubeLinter and Slither and 19 code formatters that teams switch on per repository. Risk weighting presets and SPDX license policy rules come ready to apply, and the analyzer directory lists each analyzer with its rules so teams can choose what runs. Sourcedeepsource.com/directoryread 2026-11-08
Triggers & Channel Coverage	Full
Analysis starts on every commit and pull request in an activated repository, or for AI review only when someone mentions the DeepSource bot, and pushing a commit or rerunning the check starts it again. Newly published vulnerabilities trigger a fresh dependency analysis on their own, users start Autofix from the dashboard, the CLI pushes coverage reports from CI, and outbound webhooks announce runs, Autofix sessions and issues to other systems. No scheduled code scans exist. Sourcedocs.deepsource.com/docs/platform/dashboard/team/policiesread 2026-11-08
Model Flexibility & Routing	Full
Self hosted Enterprise Server, from version 5, runs AI review on the customer's own keys for Anthropic Claude through Amazon Bedrock or the direct API, OpenAI GPT Codex through Azure OpenAI or the direct API, or Google Gemini through Vertex AI or the direct API, with a smaller second model for descriptions and summaries. In the cloud, DeepSource picks the models and names none, and customers choose only between the Standard and Advanced review tiers. Sourcedeepsource.com/blog/byokread 2026-11-08
APIs / SDKs / MCP Extensibility	Full
A GraphQL API with personal access tokens, limited to 5,000 requests an hour, reads and changes repositories, analyzer and metric settings, thresholds and issue suppressions, and webhooks signed with an HMAC header report analysis runs, Autofix runs, issues and team changes. The CLI is open source, and a hosted MCP server over streamable HTTP takes OAuth or a token and offers 30 named tools, from run reports and issue search to creating and deleting ignore rules. Sourcedocs.deepsource.com/docs/developers/mcp/toolsread 2026-11-08
Testing, Debugging & Optimization	Full
Coverage reports measure line, branch and composite coverage against thresholds that fail an analysis run when missed, and quality gates set by issue category, severity and metric do the same. Secrets detection covers more than 165 providers and fails a pull request on a find, dependency scanning ranks vulnerabilities by reachability, CVSS and EPSS, and DeepSource reports an F1 score of 84.51 percent on the OpenSSF CVE Benchmark for its review engine. Sourcedocs.deepsource.com/docs/platform/dashboard/repository/settingsread 2026-11-08
Browser / Computer-use	Not documented
DeepSource reads code, syntax trees, project graphs, coverage files and dependency manifests, and its agents act through Git host comments, commits and pull requests. Nothing on its site or in its docs describes an agent that opens a browser, drives a desktop or clicks through a running application, so checks on behavior stop at static analysis, coverage data and the dependency graph. Sourcedeepsource.com/llms.txtread 2026-11-08

The Agentic Index coverage score grades every vendor Full, Partial or Not documented against the same 14 buyer facing capabilities, from public evidence only. Each capability links to how all vendors in the index score on it. How this evidence is graded

Pricing

Free Open Source plan for public repositories, or Team at $30 a user a month, $24 billed yearly, plus metered AI review.

Per user a month on Team, billed monthly or yearly, plus AI review metered per 10,000 processed lines and dependency scanning targets beyond three.

Free tierTrial available

Included quota

Team includes $10 of AI review credit per user each month, or $100 a year on annual billing, unlimited repositories and pull request reviews, and three dependency scanning targets.

What is public

Free, Team and metered AI review prices, dependency target pricing and the trial terms, with Enterprise by contact.

Billing mechanics

Per user monthly or yearly plans with included AI credit, plus pooled AI review credit metered per 10,000 processed lines.

Cost watchouts

AI review is billed per processed line on top of seats, extra dependency targets add a monthly charge, and the Advanced review tier nearly doubles the metered rate.

Variable cost rationale

Seats are flat, but AI review is metered by processed lines of code beyond the included credit, so spend rises with pull request volume, and the Advanced tier costs nearly twice the Standard rate.

Additional watchouts

The product is to fold into the Harness platform over time, and metered AI review sits on top of seat prices.

Overage / add-ons

AI review beyond the included credit bills at $8 per 10,000 processed lines for Standard and $15 for Advanced from a pooled team balance with optional auto top up and volume discounts; extra dependency targets cost $8 to $10 a month each.

Sales call required

Mixed (some tiers require a call)

Free / trial

The Open Source plan is free for public repositories with 1,000 pull request reviews a month and pay as you go AI review, and a 14 day trial includes up to $50 of AI review credit with no card required.

Lowest paid plan

Team at $30 a user a month, or $24 billed yearly

Commercial notes

DeepSource Corp. sells DeepSource directly after its acquisition by Harness, with Enterprise deals handled within the Harness ecosystem.

Key ambiguities

The pricing page bills per user counting all members, while the billing docs describe billing per active committer, and monthly prices for extra dependency targets differ between the pricing page and the docs.

Cancellation / refund

Monthly or yearly self serve plans paid by card; Enterprise by contract with invoicing.

Support SLA / resale

Team adds priority email support, audit logs, the API, webhooks, Slack and Jira, and Enterprise adds an SLA, an account manager, custom terms, single sign on, IP restrictions, self hosting, air gap and bring your own model keys.

Missing data

Enterprise pricing and the exact billing unit for Team seats.

Agentic Index verified 2026-11-08

Official pricing page Docs

Data confidence: high