Sourcery
Also known as: Sourcery.ai, Sourcery AI, Sourcery.AI Limited
Sourcery is an AI code reviewer from Sourcery.AI Limited of London that reviews every pull request on GitHub and GitLab, posts a summary, a reviewer's guide and inline findings with suggested fixes, and approves low risk changes with no blocking findings. Its security scanning checks code for secrets, vulnerable code, infrastructure misconfiguration and risky dependencies. Open source repositories are free, Pro costs $12 a developer a month billed annually, and Team $24.
Sourcery is made by Sourcery.AI Limited, a London company founded by Nick Thapen and Brendan Maginnis that began with a local refactoring tool and now sells AI code review and security scanning. It works as a GitHub app, on GitLab.com and self managed GitLab, on GitHub Enterprise Server for Enterprise customers, and in an extension for VS Code, Cursor, Windsurf and JetBrains, with the U.S. Department of Justice, Red Hat and the Linux Foundation among the names on its site.
When a pull request opens, and again after each commit, Sourcery writes a summary into the description, posts a reviewer's guide with a file by file table and an optional sequence diagram, and leaves inline comments labeled by type, with fixes the author can commit in one click. It reads related code from the repository and linked issues, follows plain language review rules scoped by path, and resolves its own threads when later commits fix them.
On GitHub it sets a status check that fails when a security finding blocks, and it can approve a pull request when nothing it found is worth blocking on and the change needs no human judgement, an approval that counts toward branch protection and that teams switch on or off in review settings. Commands such as review, summary, resolve, dismiss and create issue run from comments or labels.
Security scanning runs secrets checks across git history with a Gitleaks fork, OpenGrep static analysis, Checkov for infrastructure as code and Trivy for dependencies, scoring findings from 0 to 100 against a repository risk profile, with daily scans on Team, Jira tasks created from findings and fix prompts that open in Cursor.
Team analytics compare Sourcery and human reviews, and a REST API and an MCP server with a tool for every endpoint let other agents read reviews, request new ones and manage rules and findings.
Sourcery holds a SOC 2 Type 2 report, deletes code right after processing, keeps account data in the UK and EEA, runs on OpenAI and Anthropic models without training on customer code, and offers self hosting, single sign on and bring your own model keys on Enterprise.
Open source repositories are free, Pro costs $15 a developer a month or $12 billed annually for private repositories, Team costs $30 or $24 with nightly security scans of up to 50 repositories and analytics, and Enterprise is custom, with a 14 day Team trial and no card needed. It fits teams on GitHub or GitLab that want fast reviews with automatic approval of safe changes and security scanning in one tool. It fits less well for buyers who want a reviewer that learns team preferences in a documented way, a choice of models, or audit logs.
Vendor details
Canonical URL
https://www.sourcery.ai
Category
Coding agent
Subcategory
AI code review for GitHub and GitLab that summarizes, comments, suggests fixes and approves low risk pull requests, with scheduled security scanning
Funding status
No funding is stated on Sourcery's own pages; founded by Nick Thapen and Brendan Maginnis.
Company status
independent
Use cases & customers
Primary use cases
Target customers
Deployment options
Integrations
GitHub app with reviews, suggestions, status checks, approvals and issue creation; GitLab bot user and webhook, including self managed GitLab; GitHub Enterprise Server on Enterprise; Jira by OAuth for tasks from security findings; Cursor deeplinks for fix prompts; GitHub and Vercel Marketplace billing; and a REST API and remote MCP server.
In practice
A platform team installs the GitHub app across its repositories; each pull request gets a summary, a reviewer's guide and inline comments, and dependency bumps with no blocking findings are approved by Sourcery so they merge once CI passes under the team's branch protection.
A security lead on the Team plan runs daily scans of 50 repositories, triages secrets and vulnerable code by risk score, and has critical findings create Jira tasks automatically up to a daily limit.
A developer copies a Sourcery fix prompt for a flagged injection risk into Cursor, applies the change, and asks Sourcery to review again with a comment command before merging.
Sources & related URLs
Related / legacy domains
Research sources
Agentic Index coverage score
10.0 / 14 capabilities · 71%
| Integrations & Tool Calling | Full |
|---|---|
|
Sourcery posts reviews, inline suggestions, a status check and approvals on GitHub, joins GitLab projects as a bot user through a webhook, and covers GitHub Enterprise Server on Enterprise. A create issue command turns a review comment into a GitHub issue, linked issues feed each review, Jira connects by OAuth to create tasks from security findings by hand or automatically by severity on Team, and fix prompts open directly in Cursor. Sourcedocs.sourcery.ai/admin/connect-jiraread 2026-11-08 |
|
| Workflow Orchestration | Partial |
|
Each review follows a fixed sequence of summary, reviewer's guide, inline comments and a status check, repeated after each commit for up to five automatic rereviews, and the security scanners run together as one logical scan of the default branch. Sourcery describes no subagents, planning steps, handoffs or parallel agents working on a change, so each update gets a single review pass. Sourcedocs.sourcery.ai/reviews/anatomy-of-a-reviewread 2026-11-08 |
|
| Knowledge Grounding & RAG | Partial |
|
Each review reads the diff along with related code from the repository, such as other places a changed function is used, plus linked GitHub issues and a search for related ones. Plain language review rules of up to 3,000 characters, scoped by path, steer what it flags, and a review language can be set, but Sourcery builds no index of the codebase and takes in no documentation or wiki. Sourcedocs.sourcery.ai/trust/code-retentionread 2026-11-08 |
|
| Human Oversight & Guardrails | Full |
|
Suggested fixes land only when the author commits them, singly or in a batch, and fix prompts for coding agents are copied by a person. Teams switch Sourcery's own approval of low risk pull requests on or off in review settings, can require its status check through branch protection, dismiss or resolve its review with a command, and snooze, ignore or rescore security findings with a reason. Sourcedocs.sourcery.ai/reviews/anatomy-of-a-reviewread 2026-11-08 |
|
| Security, Identity & Governance | Full |
|
Sourcery holds a SOC 2 Type 2 report and a penetration test from March 2026, shared on request through its trust center, and is GDPR compliant. Enterprise adds single sign on, accounts have admin and member roles mapped from GitHub and GitLab admins, code is deleted right after processing, account data stays in the UK and EEA, and neither Sourcery nor its model providers train on customer code. Sourcetrust.mycroft.io/sourceryread 2026-11-08 |
|
| Observability & Auditability | Partial |
|
Team analytics show overview, pull request lifecycle, Sourcery and human review comparisons, developers, repositories and trends, with acceptance rate, median cycle time and time to first review. Security reports track trends, remediation including mean time to fix and risk impact, and the API reads reviews and findings, but Sourcery offers no audit log or export of what it did. Sourcedocs.sourcery.ai/reviews/analyticsread 2026-11-08 |
|
| Memory & State Persistence | Partial |
|
Security ignore rules by path or rule carry into future scans, and the docs say review comments change as a team reacts to them and adds rules. A comparison page claims Sourcery learns from how people interact with its comments, but no guide explains what it keeps, for how long or how a team can view or clear it, so no memory a team can manage is described. Sourcedocs.sourcery.ai/reviews/anatomy-of-a-reviewread 2026-11-08 |
|
| Deployment & Data Residency | Full |
|
Sourcery runs as a service on Google Cloud with two fixed egress addresses, works with self managed GitLab on every plan and with GitHub Enterprise Server on Enterprise, and keeps account and usage data in the UK and EEA. Enterprise customers can run self hosted Sourcery so every part of it stays inside their own infrastructure, though no region choice or air gapped option is named. Sourcedocs.sourcery.ai/trust/self-hosted-sourceryread 2026-11-08 |
|
| Prebuilt Agents / Templates / Packs | Partial |
|
Review profiles come as Quiet, Balanced or Verbose, example review rules cover style guides, naming, architecture and migrations, and the security scanners run fixed rule sets from established open source tools. The IDE adds recipes to generate diagrams, tests and docstrings or explain code, and the original refactoring tool still carries 212 rules, but there is no library of prebuilt agents or rule packs to pick from. Sourcedocs.sourcery.ai/reviews/configureread 2026-11-08 |
|
| Triggers & Channel Coverage | Full |
|
Reviews start when a pull request opens and after every new commit, and comment commands or matching labels ask for a review, summary, guide, title, resolve, dismiss or new issue, with thread replies handled as chat. A REST call or the MCP server can request a review, the IDE reviews on demand, and security scans run on a schedule, twice weekly on Open Source and Pro and daily on Team, with on demand scans on Team. Sourcedocs.sourcery.ai/reviews/commandsread 2026-11-08 |
|
| Model Flexibility & Routing | Partial |
|
Reviews run on Anthropic models and on OpenAI models served through Azure in Sweden, with OpenAI as a fallback, and no model is named. Customers cannot switch providers from the dashboard, and bringing their own model keys is arranged by Sourcery on request for Enterprise rather than set in the product, so the choice of model stays with the vendor. Sourcedocs.sourcery.ai/trust/llm-providersread 2026-11-08 |
|
| APIs / SDKs / MCP Extensibility | Full |
|
A public REST API with bearer keys reads accounts and reviews, requests new reviews, creates, edits and deletes review rules, and reads and updates security findings and groups, requiring a Team account. A remote MCP server at a published address signs in through OAuth in the browser and exposes every API endpoint as a tool, so coding agents can work with reviews, rules and findings directly. Sourcedocs.sourcery.ai/api/mcp-serverread 2026-11-08 |
|
| Testing, Debugging & Optimization | Full |
|
Security checks on every pull request fail the status check when a blocking finding appears, and scheduled scans cover secrets across git history, static analysis in 12 languages, infrastructure as code, and dependency vulnerabilities and licenses, each scored from 0 to 100 against a repository risk profile. The IDE can generate tests on request, though Sourcery measures no test coverage. Sourcedocs.sourcery.ai/security/scannersread 2026-11-08 |
|
| Browser / Computer-use | Not documented |
|
Sourcery reads diffs, repository code, issues and scan results, and acts through pull request comments, status checks, approvals and tickets. No Sourcery agent opens a browser, runs the application under review, clicks through a page or drives a desktop, so checks on how the software behaves stop at code analysis, scan results and the customer's own CI pipeline. Sourcedocs.sourcery.ai/reviewsread 2026-11-08 |
|
The Agentic Index coverage score grades every vendor Full, Partial or Not documented against the same 14 buyer facing capabilities, from public evidence only. Each capability links to how all vendors in the index score on it. How this evidence is graded
Pricing
Free for open source repositories, or Pro at $15 a developer a month, $12 billed annually, for private repositories.
Per assigned developer seat a month, billed monthly or annually with 20 percent off annual, with review limits measured in diff characters per pull request and per seat each week.
Included quota
Pro allows 300,000 diff characters per pull request and 1,500,000 per seat each week, and Team 500,000 and 2,500,000, with Team adding nightly scans of up to 50 repositories.
What is public
Open Source, Pro and Team prices monthly and annual, review limits, trial terms and the plan features, with Enterprise by contact.
Billing mechanics
Per assigned developer seat billed monthly or annually, with diff character limits per pull request and per seat each week.
Cost watchouts
Security scanning on Open Source and Pro is a limited preview capped at a few repositories, so full scanning needs Team, and the API requires a Team account.
Variable cost rationale
Plans are flat per assigned seat with no metered usage, and pull requests over the diff limits are skipped rather than charged.
Additional watchouts
Full security scanning and the API sit on Team or above.
Overage / add-ons
Reviews beyond the diff limits are skipped rather than billed, and larger needs move to Team or Enterprise.
Sales call required
Mixed (some tiers require a call)
Free / trial
Open Source is free forever for public repositories, and installing Sourcery gives the whole organization 14 days of Team with no card needed.
Lowest paid plan
Pro at $15 a developer a month, or $12 billed annually
Commercial notes
Sourcery.AI Limited sells directly and through GitHub and Vercel Marketplace, with Enterprise on negotiated annual terms.
Key ambiguities
Pricing lists Jira on Pro while the docs place automatic Jira task creation on Team, and one docs page offers bring your own model keys on Team while others reserve it for Enterprise.
Cancellation / refund
Cancel or downgrade at any time on monthly or annual self serve plans; Enterprise billed annually by contract.
Support SLA / resale
Team adds security scanning at scale, the issues dashboard and analytics, and Enterprise adds self hosting, GitHub Enterprise Server, single sign on, bring your own model keys, a dedicated success manager and invoice billing.
Missing data
Enterprise pricing and self hosting terms.
Related vendors
- Cognition — Maker of Devin, an autonomous AI software engineer
- 10Web — Agentic website platform whose AI agents build, host and manage…
- AgentUI — Managed AI app builder for operations teams that generates and hosts…
- Aider — Open source, model agnostic terminal coding agent that edits your…
- Amp — Amp is a coding agent from Amp Frontier Corporation that runs each…
- Anthropic Claude Code — Anthropic's agentic coding system across terminal, desktop, IDE, web…