Dataset·Catalogue

Agentic Developer Tools

Name: Agentic Developer Tools
Creator: Hermosa AI
Published: 2026-09-06
License: https://creativecommons.org/licenses/by/4.0/

Coding agents started as the product. They are becoming an engine other tools drive. These are the tools that point one at an existing codebase to do a single fixed job: review a pull request, audit for vulnerabilities, generate tests, run a migration. Not the agents that write your features, the tools that check them. Browse it below, or take the raw files.

Snapshot: 2026-09-06
Coverage: 2tools·2jobs covered·1drive coding agents·1self-hostable
Download

About this dataset

[show]

Unit: One row = one tool that drives an LLM or coding agent over an existing codebase, with the job it owns, the engine it drives, deployment model, whether it writes code, surface, pricing, maturity, and a source.
Scope: The boundary against a coding harness is who sets the goal. A harness takes open-ended instruction: you tell it what to build. A tool here owns one fixed job and you point it at a codebase. Writing code is therefore in scope, so long as finding is the primary job: an autofixer that patches what it found belongs here, an agent you brief to build a feature does not.
Engine: Whether the tool drives an external coding agent, runs a model the vendor hosts, pairs static analysis with a model pass, or an ensemble the vendor does not decompose. A purely deterministic linter, SAST scanner or codemod with no model is out of scope.
Claims: Every vendor in this category claims benchmark superiority and most of it is marketing. Accuracy, false-positive and benchmark figures are quoted and explicitly attributed as vendor-claimed or independent. Treat an unattributed number as unverified.
Unknowns: A capability a vendor does not document is left unset and reads as unknown, never as a no. Absence of a claim is not evidence of absence.
Sources: Each row is verified against vendor documentation, launch posts, changelogs or the source repository. URLs travel with the dataset.
License: Free to use, distribute, and reproduce with attribution to Hermosa Labs LLC (CC BY 4.0).
Cite: Hermosa Labs LLC, “Agentic Developer Tools,” 2026-09-06.

The catalogue

Security audit1

deepsec

[find only][GA]

Vercel·self-hosted·drives a coding agent·launched 2026-05-04

Open-source security review tool. Static analysis shortlists security-sensitive files, then coding-agent models investigate each one, tracing data flows and checking for mitigations, and the run emits ranked findings with severity ratings. Runs on your own machine with optional fanout to Vercel Sandboxes.

Surface: CLI (npx deepsec init), run locally, with optional remote execution on Vercel Sandboxes
Engines: Claude Opus 4.7 and GPT 5.5 through Vercel AI Gateway by default; bring your own key (OpenAI, Anthropic, or a custom HTTPS provider) with --model-auth direct, or use an existing Claude or Codex subscription
Codebase context: static analysis shortlists candidate files, then per-file agent investigation; runs on Vercel's own monorepos routinely scale past 1,000 concurrent sandboxes, and an interrupted run resumes without re-analysing finished files
Pricing: free and open source; you pay only for model usage, either through AI Gateway or your own key
License: Apache-2.0
Open source: yes

Benchmark signals

Vendor-claimed only: Vercel reports the false positive rate is 'roughly 10-20%' on its own monorepos. No independent benchmark of deepsec was located.

Vercel calls deepsec 'a security harness powered by coding agents', which collides with this repo's harnesses dataset, where harness means the coding agent itself. deepsec is a consumer of harnesses rather than a member of that set: it owns a fixed job (find vulnerabilities), drives coding agents as an engine, and never authors features. This entry is the case that motivated the topic.

Source: Vercel, Introducing deepsec

Mixed1

CodeRabbit

[writes code][GA]

CodeRabbit Inc.·SaaS·hybrid ensemble

Hosted AI code-review service that reviews pull requests line by line, triages and prioritises them, and adds what it calls agentic code-security monitoring. It comments on the PR and can also commit a fix.

Surface: GitHub and GitLab pull-request bot, IDE reviews, CLI reviews, web dashboard, and Slack
Pricing: freemium; a free tier and free trial are offered, with paid tiers on a separate pricing page not read for this entry
Open source: no

Benchmark signals

Vendor-claimed positioning only ('Most installed AI App on GitHub'). No independent benchmark was verified for this entry. Martian published an independent AI code-review benchmark in February 2026 covering 17 tools across roughly 300,000 pull requests, which a future round should check for CodeRabbit's placement.

Seeded as the contrasting shape to deepsec: a hosted SaaS pull-request bot that commits fixes, against a self-hosted find-only CLI. Its engine is described only as an 'Ensemble of models & tools', and whether a customer model can be supplied is not stated, so pluggableEngines, codebaseContext, license and launched are left unset rather than assumed.

Source: CodeRabbit product site

Agentic Developer Tools

Snapshot

2026-09-06

Coverage

2tools·2jobs covered·1drive coding agents·1self-hostable

Download