An AI security scanner that costs thousands and runs with shell access

What it does

Deepsec is an agent-powered vulnerability scanner designed for large-scale repositories. It runs in your own infrastructure—optionally distributing work across Vercel Sandbox microVMs—to surface hard-to-find security issues that have been sitting in code for a long time. The tool is explicitly tuned to use the best available models at maximum thinking levels, which means full scans can cost thousands or tens of thousands of dollars.

The interesting bit

Instead of throwing AI at every line blindly, Deepsec first uses fast regex matchers to find candidate sites, then sends only those to an AI investigator. Even more unusually, it asks you to prime the agent with a short, project-specific brief—INFO.md—so the model knows your auth helpers and middleware rather than drowning in generic CWE categories.

Key highlights

• Resumable by design: if a run crashes or exhausts its API quota, re-running the same command skips already-analyzed files and continues from the breakpoint.
• Two-phase pipeline: a lightweight scan finds candidates with regex, then process dispatches them to the coding agent for actual investigation and recommendations.
• Distributed execution for monorepos: work can fan out across multiple sandboxed microVMs with limited network egress to reduce exposure.
• PR-mode support via process --diff to investigate only changed files, plus a revalidate step to cut false positives by rechecking findings against git history.
• Security model is honest: the tool treats itself as a coding agent with full shell access, and the README warns about prompt-injection risks from external dependencies.

Caveats

• The README notes that local Claude or ChatGPT subscriptions “generally don’t have enough headroom for full repo scans,” so real usage requires Vercel AI Gateway or explicit API keys.
• Because the agent runs with full shell access on your environment, vendored or external dependencies could theoretically be exploited via prompt injection; sandbox mode mitigates this but adds infrastructure complexity.

Verdict

Organizations with large, mature codebases and an appetite for expensive, deep security audits should look here. If you need a lightweight, low-cost linter or lack the budget for top-tier model inference, this is not your tool.