Dataset·Catalogue

Agentic Developer Tools

Name: Agentic Developer Tools
Creator: Hermosa AI
Published: 2026-10-12
License: https://creativecommons.org/licenses/by/4.0/

Coding agents started as the product. They are becoming an engine other tools drive. These are the tools that point one at an existing codebase to do a single fixed job: review a pull request, audit for vulnerabilities, generate tests, run a migration. Not the agents that write your features, the tools that check them. Browse it below, or take the raw files.

Snapshot: 2026-10-12
Coverage: 34tools·7jobs covered·2drive coding agents·15self-hostable
Download

About this dataset

[show]

Unit: One row = one tool that drives an LLM or coding agent over an existing codebase, with the job it owns, the engine it drives, deployment model, whether it writes code, surface, pricing, maturity, and a source.
Scope: The boundary against a coding harness is who sets the goal. A harness takes open-ended instruction: you tell it what to build. A tool here owns one fixed job and you point it at a codebase. Writing code is therefore in scope, so long as finding is the primary job: an autofixer that patches what it found belongs here, an agent you brief to build a feature does not.
Engine: Whether the tool drives an external coding agent, runs a model the vendor hosts, pairs static analysis with a model pass, or an ensemble the vendor does not decompose. A purely deterministic linter, SAST scanner or codemod with no model is out of scope.
Claims: Every vendor in this category claims benchmark superiority and most of it is marketing. Accuracy, false-positive and benchmark figures are quoted and explicitly attributed as vendor-claimed or independent. Treat an unattributed number as unverified.
Unknowns: A capability a vendor does not document is left unset and reads as unknown, never as a no. Absence of a claim is not evidence of absence.
Sources: Each row is verified against vendor documentation, launch posts, changelogs or the source repository. URLs travel with the dataset.
License: Free to use, distribute, and reproduce with attribution to Hermosa Labs LLC (CC BY 4.0).
Cite: Hermosa Labs LLC, “Agentic Developer Tools,” 2026-10-12.

The catalogue

Code review9

Baz

[GA]

Baz·self-hosted or SaaS·own model·launched 2025-01

Engineering review platform whose Reviewer agent reads the whole codebase to give inline pull-request feedback, alongside Custom Reviewers trained on a team's past PR discussions and a Planner product that pushes review earlier into the implementation-plan stage.

Surface: PR bot (GitHub), web-based review workspace
Codebase context: full-repo: Baz's own description says it reads the whole codebase rather than only the diff
Pricing: seat-based pricing plus usage-based Engineering Work Credits

Benchmark signals

Listed among the tools evaluated in Martian's independent Code Review Bench per Martian's own description of its tool set. No vendor-published or independently confirmed F1/precision/recall score specific to Baz was located for this entry.

Filed as job: review. Baz names security findings as one of several review surfaces (alongside implementation plans, pull requests and merge decisions), which the validator judged a facet of review rather than a co-equal product line, unlike CodeAnt. engineModel is the discoverer inference and is not confirmed by any vendor technical statement, so treat it as unverified until a teardown or a vendor architecture page supports it. Founded by Bridgecrew founder Guy Eisenkot; emerged from stealth with an $8M seed round around January 2025 and raised a further $9M seed extension in June 2026 (both secondary-sourced). writesCode is omitted: a 'Fixer' agent role is referenced in vendor materials but no page read for this entry confirmed whether it commits to the repo or only proposes a fix.

Source: Baz homepage

Bugbot

[writes code][GA]

Cursor (Anysphere)·SaaS·hybrid ensemble·launched 2025-06

AI code review bot from Cursor that automatically reviews GitHub pull requests for logic bugs and posts comments with fix suggestions, with an optional Autofix mode that spawns a Cloud Agent to push a fix directly to the branch.

Surface: PR bot (GitHub), Cursor editor, Cloud/Background Agent
Pricing: usage-based billing; consumes included usage first, then bills additional reviews through on-demand spend (moved off a flat per-seat subscription in 2026 per third-party reporting, not confirmed on Cursor's own pricing page for this entry)

Benchmark signals

Listed among the tools evaluated in Martian's independent Code Review Bench (per Martian's own GitHub repository description of the benchmark's tool set, which names Cursor Bugbot alongside CodeRabbit, Greptile, Qodo, Graphite, Baz, CodeAnt and others). No vendor-published or independently confirmed F1/precision/recall score specific to Bugbot was located for this entry; Cursor's own docs claim a review-usefulness figure instead: '70%+ of flags get resolved before merge,' which is a vendor-reported adoption metric, not a benchmark placement.

Separately named, separately billed (per-review usage pricing) product from the Cursor IDE/CLI that is already tracked in harnesses.csv, satisfying this topic's fixed-job test even though it shares Cursor's account and some of its models. Docs also state: 'Bugbot Autofix automatically spawns a Cloud Agent to fix bugs found during PR reviews,' which can 'push fixes to the existing branch or a new branch,' the basis for writesCode: true. Engine per Cursor's own docs: 'Bugbot uses a combination of frontier and in-house models to review code.'

Source: Cursor Bugbot docs

Copilot code review

[writes code][GA]

GitHub (Microsoft)·SaaS·hybrid ensemble·launched 2025-04-04

An agentic pull-request review feature of GitHub Copilot: it reviews a PR's changes using agentic tool calling to explore the repository (relevant code, directory structure, cross-file references) before leaving inline comments and suggested fixes, and in public preview can hand accepted suggestions to a Copilot cloud agent to open a follow-up pull request with the fixes applied.

Surface: PR bot on GitHub pull requests, runs via GitHub Actions
Pricing: Included with paid Copilot plans (Pro, Pro+, Business, Enterprise); per GitHub's own changelog, billed as part of GitHub Copilot's usage-based AI Credits model starting 2026-06-01, with GitHub Actions minutes also consumed per review on private repositories beyond included entitlements

Distinct, separately named and separately billed review surface from the already-tracked github-copilot-autofix entry, which is bound only to CodeQL code-scanning alerts (job: security) and never runs a general PR review. Copilot code review reached GA on 2025-04-04 as a diff-only reviewer per GitHub's own changelog, then moved to the agentic tool-calling architecture described here on 2026-03-05, and continued shipping capability updates through 2026-09 (approval sign-off, resolution reasons, AGENTS.md support), so it is an actively evolving, currently-live surface rather than a one-off launch. engineModel: hybrid is an inference, not a direct Copilot-code-review-specific statement: GitHub's docs confirm the feature is LLM-driven and agentic but do not name which specific model(s) power code review as opposed to Copilot's other surfaces (Copilot's general model picker spans GPT, Claude and Gemini families, per secondary reporting, but that was not confirmed as applying to code review specifically). openSource is omitted (not applicable/not stated).

Source: GitHub Changelog: Copilot code review now runs on an agentic architecture

cubic

[writes code][GA]

cubic (YC S25)·SaaS·hybrid ensemble·launched 2025-04

AI code review platform, marketed as 'cursor for code review,' that reviews every pull request against the whole codebase and past merges to reduce noisy one-size-fits-all warnings, and can generate a fix through a connected coding agent on request.

Surface: PR bot (GitHub), IDE, web platform, CLI (Team plan and above)
Engines: Docs state cubic 'uses multiple model providers, with different models for different review tasks,' and that its coding-agent fix step will 'Generate fixes when requested, using your configured provider.'
Pricing: Per-developer plans on the pricing page (monthly billing): Team $40, Pro $99 and Max $200 per developer per month, each with a review-line allowance and auto-fix PRs (2, 10 and 20 per developer respectively); the page shows a 20% discount toggle for yearly billing; Enterprise custom. The page fetched 2026-10-12 does not mention a free Starter tier, so whether it still exists is unconfirmed; public and open-source repositories were previously listed as free and are not re-confirmed.

Benchmark signals

Vendor-reported placement on Martian's independent Code Review Bench: cubic's own recap states it holds the top spot with a 61.8% F1 score and that 'cubic scores 16.3 percentage points above the next well-known tool on the list.' As with the other vendors on this leaderboard, this is a dated snapshot (published around 2026-03-25); Martian's benchmark updates continuously and other tools (Qodo, Greptile, CodeRabbit) have separately claimed top placement on different dates with different scores.

Founded in 2025 (YC Spring 2025 batch) by Allis Yao and Paul Sangle-Ferriere, per Y Combinator and press coverage; publicly launched on Product Hunt 2025-04-28 (secondary-sourced). writesCode is true both via an on-request coding-agent fix step and, per third-party reporting, an automatic commit-and-open-PR path on the Team plan and above; only the on-request path is confirmed directly in cubic's own docs for this entry.

Source: cubic homepage

Graphite AI Reviews (formerly Diamond)

[writes code][GA]

Graphite (Cursor / Anysphere; definitive acquisition agreement announced 2025-12-19)·SaaS·own model·launched 2025-03-17

AI reviewer that comments on every GitHub pull request with codebase-aware findings and suggested fixes, and can apply a fix and commit it through an in-page chat once a developer approves it. Launched as a standalone product named Diamond in March 2025 and later absorbed into Graphite's core AI Reviews feature under the main Graphite brand.

Surface: PR bot (GitHub), web app (app.graphite.com), IDE (VS Code, per the original Diamond launch)
Pricing: Diamond originally offered a free tier up to 100 PRs/month; the current Graphite homepage offers a free 30-day trial synced to a GitHub account, with paid tiers on a separate pricing page not read for this entry

Benchmark signals

Independent finding from Martian's own Code Review Bench writeup (not a vendor claim): 'Graphite: highest precision and lowest recall in both benchmarks.' This is Martian's own characterization of Graphite's result profile rather than a headline F1 ranking.

Anysphere (Cursor's maker) announced in December 2025 that it had agreed to acquire Graphite; per Cursor's own post, 'Graphite has entered into a definitive agreement to be acquired by Cursor,' and separately, 'Graphite will continue to operate independently with the same team and product.' As of this check, graphite.com still markets AI Reviews as an active, separate product and carries no 'a Cursor company' branding; a homepage banner ('Cursor Cloud Agents are now in Graphite') shows product integration deepening, but no page read for this update confirms the acquisition has formally closed or that Graphite and the already-tracked Cursor Bugbot are being merged; that the two are now under a common parent is this entry's own inference, not a claim made by either vendor page. Distinct from the already-tracked Graphite CLI/stacking product (not itself a review tool and not tracked in harnesses.csv). Now writes and commits code when a developer approves a fix in Graphite Chat, per the homepage: it lets you resolve CI failures, apply suggested fixes, and commit your changes in one conversation, unlike Greptile, which never applies a patch itself.

Source: Graphite homepage

Greptile

[find only][GA]

Greptile, Inc.·self-hosted or SaaS·hybrid ensemble·launched 2023

AI code review agent that builds a dependency-graph index of the whole codebase before commenting on a pull request, using a swarm of parallel agents to trace dependencies and flag logical, security and style issues with supporting evidence.

Surface: PR bot (GitHub, GitLab), IDE integrations (Cursor, Claude Code, Codex, Devin), CLI, API/MCP
Codebase context: full-repo index; docs describe indexing the entire codebase into a dependency graph before reviewing any single PR, rather than reviewing the diff in isolation (paraphrased from Greptile's own product description)
Pricing: freemium: Starter is free for one developer with 50 credits/month; Pro is $30/seat/month with 50 credits/seat (1 credit = 1 standard review, 3 credits = 1 TREX test-writing review), additional credits $1 each

Benchmark signals

Vendor-reported placement on Martian's independent Code Review Bench: Greptile's own recap (dated 2026-07-30) states 'Greptile is the top-performing AI code reviewer overall as of July 30, 2026. Greptile ranks #1 in F1 score at 60.8% and leads all evaluated tools in precision at 76.2%.' The Martian leaderboard is a continuously updated, open-source benchmark (codereview.withmartian.com, launched 2026-02-26), and multiple vendors (Qodo, cubic) have separately claimed the #1 spot on other dates with different scores, so treat any single vendor's '#1' claim as a dated snapshot of a moving leaderboard rather than a fixed ranking.

Distinct from CodeRabbit in this dataset by never writing or committing code itself: every finding routes to an external coding agent for the actual fix (docs describe a 'Fix with your Agent' action that hands the issue to Claude Code, Codex, Conductor, Cursor, or Devin rather than Greptile applying the patch). Deployment is both self-hosted and SaaS per docs ('Greptile Cloud (SOC2 Type II)' alongside Docker Compose and Kubernetes with Helm for self-hosting); pluggableEngines is left unset because the docs mention 'custom LLMs' only in passing on that deployment-options list without naming which providers/models are actually supported. Founded 2023, YC W24 batch, per Georgia Tech and press coverage (secondary-sourced, not confirmed on Greptile's own site).

Source: Greptile docs, Introduction

Qodo

[GA]

Qodo (formerly CodiumAI)·self-hosted or SaaS·hybrid ensemble

AI code review platform, evolved from the open-source PR-Agent project into Qodo Merge and now folded into the unified Qodo platform, that runs specialized agents in parallel to assess correctness, standards compliance, architecture and risk on a pull request, then merges their findings with a judge agent before commenting.

Surface: PR bot (GitHub, GitLab, Bitbucket, Azure DevOps), IDE (VS Code, JetBrains), CLI, Git workflows
Engines: Enterprise plan supports bring-your-own LLM keys per Qodo's pricing page, which lists BYOK as an Enterprise-tier feature; specific model options are not disclosed.
Pricing: credit-based: free 14-day trial, Pro Team plan from $30/month with credits at $0.012 each pooled across the team, custom Enterprise pricing, and a free tier for qualifying open-source projects

Benchmark signals

Vendor-reported placement on Martian's independent Code Review Bench: Qodo's own recap (dated 2026-03-15) states 'With an F1 score of 64.3%, Qodo surpasses other AI code review tools, ahead of the next leading tool by +10.5%.' As with other vendors on this leaderboard, this is a dated snapshot; Martian's benchmark updates continuously and other tools (CodeRabbit, cubic, Greptile) have separately claimed top placement on different dates with different scores.

writesCode is left unset: the product page describes generating an 'implementation-ready prompt for any AI coding agent' for a developer to hand to their own assistant, which shows a handoff path exists but does not settle whether Qodo's own /improve-style suggestions are ever applied and committed directly, so neither true nor false is confirmed. Rebrand lineage: CodiumAI became Qodo; the open-source PR-Agent project (github.com/The-PR-Agent/pr-agent) that Qodo Merge grew from still exists as a separate community project and explicitly states it 'is not the Qodo free tier.'

Source: Qodo Merge product page

OpenQodex

[find only][Beta]

Qodex·self-hosted·static analysis plus a model·launched 2026-10-02

Open-source pre-push code review that runs from a CLI, a coding-agent integration or a GitHub Action. Built-in scanners run first with no model; then a separate reviewer process (Claude Code or Codex, on the user's own login) must raise or drop each scanner finding with a reason, and scripts check that every finding was answered. It reviews unpushed commits plus uncommitted work.

Surface: CLI (npx openqodex init, openqodex review), skill and plugins for Claude Code, Codex CLI, Cursor and Cline, MCP server for code-graph questions, git pre-push hook, GitHub Action, Node library
Engines: Reviewer is Claude Code or Codex using the user's own login; Cursor and Cline can start a review but cannot be the reviewer
Codebase context: Code graph built from the repository (framework plugins such as React and Express) and exposed through an MCP server; every changed line is put in front of the reviewer per the vendor page
Pricing: Free; a review uses your own Claude Code or Codex plan. The GitHub Action full review needs an Anthropic API key. Qodex sells a separate hosted per-developer product.
License: Apache-2.0 (per the GitHub API and product page). The product page says the optional Brakeman scanner is under the Brakeman Public Use License, which is not open source; it is not bundled and can be disabled in config.
Open source: yes

Benchmark signals

None published. The repo has a 'Benchmark data (not a product release)' pre-release (2026-10-11) holding run archives, but its release body contains no figures; the only numbers in release notes are code-graph build-time and cache-size notes, not review accuracy.

Launch date is the GitHub repo created_at (2026-10-02, via the GitHub API); the product page states no launch date. Maturity beta because the vendor says 'OpenQodex is on the way to 1.0' (releases at 0.12.0 by 2026-10-10). The repo has a benchmark folder and a benchmark data pre-release but no results were read, so no accuracy figure is recorded. The only numbers seen (code-graph build time, cache size) are vendor-stated performance notes, not review accuracy. Distinct from Qodo (formerly CodiumAI, a different company) and from the hosted Qodex PR review service; engine is a separate Claude Code or Codex process, so it is a consumer of harnesses with its own scanner-then-reviewer loop, not a prompt pack. It ships as a skill and plugins too, but the CLI runs its own pipeline (picks scanners, starts the reviewer, verifies the output).

Source: OpenQodex product page

Open Code Review (OCR)

[maturity unknown]

Alibaba Group·self-hosted·static analysis plus a model

An AI-powered code review CLI, originally Alibaba Group's internal AI code review assistant before being open-sourced. A deterministic pipeline handles file/diff selection, rule matching (a built-in multi-language ruleset covering issues such as NPE, thread-safety, XSS and SQL injection) and comment positioning, then an LLM agent reads full file contents, searches the codebase for context and inspects related files before generating structured, line-level review comments. A separate 'ocr scan' command runs the same engine across whole files rather than a diff, for auditing an unfamiliar codebase.

Surface: CLI (installed via 'npm install -g @alibaba-group/open-code-review', giving an 'ocr' command); the README's own CI/CD Integration section lists 'GitHub Actions, GitLab CI, GitFlic CI, and Gerrit integration'; badges also advertise integration alongside Claude Code, Codex, Cursor and Kimi Code as host coding agents
Engines: Per the repo's own tagline: 'OpenAI & Anthropic compatible'.
Pricing: Free and open source; installed via npm or binary releases. No vendor-hosted paid tier or SaaS offering was found on the pages read for this entry.
License: Apache-2.0
Open source: yes

Surfaced via a September 2026 GitHub-trending roundup (josedacruz.com, week of Sept 9-15 2026; an earlier search summary misattributed this find to a different digest, startupcorners.com, which on direct fetch did not actually contain it, this entry is sourced only to the josedacruz roundup and the repo itself), independently confirmed by reading the repo's own README (raw.githubusercontent.com/alibaba/open-code-review/main/README.md) rather than trusting the roundup alone. Quote is lightly punctuation-normalized (the README's em dash replaced with a comma) to satisfy this repo's no-em-dash copy rule while preserving the verbatim wording; the sentence itself describes the tool's two-year internal history at Alibaba, not its public open-source release date. An npm registry fetch for the first-publish date was inconclusive (only the latest version string, 1.12.9, came through; the time.created field did not render), so 'launched' and 'maturity' are left unset rather than guessed. The GitHub API confirms the repository's created_at is 2026-05-18 (pushed_at 2026-09-24, so still actively maintained), roughly four months before this lens's 2026-09-07 window, so treat this as a pre-window repo that only recently trended rather than a new-window launch; launched is still left unset since created_at may reflect when the repo went public rather than an announced product-launch date. Distinct within this catalogue's review-job rows: every other tracked review tool (CodeRabbit, Greptile, Qodo, Graphite AI Reviews, Bugbot, cubic, CodeAnt, Baz) is commercial SaaS or SaaS-plus-self-host; OCR would be the first free, fully self-hosted, Apache-2.0-licensed review CLI in the set. deepsec is this catalogue's closest open-source precedent, but its job is security, not review.

Source: GitHub: alibaba/open-code-review README

Security audit10

Copilot Autofix

[writes code][GA]

GitHub (Microsoft)·SaaS·static analysis plus a model·launched 2024-08-14

A code-scanning feature that turns CodeQL alerts into a suggested code fix: CodeQL finds the vulnerability deterministically, then an LLM is fed the alert data and surrounding code to draft a fix and an explanation for a developer to review and apply.

Surface: PR bot, CI
Pricing: no Copilot subscription required and it does not consume Copilot AI credits; free on public repositories, included for private/internal repos with a GitHub Code Security license
Open source: no

Distinct from the already-tracked Copilot harness (harnesses.csv row 16, the general-purpose IDE/CLI coding agent): Autofix is a narrow, fixed-job feature bound to CodeQL code-scanning alerts, not an open-ended coding agent you prompt with 'build me X'. It generates a single reviewable suggestion; it does not on its own open a pull request, so writesCode is true in the sense of producing a mergeable patch, but a human applies it. GitHub also has a newer 'agentic Autofix' variant in public preview that iterates with tests; that variant is not what is described here, only the GA classic Autofix. No quantified accuracy figure for classic Autofix was found on GitHub's own docs, so benchmarkSignals is omitted.

Source: GitHub Docs: About Copilot Autofix for code scanning

Corgea (BLAST)

[writes code][GA]

Corgea·SaaS·static analysis plus a model·launched 2025-04-02

An AppSec platform whose BLAST detection engine combines LLMs with AST-based analysis to find vulnerabilities, including business-logic flaws like broken auth and authorization gaps that pattern-based scanners miss, then generates and opens pull-request fixes for the developer to approve, across GitHub, GitLab, Azure DevOps and Bitbucket.

Surface: PR bot, CI
Codebase context: BLAST is described as tracing converging code routes to a shared weak point and mapping impact to vulnerable code and packages, i.e. cross-file/data-flow context rather than single-file analysis
Open source: no

Benchmark signals

Vendor-claimed only: Corgea's own blog post states traditional SAST tools have false-positive rates exceeding 20 percent, while BLAST keeps false positives below 5 percent. The previously cited '2x more true positives,' '3x less false positives,' and '+90% auto-fix accuracy' figures do not appear on the cited page and could not be confirmed, so they are replaced with the figures actually found on that page. No independent benchmark of Corgea was located.

This entry covers Corgea's codebase-scanning-and-fix product (BLAST/AI SAST). Corgea separately markets an 'AI Pentest' product for autonomous penetration testing of applications an organization already owns; that is a different fixed job (dynamic testing vs static codebase scanning) and is not what is scored here, though it would likely also be in-scope under the offensive-tooling test since it targets systems the customer owns rather than third parties. The engine description ('combines Large Language Models (LLMs) with AST-based security analysis, providing deep contextual (semantic) understanding of code') is a faithful paraphrase from the same source page, quoted separately from the definitional sentence above rather than joined with an ellipsis.

Source: Corgea: Introducing BLAST: The Future of Security Testing is Here

deepsec

[find only][GA]

Vercel·self-hosted·drives a coding agent·launched 2026-05-04

Open-source security review tool. Static analysis shortlists security-sensitive files, then coding-agent models investigate each one, tracing data flows and checking for mitigations, and the run emits ranked findings with severity ratings. Runs on your own machine with optional fanout to Vercel Sandboxes.

Surface: CLI (npx deepsec init), run locally, with optional remote execution on Vercel Sandboxes
Engines: Claude Opus 4.7 and GPT 5.5 through Vercel AI Gateway by default; bring your own key (OpenAI, Anthropic, or a custom HTTPS provider) with --model-auth direct, or use an existing Claude or Codex subscription
Codebase context: static analysis shortlists candidate files, then per-file agent investigation; runs on Vercel's own monorepos routinely scale past 1,000 concurrent sandboxes, and an interrupted run resumes without re-analysing finished files
Pricing: free and open source; you pay only for model usage, either through AI Gateway or your own key
License: Apache-2.0
Open source: yes

Benchmark signals

Vendor-claimed only: Vercel reports the false positive rate is 'roughly 10-20%' on its own monorepos. No independent benchmark of deepsec was located.

Vercel calls deepsec 'a security harness powered by coding agents', which collides with this repo's harnesses dataset, where harness means the coding agent itself. deepsec is a consumer of harnesses rather than a member of that set: it owns a fixed job (find vulnerabilities), drives coding agents as an engine, and never authors features. This entry is the case that motivated the topic.

Source: Vercel, Introducing deepsec

GitLab Duo Agentic SAST Vulnerability Resolution

[writes code][GA]

GitLab·self-hosted or SaaS·static analysis plus a model·launched 2026-02-19

A GitLab Duo agent feature that automatically analyzes SAST vulnerabilities after a scan completes on the main branch and generates a merge request with a context-aware code fix, using iterative, multi-shot reasoning across the codebase and a confidence score for each proposed solution, then runs the pipeline to validate that the fix resolves the finding.

Surface: Triggers automatically in the GitLab CI/CD pipeline after a SAST scan, or manually from the Vulnerability Report; opens a merge request
Pricing: Available on GitLab's Ultimate tier (Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated) per docs.gitlab.com; specific dollar pricing was not disclosed on the page read for this entry.

GitLab is the established DevSecOps platform vendor (deterministic SAST/SCA scanning already built in) that has shipped this LLM-agent remediation mode via GitLab Duo, matching the lens directly. Introduced as a beta feature in GitLab 18.9 (released 2026-02-19, the launched date recorded here); GitLab's own docs state it reached general availability in GitLab 18.11, but the exact calendar date of the 18.11 release was not independently confirmed for this entry. Available across GitLab.com (SaaS), GitLab Self-Managed and GitLab Dedicated per the docs page's own Offering metadata, hence deployment: both. A related 'Agentic Breaking Change Resolution' capability extends the same flow to dependency-update pipeline failures but is a separate feature not scored here. The docs page's own Tier metadata states this feature requires GitLab Ultimate; openSource status and the underlying model were not disclosed on the docs page read for this entry, so they are left unset (GitLab's core product is open-core, but that does not settle whether this specific Duo feature is available in any open/free tier).

Source: GitLab Docs: Agentic SAST Vulnerability Resolution

Pixeebot

[writes code][GA]

Pixee·SaaS·hybrid ensemble·launched 2023-08-31

A GitHub App that runs codemods against pull requests and existing codebases to remediate vulnerabilities and harden code. Deterministic AST-based codemods handle the majority of known patterns; for cases that don't map to a fixed rule (complex business logic, custom auth flows), its 'MagicMods' use an LLM to read surrounding code context and generate a fix in the codebase's own style, validated through a three-layer check before being proposed.

Surface: PR bot
Codebase context: MagicMods read call graphs, data flow, and framework conventions around the vulnerable code before generating a fix

openSource is intentionally omitted rather than set: the underlying codemodder transformation framework Pixeebot is built on is open source, but the Pixeebot GitHub App service itself is not, and the entity here is the service, not the framework. At its August 2023 launch, LLM-assisted codemods were described as a future capability; this entry documents the current (2026) state where MagicMods actively generate fixes per the cited 2026 post. No verbatim, Pixee-owned benchmark figure (merge rate, false-positive reduction) could be confirmed during this pass, so benchmarkSignals is omitted rather than repeating third-party aggregator numbers.

Source: Pixee: Java Vulnerability Remediation: From Scanner Alert to Merged Fix

Snyk Agent Fix

[writes code][GA]

Snyk·self-hosted or SaaS·static analysis plus a model·launched 2026-05-26

Snyk Code (deterministic/ML SAST) finds a vulnerability; Agent Fix then runs an agentic loop that prompts an LLM with dynamic few-shot examples from Snyk's own database of 35,000+ expert-written fixes, and if the generated fix fails a re-scan by Snyk Code, feeds the error back into the model and retries until a verified fix is produced. Formerly named DeepCode AI Fix.

Surface: IDE, PR bot
Codebase context: fixes are validated by re-running the deterministic Snyk Code scan against the generated patch before it is offered, with failed attempts fed back to the model for another try
Open source: no

Benchmark signals

Vendor-claimed only: Snyk's own blog post on Agent Fix's architecture reports Golden Test results of an 85.4% functional-and-secure fix rate for Opus 4.6 with Snyk Intelligence and 82.5% for Sonnet 4.6 with Snyk Intelligence. Snyk's docs separately state a median fix time under 8 seconds, with retries on large files taking up to 2 minutes. The previously cited 'industry-leading 80% accuracy' and 'average fix generation time of just 12 seconds' figures do not appear on the cited source page or in Snyk's docs and could not be confirmed, so they are replaced with the figures actually found. No independent benchmark of Agent Fix's accuracy was located.

Named precisely as Snyk names this specific generative-fix product, not the broader 'Snyk' or 'DeepCode AI' brand (DeepCode AI is the underlying symbolic/ML detection engine that predates the generative fixer and is a separate mechanism). In GitHub PRs, fixes are invoked with @Snyk /fix and applied with @Snyk /apply rather than opened automatically, so a human triggers and accepts the change.

Source: Snyk: New Agentic Architecture for Snyk Agent Fix

ZeroPath

[writes code][GA]

ZeroPath·SaaS·static analysis plus a model·launched 2024

An AI-native SAST product built to reason about code the way a pentester would: it combines LLM analysis with AST-based source-to-sink taint tracing to find vulnerability classes like business-logic flaws and auth bypasses that rule-based scanners miss, then opens ready-to-merge pull requests with the fix.

Surface: PR bot, CI
Open source: no

Benchmark signals

Vendor-claimed only: ZeroPath's blog describes a reachability-aware data-flow analysis that reduces false positives by accounting for sanitization functions, authentication checks and execution context. The previously cited '75% fewer false positives' figure does not appear on the cited page and could not be confirmed, so it is removed rather than repeated.

Y Combinator-backed (S24); founded 2024 by Raphael Karger, Etienne Lunetta and Dean Valentine. launched is left at year-precision because the founding year is well corroborated (YC batch, funding trackers) but no single precise public-launch date for the product itself (as opposed to the company) was confirmed on a vendor page during this pass.

Source: ZeroPath: How ZeroPath Works

Semgrep Assistant (Autofix)

[writes code][Beta]

Semgrep, Inc.·self-hosted or SaaS·static analysis plus a model·launched 2026-03-16

An AI layer on top of the Semgrep static-analysis engine: Semgrep's deterministic rules find a finding, then an LLM auto-triages true/false positives (with retrieval over the codebase and past triage decisions) and Autofix generates a proposed patch, which is checked by re-running the Semgrep engine against the generated code before being opened as a PR/MR.

Surface: CI, PR bot, CLI
Codebase context: Autofix's self-evaluation loop runs the generated fix back through the Semgrep engine to confirm the original finding is resolved before surfacing it
Open source: no

Benchmark signals

Vendor-claimed only: Semgrep states Autofix is 'deprioritizing more than 95% of false positives' and cites a '+95% agreement rate' for AI-assisted triage against its own security researchers. No independent benchmark of Autofix was located.

Entered under Semgrep's own product name rather than a generic 'Semgrep' entry. The underlying open-source Semgrep CLI/rule engine is self-hostable (Apache-2.0), but Assistant/Autofix itself is a hosted AppSec-platform feature layered on top of it, so openSource is marked false for this specific capability. Autofix was previously announced as public beta by Semgrep in March 2026; per Semgrep's own release notes for the week of 2026-08-31, 'Autofix is now enabled for all customers,' though it 'remains opt-in for each finding: it runs only when you request a fix from the finding Details page or through the API.' No Semgrep page found in this pass explicitly relabels the capability as general availability, so maturity is deliberately left at beta rather than flipped to ga; the separate auto-triage capability has been live longer.

Source: Semgrep: Accelerate and Automate Remediation with Semgrep Autofix

Checkmarx Triage and Remediation Assist

[writes code][maturity unknown]

Checkmarx·SaaS·static analysis plus a model

A Checkmarx One capability that autonomously triages the existing vulnerability backlog, using AI reasoning together with reachability, exploitability, policy and Checkmarx One context to classify and prioritize findings, then generates review-ready fix suggestions and, for supported GitHub repositories, opens remediation pull requests directly.

Surface: Checkmarx One dashboard; PR-native remediation is currently available for GitHub pull requests specifically, per checkmarx.com/product/triage-and-remediation/, which lists 'GitHub, GitLab, Azure DevOps, and Bitbucket integrations' but notes PR-native features are available for GitHub; the other three are Checkmarx One repository integrations more broadly, not confirmed as PR-native for this specific capability.
Codebase context: Operates on findings already generated within the Checkmarx One platform (i.e. triages an existing scan backlog rather than scanning fresh code itself)

Re-scoped from an earlier draft of this entry that targeted 'Checkmarx Developer Assist' (a hooks/MCP integration that runs inside a developer's own third-party AI coding tool, e.g. Cursor or Claude Code, which sits closer to this topic's excluded shapes: 'a config injected into someone else's agent' / 'a component you compose into your own agent'). This entry instead targets Triage and Remediation Assist, which owns its own fixed job (clear an existing vulnerability backlog) end to end inside Checkmarx's own platform and, for GitHub repos, opens its own pull requests, a clean fit for the own-orchestration-loop test. Checkmarx is the classic SAST/AppSec vendor shipping this LLM-agent mode, matching the lens. Checkmarx separately announced this capability (alongside sibling products Developer Assist and a broader 'self-healing' framing) in a 2026-07-13 press release ('Triage and Remediation agents autonomously prioritize what's already in the codebase and generate merge-ready fixes'), but the product page itself carries no launch date, and it is unclear whether the product page describes a pre-existing feature or the same July 2026 launch, so launched/maturity are left unset rather than assumed. openSource, license and pricingModel were not confirmed on the page read for this entry.

Source: Checkmarx: AI-Assisted Vulnerability Triage & Remediation

Cursor Security Reviewer

[maturity unknown]

Anysphere (Cursor)·hybrid ensemble·launched 2026-04-30

A security review agent that runs on every pull request, reads the change in the context of the whole codebase, and reports vulnerabilities with an explanation and a proposed fix. Part of Cursor's separately named 'Cursor Security Review' product line (alongside a companion Vulnerability Scanner agent), distinct from the tracked Bugbot PR-review product.

Surface: pull request review
Pricing: Available on Cursor Teams and Enterprise plans; first announced in beta on 2026-04-30 (cursor.com/changelog/04-30-26) and presented again on 2026-09-23 alongside a new 'Rollouts' feature (cursor.com/blog/rollouts-and-security-reviewer). Whether it is included at no additional cost beyond the plan price or billed separately was not confirmed on any page read for this entry.

Benchmark signals

Vendor-claimed (Cursor's 2026-09-23 blog post, cursor.com/blog/rollouts-and-security-reviewer): reduced average review time from 4.8 to 3.8 minutes and increased comment acceptance from 45-50% to 60-70%; no baseline period, comparison group or sample size is stated on the page. No independent benchmark found.

Routed by the status lens (surfaced while checking cursor-bugbot) rather than found by a launch lens. First announced in beta on 2026-04-30 per cursor.com/changelog/04-30-26 ('Cursor Security Review is now in beta on Teams and Enterprise plans. You can run two types of always-on security agents: Security Reviewer and Vulnerability Scanner'); the 2026-09-23 post ('Today we're releasing software development bots...') presents Security Reviewer again alongside the new Rollouts feature without a clear beta-to-GA statement, so maturity is left unset and launched is set to the earlier confirmed date. Distinct from the tracked cursor-bugbot row: Cursor Security Review is a separately named, separately docs-paged product line (cursor.com/docs/security-agents) scoped to security vulnerabilities, auth regressions, privacy/data-handling risks, agent tool auto-approvals and prompt injection; no page read for this entry states that Bugbot is scoped to 'style and quality' (that characterization in the original candidate is unconfirmed and dropped), and Bugbot's own tracked entry scopes it to logic bugs. Cursor's own docs (cursor.com/docs/security-agents) state only that Security Reviewer and Vulnerability Scanner 'run on the Automations platform and require Cloud Agents'; no page read for this entry names the underlying model(s) or vendor(s), so engineModel is left unset rather than asserted. Deployment is also left unset: the only infrastructure statement found ('You can use Cursor's cloud with no additional setup') does not clearly rule out an alternate or self-hosted path, so asserting saas would overstate the sourcing. engineModel set to 'hybrid' (an ensemble the vendor does not decompose) by the orchestrator on 2026-09-25: no page read states the model behind it, and Cursor's security-agents docs say only that the agents 'run on the Automations platform and require Cloud Agents'. Same value as the sibling cursor-bugbot row.

Source: Cursor blog: Rollouts and Security Reviewer

Test generation4

Diffblue Testing Agent

[writes code][maturity unknown]

Diffblue·drives a coding agent·launched 2026-03-24

An autonomous regression-test generator from Diffblue that works alongside an enterprise's existing AI coding platform: it handles coverage analysis, build-system configuration, test-plan creation and parallelized test generation, delegates method- and class-level test authoring to the underlying AI coding agent, then verifies the output and prepares a pull request.

Surface: CLI (`diffblue-agents run regression-unit-tests`, `diffblue-agents license activate`, `diffblue-agents install`), delegating test authoring to a locally authenticated third-party AI coding agent (Claude Code or GitHub Copilot)
Engines: Integrates with GitHub Copilot and Claude Code, with additional AI coding platform support planned based on customer demand, per Diffblue's own announcement (as reprinted by its investor)

docs.diffblue.com (Quickstart, Regression unit test generation workflow, and CLI reference pages) independently corroborates the IP Group-reprinted announcement on a first-party Diffblue page: the Quickstart page's setup instructions name both Claude and GitHub Copilot as the two supported coding-agent tabs to authenticate before running the agent, and the workflow page states the tool 'Delegates test writing to your AI coding agent platform' via a 'supported AI coding agent platform' prerequisite, matching the reprinted claim that the product integrates with GitHub Copilot and Claude Code with more platforms planned. Direct WebFetch of diffblue.com and www.diffblue.com/agents/ still only rendered page titles (likely a client-side-rendered marketing site), so the quote and source remain pointed at the IP Group reprint of Diffblue's own announcement rather than a marketing page, but the mechanism is now confirmed independently via Diffblue's own docs subdomain. Distinct from Diffblue's flagship Cover product (a deterministic, reinforcement-learning test generator, not LLM-driven): the Testing Agent is a new orchestration layer that drives an external LLM coding agent (Copilot or Claude Code) to author test bodies while Diffblue's own logic handles coverage analysis, build configuration and verification, clearing this topic's engine-model test. First publicly announced 2026-03-24 per the IP Group reprint, which states 'Diffblue's Testing Agent is available immediately for enterprise evaluation'; no page read for this entry used the exact phrase 'general availability' or 'generally available,' so maturity is deliberately left unset rather than asserted as ga. Well before the 2026-09-07 window; in scope and now adequately sourced as a pre-window vendor gap-fill.

Source: IP Group: New Diffblue Testing Agent Automatically Generates Comprehensive Regression Test Suites To Derisk Application Modernization

Keploy Unit Test Generator (UTG)

[writes code][maturity unknown]

Keploy Inc.·self-hosted or SaaS·static analysis plus a model

A component of the open-source Keploy platform that reads pull-request diffs and code semantics, uses LLMs to write unit tests with mocked dependencies and edge cases, then validates that each test builds, runs and passes before suggesting it.

Surface: CLI, CI (PR comments), IDE (VS Code extension)
Open source: yes

Scoped deliberately to Keploy's Unit Test Generator sub-feature, which is genuinely LLM-driven. Keploy's flagship capability (eBPF-based production-traffic capture for API/integration test generation) is a deterministic recording mechanism and would fail the LLM-engine filter on its own; this entry covers only the LLM-driven UTG piece, per the task's instruction to scope narrowly.

Source: Keploy Docs: Unit Test Generator

Momentic

[writes code][maturity unknown]

Momentic·SaaS·own model

A testing platform whose autonomous agent explores a web/mobile app to discover critical user flows, writes end-to-end tests from natural-language intent, and keeps them passing via self-healing, intent-based locators as the UI changes.

Surface: web (dashboard), CI
Pricing: freemium (free to start; enterprise via contact sales), with a credit-based pay-as-you-go option: per Momentic's own changelog, pay-as-you-go plans can set a Monthly spend limit under Settings > Billing, and 'new tests and other credit-consuming work pause once your reported spend for the billing cycle reaches the limit, and an email alert goes out at the percentage you choose.'

Fixed job: maintains a regression test suite for a given app. The agent interprets each test's intent fresh at runtime (an LLM-in-the-loop, not a driven external coding-agent binary), which is what makes the self-healing locators work, so it clears the LLM-engine filter distinctly from Meticulous (checked and rejected this round, deterministic session record/replay despite 'AI engine' marketing copy).

Source: Momentic homepage

TestSprite

[writes code][maturity unknown]

TestSprite·SaaS·own model

An autonomous testing agent that plans, generates and executes UI, API and end-to-end tests in its own cloud sandboxes, self-repairs flaky steps, and feeds structured bug reports and fix suggestions back to a coding agent or developer.

Surface: CI, IDE (MCP server into Cursor, Windsurf, Claude Code, VS Code), web

Checked specifically for filter 3 (own orchestration loop vs. MCP-tool-only): the plan/generate/execute/self-repair loop runs in TestSprite's own cloud sandbox; the MCP server and IDE integrations are additional entry points into that same backend loop rather than the loop itself, so it clears the bar rather than being merely a prompt pack injected into a host agent.

Source: TestSprite: Autonomous Software Testing

Migration and refactor3

AWS Transform

[writes code][maturity unknown]

AWS (Amazon Web Services)·SaaS·own model

A collaborative enterprise workbench where purpose-built AI agents run mainframe, VMware, Windows/.NET, and custom application migrations end to end, including language/framework version upgrades and SDK migrations.

Surface: web (workbench dashboard)

Benchmark signals

Vendor-claimed: AWS states .NET modernization through AWS Transform can reduce 'operating costs by up to 70%' by moving off legacy licenses; no independent verification located for this figure.

Distinct from Amazon Q Developer's built-in /transform Java-upgrade command, which AWS is winding down (per AWS's own end-of-support notice, Java upgrades delivered through the Q Developer IDE plugins lose support after 2027-04-30). AWS Transform is a separately branded, standalone workbench, not a feature bolted onto the Q Developer coding-agent harness. maturity is deliberately omitted: the fetched product page states some capabilities (e.g. continuous modernization) are still 'Preview' and gives no single overall GA date, so a blanket 'ga' would overstate what the source supports. Correction for the orchestrator: Amazon Q Developer itself is not currently a row in harnesses.csv (only Kiro, also AWS, is tracked there), contrary to the task brief's assumption.

Source: AWS Transform product page

Codemod (Codemod AI / Codemod2.0)

[writes code][maturity unknown]

Codemod, Inc.·self-hosted or SaaS·hybrid ensemble

A code-migration platform whose Codemod AI engine drafts a codemod with an LLM, iteratively repairs it against compiler, codemod-runner and diff feedback until it is verified correct, then runs the transformation as an orchestrated 'Migration Campaign' across any number of repositories.

Surface: CLI (npx codemod ai), CI

Distinct from Moderne/OpenRewrite (checked and rejected this round: AI there only helps author recipes for a deterministic execution engine). Here the LLM performs the actual code transformation step, gated by deterministic compiler/runner checks, and Migration Campaigns is the product's own multi-repo orchestration layer, not a prompt pack injected into someone else's harness.

Source: Codemod blog: Codemod AI iterative system

Morph (Modelcode)

[writes code][maturity unknown]

Modelcode AI, Inc.·self-hosted or SaaS·hybrid ensemble

Per Modelcode's own blog: 'Modelcode's Morph is an enterprise code modernization platform.' The same post describes the mechanism: the platform connects to a customer's repository, analyzes the codebase, and produces a Project Spec for language upgrades, framework migrations or architecture modernization that a human approves before any code is generated; execution then ships as milestone pull requests, each checked by automated code review and by functional tests comparing the migrated application's behavior against the original, increment by increment.

Surface: Web dashboard, connecting to a GitHub repository (docs.modelcode.ai describes a 'Standard GitHub workflow'); a self-hosted 'ModelDaemon' build agent runs checkout, install, build, test and application runs on the customer's own infrastructure with outbound-only connections
Codebase context: Per Modelcode's own blog (blog.modelcode.ai): the platform connects to a repository, analyzes the codebase, and produces a Project Spec a human approves before any code is generated; execution then ships in milestones, each a pull request through normal review, with functional tests comparing the migrated application's behavior against the original, increment by increment.
Pricing: Usage-based credits rather than per-seat: the vendor's homepage states plans include 40,000 credits monthly at $0.01 per additional credit, and describes the model as '$0 per seat' regardless of project count or lines of code.

Distinct from the already-tracked aws-transform (AWS-specific mainframe/VMware/.NET migrations inside AWS's own workbench) and codemod-ai (an LLM drafts and iteratively repairs codemods itself, gated by compiler/runner checks). Morph instead owns the program-level loop, spec approval, milestone PRs, automated review and behavioral verification, while an unspecified 'coding agent' layer executes the code-writing step; docs.modelcode.ai was fetched directly and did not confirm whether that engine is Modelcode's own model or a customer-supplied one (Claude/Codex), so pluggableEngines is left unset and engineModel is recorded as hybrid rather than drives-coding-agent or own-model. A search summary (not a primary page read directly) separately described support for GitLab and Azure DevOps repositories beyond GitHub; that claim is not repeated here because docs.modelcode.ai's own workflow description names only GitHub. No precise public launch date and no explicit GA/beta status word were confirmed on any page read for this entry (site copyright reads (c) 2026 Modelcode.ai, Inc.), so both launched and maturity are left unset. This candidate surfaced via a general migration-agent search rather than a dated Show HN/Product Hunt/changelog post, so its actual launch could predate this lens's 2026-09-07 window; flagged for the orchestrator to weigh against the 'launches' lens's window intent. www.modelcode.ai (with the www subdomain) returned a TLS certificate mismatch error during this research pass; the bare https://modelcode.ai domain used as the source resolved correctly.

Source: Modelcode: Morph homepage

Documentation3

DeepWiki

[find only][GA]

Cognition·SaaS·hybrid ensemble·launched 2025-05

A tool from Cognition (maker of the Devin coding agent) that turns any GitHub repository into an interactive, wiki-style documentation site: swap github.com for deepwiki.com in a repo URL and it indexes the repo, builds a navigable table of contents with architecture diagrams and cross-referenced module pages, and adds a conversational Q&A interface grounded in the source, built on what Cognition calls Devin Wiki and Devin Search.

Surface: Web (deepwiki.com URL substitution), plus an official DeepWiki MCP server (mcp.deepwiki.com) exposing read_wiki_structure, read_wiki_contents and ask_question tools for use inside Claude Desktop, Cursor and similar clients
Pricing: Free for public repositories; indexing a private repository requires signing up for a Devin account rather than a separate DeepWiki price

Distinct from Devin itself (the general coding agent, out of scope as a harness) and from the DeepWiki MCP server considered alone (that would be an infrastructure building block): this entry is the wiki-generation product, which owns the fixed job of producing and updating documentation from an existing codebase. Launch is dated to month precision only: Cognition's own announcement page carries an ambiguous dateline ('05.05.25') while other secondary blogs cite late April 2025, so the exact day is not treated as sourced.

Source: Cognition: DeepWiki announcement

Komment

[GA]

Komment·self-hosted or SaaS·own model

A documentation engine that connects to a GitHub, GitLab or Bitbucket repository across 90+ languages and generates a full documentation site (usage instructions, API docs, architecture diagrams, in-code comments, security insights), then automatically re-documents the software whenever it detects the code and docs have diverged.

Surface: Connects to GitHub, GitLab and Bitbucket; publishes into Confluence, Notion, ReadMe, Slack and VS Code; SaaS dashboard at app.komment.ai or self-hosted
Codebase context: Per Komment's own site, the platform 'automatically re-documents your software when it detects divergence between code and docs' after connecting to the repository.
Pricing: Freemium: free forever for unlimited public repositories with no credit card required; paid Build/Grow/Scale tiers (private-repo limits, automatic updates, access control, custom scheduling) with amounts not disclosed on the pricing page fetched for this entry

Komment's own marketing explicitly distances the product from being a wrapper on 'generic language models' ('Komment is more than just AI'), so engineModel is recorded as own-model based on the vendor's own description rather than a confirmed model architecture; no independent technical teardown was located. Deployment self-host option is documented as VPC deployment via AWS, Azure or GCP. This is the weakest of the four candidates: a validator may reasonably bounce it on the LLM/agent-engine test since the vendor actively disclaims being 'just AI' and no third party confirms the mechanism.

Source: Komment homepage

Mintlify Agent

[find only][GA]

Mintlify·SaaS·hybrid ensemble

An AI agent inside the Mintlify docs platform that clones a customer's specified code repositories for context, watches for merged pull requests (or runs on a schedule), reads the diff to identify documentation that is now out of date, drafts the update, and either opens a pull request or pushes the change directly to the docs deployment branch.

Surface: Mintlify dashboard (Products -> Agent) for configuring automations; also reachable from Slack per Mintlify's own engineering blog
Codebase context: Per Mintlify's own blog, on each automation run 'the agent clones any specified repositories as context, follows the prompt, and either opens a pull request or pushes changes directly to your deployment branch' (paraphrase of the cited post; not copied verbatim from the docs page).
Pricing: Gated behind a paid tier: Mintlify's own pricing page lists Agent and Automations as included starting at the Pro plan and above, and explicitly not included on the free Starter plan; the page did not render a reliable dollar figure to cite.

Distinct from the older, free, open-source Mintlify Doc Writer (github.com/mintlify/writer, a highlight-and-generate IDE completion feature with no standing loop): this entry is specifically the newer Agent/Automations feature, which owns a fixed job (keep docs in sync with a monitored codebase) via its own trigger-clone-diff-draft-PR loop rather than a per-keystroke completion.

Source: Mintlify docs: What is the agent?

Dependency upkeep1

Infield

[GA]

Infield AI, Inc.·SaaS·hybrid ensemble

A managed dependency-upgrade service: it connects to a repo (GitHub app or CLI), builds a living upgrade plan across direct and indirect dependencies weighted by risk and effort, uses LLMs to read changelogs and flag updates likely to cause issues, and combines that with a team of expert developers to remediate breaking changes and ship upgrades, positioned explicitly against scanners like Dependabot that only flag issues rather than fixing them.

Surface: GitHub app, CLI

Distinct from Renovate and Dependabot (deterministic version bumpers, not tracked in this catalogue) because Infield names LLMs specifically as the mechanism doing changelog risk analysis, on top of which a team of expert developers (not a fully autonomous coding agent) remediates breaking changes; per Infield's own site, 'Infield combines automation with a team of expert developers to upgrade open source software safely.' writesCode is true because the service explicitly remediates breaking changes and ships upgrades, though the press release does not specify whether the AI or a human developer authors the final diff in every case.

Source: PR Newswire: Infield announces $3M funding to use AI to manage open-source dependency updates

Mixed4

CodeAnt AI

[GA]

CodeAnt AI·static analysis plus a model

Platform that bundles AI-driven pull-request review (line-by-line comments, auto-suggested fixes, AI PR summaries) with static analysis products (SAST, secrets detection, IaC misconfiguration scanning, SCA) and, more recently, agentic pentesting, as co-equal lines rather than review being the sole product.

Surface: PR bot (GitHub, GitLab, Bitbucket, Azure DevOps), IDE, CLI, cloud dashboard
Pricing: offers a free tier for open-source projects ('100% off for open source') and a 14-day free trial with no credit card required; tiered pricing for private repositories is on a separate pricing page not fully read for this entry

Benchmark signals

Listed among the tools evaluated in Martian's independent Code Review Bench per Martian's own description of its tool set. CodeAnt has also published its own blog post summarizing that benchmark ('Best AI Code Review Tools in 2026, Ranked by a 300,000-PR Benchmark'), but no CodeAnt-specific F1/precision/recall figure from Martian's own page was confirmed for this entry, so no score is recorded here.

Marked job: mixed (rather than review) because, unlike CodeRabbit's narrower 'agentic code-security monitoring' add-on, CodeAnt's own homepage positions AI Code Review, Code Security, Code Quality and AI Pentesting as separate, co-equal product lines under one platform. Founded 2023 per Y Combinator and press coverage (secondary-sourced); deployment and writesCode are omitted here because no page read for this entry confirmed them (a self-hosting FAQ question was found but not its answer, and only 'auto-suggested fixes,' not automatic commits, was confirmed).

Source: CodeAnt AI docs, Introduction

CodeRabbit

[writes code][GA]

CodeRabbit Inc.·self-hosted or SaaS·hybrid ensemble

Hosted AI code-review service that reviews pull requests line by line, triages and prioritises them, and adds what it calls agentic code-security monitoring. It comments on the PR and can also commit a fix.

Surface: GitHub and GitLab pull-request bot, IDE reviews, CLI reviews, web dashboard, and Slack
Pricing: Paid tiers Essentials, Team and Advanced (annual-billing list prices of $24, $48 and $72 per user per month on the pricing page; monthly billing listed at $30 for Essentials and $60 for Team in the FAQ) with a 14-day trial, custom Enterprise pricing, and free reviews for public repositories; self-hosting is listed as available on the Enterprise plan only
Open source: no

Benchmark signals

Martian's Code Review Bench (codereview.withmartian.com) is a real, independently run benchmark built by a research lab that does not sell a code review product; it launched 2026-02-26. Martian's own primary post describes the dataset as '200K+ PRs and updates daily', a live, continuously updated leaderboard rather than a fixed one-time count, and states that CodeRabbit has the highest recall in the benchmark's online data, at 0.54. CodeRabbit's own recap of its placement on that leaderboard states it evaluated 10 tools and reports an F1 score of 51.2% and a precision of 49.2%. Other vendors, including Qodo, cubic and Greptile, have separately claimed the top spot on other dates with different scores, so any single tool's ranking should be read as a dated snapshot of a moving leaderboard rather than a fixed, final result. Treat exact tool-count and PR-count figures as best checked live at codereview.withmartian.com rather than as fixed published numbers. Separately, vendor-claimed (CodeRabbit blog, 2026-10-06, an 'internal comparative development slice' of 100 vulnerabilities across 94 public repositories; the post says it is not an independently run public benchmark, the models may have seen the public repositories in training, and it scores detection only, not fix quality): CodeRabbit Security detected 86.7% versus Devin 73.3%, Codex Security Plugin 62.0% and Claude Security 40.0%. No independent verification located.

Seeded as the contrasting shape to deepsec: a hosted SaaS pull-request bot that commits fixes, against a self-hosted find-only CLI. Its engine is described only as an 'Ensemble of models & tools', and whether a customer model can be supplied is not stated, so pluggableEngines, codebaseContext, license and launched are left unset rather than assumed.

Source: CodeRabbit product site

DeepSource (Autofix)

[writes code][GA]

DeepSource·SaaS·static analysis plus a model

An AI code-review platform combining over 5,000 deterministic rules with an AI review agent to find issues including security vulnerabilities across a codebase, paired with Autofix, which generates pre-validated, mergeable patches for most identified issues rather than free-text suggestions.

Surface: PR bot, CI
Open source: no

Benchmark signals

DeepSource states it scored 84.51% F1 on the OpenSSF CVE Benchmark, run on 165 real CVEs from the OpenSSF dataset, and reports this as the highest of the tools it tested. This benchmark was run by DeepSource itself (using an LLM, Claude Opus 4.5, as its own judge) rather than published by OpenSSF or another independent third party, so despite drawing on OpenSSF's CVE dataset it should be treated as vendor-run rather than fully independent verification.

Categorized job as 'mixed' (like the already-tracked CodeRabbit) rather than 'security' because DeepSource markets itself first as a general AI code-review platform ('DeepSource automates code reviews') with security scanning and Autofix as one part of that, not a security-first tool. This is the tool the task brief itself named as the source of the 84.51 F1 claim; that figure is confirmed on DeepSource's own benchmarks page, and this entry reports it as vendor-run rather than repeating it as an independent result. No launched date was confirmed on a vendor page, so it is omitted. Quote lightly punctuation-normalized (em dash replaced with a comma) to satisfy this repo's no-em-dash copy rule while preserving the verbatim wording.

Source: DeepSource: Benchmarks

SonarQube Remediation Agent

[writes code][GA]

SonarSource (Sonar)·self-hosted·static analysis plus a model·launched 2026-10-01

Agent on SonarQube Server that takes issues raised by Sonar's own analysis, generates a fix with an LLM, applies it in a sandbox, re-runs the same Sonar analysis on the result, discards fixes that do not clear the issue or introduce a new one, and opens pull requests for the survivors for human approval. Runs on demand (assign selected issues) or on a daily or weekly schedule with a cap on pull requests per run.

Surface: SonarQube Server UI triggers remediation; output is pull requests on GitHub, GitLab or Azure DevOps
Engines: Customer-chosen model endpoint: AWS Bedrock, Azure AI Foundry, native Anthropic and OpenAI keys, and custom gateways (per Sonar's post). No specific model is named.
Codebase context: Fixes are checked by re-running the same analysis that raised the issue. Per Sonar, verification does not run the customer's test suite. Supports C#, Java, JavaScript/TypeScript and Python.
Pricing: Billed on suggestions consumption; available on SonarQube Server Enterprise and Data Center editions
Open source: no

Benchmark signals

None published in the announcement post.

Qualifies as agent-driven (hybrid, not a summariser): the LLM authors the fix and a generate, sandbox-apply, re-analyse, discard-or-PR loop wraps it. Distinct from snyk-agent-fix and semgrep-assistant (other vendors) and from github-copilot-autofix (GitHub-hosted, CodeQL alerts). Date taken from the post as read via page extraction; launch labelled ga because the post says 'now available' but a GA label is not explicitly quoted. Limitation per post: dependency (SCA) remediation is Cloud only, not yet on Server. The same-week Sonar Vortex product was checked and rejected as not_agent_driven.

Source: SonarSource blog: The SonarQube Remediation Agent is now available on SonarQube Server

Agentic Developer Tools

Snapshot

2026-10-12

Coverage

34tools·7jobs covered·2drive coding agents·15self-hostable

Download