Scan Your Own Code With Free AI Agents (deepsec, Step by Step)

Every AI coding tool writes bugs. It writes them fast, and it writes them confidently. A SQL query built from user input. A hardcoded key. An eval on request data. The code runs, the demo works, and the vulnerability ships.

So the useful question is not “does AI write bugs” — it does. The question is: how do you catch them before an attacker does?

This guide walks you through deepsec, a free open-source tool from Vercel Labs that points AI agents at your codebase and hunts for real vulnerabilities. We will explain how it works, run it step by step, read the findings, and cover the one thing everyone gets wrong about the cost.

What deepsec actually is (and how it works)

deepsec is “a security harness for finding vulnerabilities in your codebase powered by coding agents.” It is open source under the Apache 2.0 license.

The clever part is that it runs in two stages, and understanding this is what makes the tool make sense:

1. Regex stage (fast, cheap). deepsec sweeps your code with pattern matchers and flags candidate sites — a string concatenation that looks like SQL, an eval, a hardcoded secret. This is instant and costs nothing. But regex alone is dumb: it flags things that are fine and misses things that aren’t.
2. AI investigation stage (slow, smart). For each candidate, an AI agent actually reads the surrounding code at maximum thinking level and decides: is this a real exploitable vulnerability, or a false alarm? This is where the intelligence — and the cost — lives.

That split is the whole idea. Regex narrows millions of lines down to a handful of suspects; the AI does the expensive deep-thinking only on those suspects. A plain linter can’t reason about whether input is actually attacker-controlled. deepsec can, because a real model reads the flow.

The cost — read this before you panic

deepsec’s own README is refreshingly blunt: a full scan of a large codebase “can cost thousands or even tens-of-thousands of dollars.” That is not a typo. Deep AI reasoning over an entire company monorepo burns a lot of tokens.

But that is the enterprise case, not yours. On a side project or a single service, running it against a small repo using a subscription you already have is basically free. That is the path this guide uses. Don’t let the scary headline number stop you — scope the scan to what you’re actually shipping.

Step 1 — Point it at a repo

From the root of the project you want to scan:

npx deepsec init      # creates a .deepsec/ folder with this repo as the first project
cd .deepsec
pnpm install          # installs deepsec

That’s the setup. deepsec init registers your repo; pnpm install pulls the tool in.

Step 2 — Give it a model (use the plan you already have)

deepsec needs a coding agent to do the investigation. You have options, cheapest first:

• Your existing Claude or Codex subscription (the local fallback). If you already pay for Claude Pro/Max or a ChatGPT plan, deepsec can use it. For a small repo this is the free path. (Note: subscriptions have limited headroom — enough for a side project, not a full company scan.)
• Vercel AI Gateway — set AI_GATEWAY_API_KEY=vck_... for production-grade scanning where you pay per token.
• Explicit keys — your own ANTHROPIC_AUTH_TOKEN or OpenAI equivalent override everything else.

For learning and side projects, the subscription fallback is the move.

Step 3 — Scan, then investigate

pnpm deepsec scan       # regex stage: flags candidate vulnerabilities fast
pnpm deepsec process    # AI stage: an agent investigates each candidate

scan is the quick regex sweep — it will flag candidates in a fraction of a second. process is where the agent reads each one and decides if it’s real. This step takes a couple of minutes because the model is genuinely thinking.

Optional but recommended:

pnpm deepsec revalidate  # a second pass that cuts false positives

Step 4 — Read the findings

pnpm deepsec export --format md-dir --out ./findings

This writes a plain markdown report. Each finding tells you three things that matter:

• What the vulnerability is (e.g. “User-controlled query parameter is concatenated into SQL”)
• The severity (Critical / High / Medium)
• The exact file and line

That is the payoff. Not “your code might have issues” — a named vulnerability, a severity, and a line number you can open right now. When we tested this on a tiny planted repo, deepsec ranked a classic SQL-injection line as Critical and pointed straight at app.js, line 4.

One honest caveat: deepsec finds some real vulnerabilities. It does not find all of them, and a clean report does not mean your code is safe. Treat it as a sharp extra reviewer, not a guarantee.

Scope big scans so they stay cheap

If you do want to run this on a larger codebase without the four-figure bill, use PR-review mode instead of scanning everything:

pnpm deepsec process --diff   # investigate only what changed in this PR

Scanning only the diff means the AI reasons about a handful of changed files, not the whole history. This is also the smartest way to use it in real life — catch the vulnerability in the pull request, before it ever merges.

Two more free AI scanners worth knowing

deepsec is the deepest, but it is not the only free option:

• Semgrep — fast, rule-based static analysis with a strong free tier. Not AI-reasoning like deepsec, but excellent for catching known patterns instantly in CI.
• Your coding agent, prompted directly — Claude Code or Codex, pointed at a file with “act as a security reviewer, find injection and auth flaws, cite the line.” Less structured than deepsec, but zero setup and surprisingly effective for a single file.

Use deepsec when you want depth, Semgrep when you want speed in CI, and a direct agent prompt when you just want a quick second opinion on one file.

The habit that matters

The tools change every month. The habit does not: scan before you ship. AI writes your code faster than ever, which means it writes vulnerabilities faster than ever too. A two-minute scan on a small repo, using a plan you already pay for, is the cheapest insurance in software.

deepsec is free and open source. Point it at your next side project today.