DeepSource: reviews and analysis

TLDR: DeepSource is the veteran of automated review and the only one in the segment that runs thousands of deterministic rules before a model gets an opinion on the change. That shows in how few invented warnings reach the pull request, and its pitch is security rather than conversation. The bill has two meters, $24 per user per month on annual billing plus AI review charged separately by processed lines, so the headline price is not the final one.

What DeepSource is and how it works

DeepSource went public in March 2020 as the easy way to put static analysis into code review, long before anyone was selling reviewers built on language models. That origin explains today’s architecture, which the company calls hybrid and which is its one real difference from the rest of the segment: over five thousand deterministic rules run across the change first, and only then does the AI agent reason about what is left.

The order matters more than it sounds. A deterministic rule does not hallucinate, you can read it, and when it flags something you can explain why. A model brings context and grasps the intent of a change, but it also invents problems that are not there. Putting them in that order means a good share of what shows up in the pull request arrives with a checkable reason behind it, and that the model works on ground already cleared rather than on the whole diff.

Around the review sit pieces that are separate products elsewhere: secret detection, analysis of infrastructure declared as code, vulnerable dependency scanning, compliance reports and test coverage. And then there is Autofix, which does not propose a change in a comment but generates the verified patch.

One detail answers the old accusation aimed at this kind of product. Back in 2020, when the company introduced itself publicly, a commenter threw the two standard objections at it: that sending your whole codebase to a third party is a security problem, and that these tools are wrappers around other people’s open analysis software with a billing layer on top. Six years later the answer to the second one comes with code. The company publishes Globstar, its own static analysis engine under MIT, written in Go and built on tree-sitter, with checkers declared in YAML files. You can use it without buying anything. That is not a wrapper around pylint. The first objection, though, is still live and belongs to the customer: anyone who cannot send code outside needs the enterprise plan, which allows self-hosting and bringing your own model keys.

What using it is like day to day

It connects to the four big hosts, GitHub, GitLab, Bitbucket and Azure DevOps, and that list alone settles the question for plenty of corporate teams who cannot even look at reviewers that only plug into the first two. From there it analyses each pull request and leaves its findings where they get read, inside the change itself.

In practice the experience feels closer to a serious linter with judgement than to a colleague leaving comments. Anyone arriving from CodeRabbit will notice less conversation and fewer narrative summaries, and anyone arriving from a false-positive hangover will notice silence where paragraphs used to be. Autofix is the part that saves the most time when a finding is mechanical, because the patch arrives written and verified, and it comes unlimited on the paid plan.

On quality there are numbers, and they need the fine print attached. The company publishes an in-house benchmark over 165 real vulnerabilities from the OpenSSF open catalogue, in JavaScript and TypeScript, where it scores 84.51% F1 and places Cursor BugBot, Greptile and CodeRabbit behind it, the last one by a distance. Before buying the headline, look at the breakdown the same page publishes, which tells you more than the overall score: precision is 100% and recall is 73.17%. Translated, when it speaks it is right, and roughly one vulnerability in four in that set slips past. It wins the comparison by not being wrong, not by seeing more. For a team sick of noise that is exactly the thing to buy. For a team looking for a net that lets nothing through, it is the opposite.

And here is the serious weakness of this review, which sits not in the product but in what can be checked about it. The measurement is run by the vendor, even though it publishes the raw data, and the open user opinion you would contrast it against does not exist: on the review aggregators where it should be there is none, not one, and the launch listing has none either. A six-year-old product with corporate customers and no public reviews is not an alarm, but it does force us to say that its reputation rests on what the vendor reports and on what competitors say when they compare themselves against it.

Pricing and plans

The paid plan is called Team and the page shows $24 per user per month under an annual billing label. That switch carries a visual trap worth knowing: turning it off changes the figure to $30 per user per month, but the periodicity label stays put, so it is easy to walk away with the annual number believing it is the monthly one. We publish what the page shows by default, with its condition attached.

The important part comes next, because the seat does not include AI review. That is billed by usage, and the card itself spells it out: each user on the plan carries $100 of annual credit, and beyond that standard review costs $8 per ten thousand processed lines and the advanced tier $15. Autofix does come unlimited on the paid plan. Open source dependency scanning includes three targets and charges $8 a month for each additional one.

So there are two meters, and the second one depends on how much code you move. Before comparing this price against a flat-rate rival, estimate how many lines go through your pull requests in a month, because that arithmetic can change the ranking. The company states that prices include taxes, which is rare and welcome in this market.

The trial runs fourteen days, includes up to $50 in review credits and asks for no card. Public projects pay nothing and get a thousand pull request reviews a month, with the expected limitation that private repositories are not part of that.

Who it is for (and who it is not for)

DeepSource is the natural pick for a team that answers to security or compliance. If someone is going to ask you for a vulnerability report, secret detection and dependency traceability, and you also want review in the pull request, it is all in one place here and backed by rules you can audit. It is also the obvious answer for code living on Bitbucket or Azure DevOps, since half the competition in this segment does not go there at all.

It fits teams burnt by noise just as well. Buying precision at the cost of recall is a legitimate decision, and this tool has made it explicitly.

It is not for anyone who wants conversational review that explains the change and argues about design, which is what CodeRabbit does best. Nor for anyone who needs a closed, predictable price, because per-line billing means watching the invoice. And for small teams on a tight budget, the cheap entry to the segment is Sourcery, though it looks far less deep. The ranking lives in the best AI code review tools, inside the map of the best AI coding tools.

Alternatives to DeepSource

Against CodeRabbit the difference is temperament: one converses and summarises, the other filters and asserts. Against Greptile, which indexes the whole repository to see what the diff does not show, DeepSource attacks the same noise problem from the opposite side, putting hard rules in front instead of more context. And if what you want is usage-based billing with no seats, Qodo sells credit pools shared across the team, though without the security half that is the main argument here.

Frequently Asked Questions

What does DeepSource cost in total?

The seat is $24 per user per month on annual billing, and on top of that comes AI review, charged at $8 per ten thousand processed lines in standard mode and $15 in advanced, with $100 of annual credit included per user.

How is it different from a normal AI reviewer?

Static analysis runs first. Over five thousand deterministic rules examine the change before the model says anything, so what reaches the pull request has been filtered by criteria you can read.

Is the 84.51% it publishes trustworthy?

It is its own measurement over an open set of real vulnerabilities, with the raw data published. The most informative detail is not the overall score but its breakdown: it is right 100% of the times it speaks and detects 73.17% of the cases, so it wins by producing no false positives rather than by finding more.

Does it work with Bitbucket or Azure DevOps?

Yes, and it is one of the few in the segment that reaches all four big hosts. A good share of its rivals cover only GitHub and GitLab.

Can I avoid sending my code outside?

With the enterprise plan, which allows self-hosted deployment and using your own model keys. On the regular plans the code leaves for the service, which is the objection that has followed it since the day it launched.