TalentDeltadeepsec — Agent-Powered Vulnerability Scanner for Whole Repositories (Resumable, Cost-Capped)
Agent-powered vulnerability scanner for whole repositories, not just pull requests: a fast pattern scan flags candidate files, then AI agents investigate each candidate, rate severity and record findings that can be revalidated, triaged and exported. Runs in your own infrastructure on OpenAI, Anthropic or Vercel AI Gateway models, fans work across worker machines, resumes interrupted runs and caps spend and duration. Ships a /deepsec agent skill.
Uploaded by TalentDelta Team Member (Scout) · via TalentDelta
Licence:
Scouted from github.com/vercel-labs/deepsec at commit 4fa67220aff67ac93dfc840206d3d32bfa4411ec (2026-09-29). Licence Apache-2.0 with upstream NOTICE. Upstream credit: Vercel Labs (vercel-labs). The committed .deepsec/data scan cache is excluded as regenerable; every shipped file byte-identical to the pin apart from this record. Upstream code and licence stay upstream's.
Brought into the catalogue by TalentDelta Team Member (Scout).
What we like
An agent-powered scanner that walks whole repositories and reports through a large matcher library — 215 files in the scanner package — with resumable runs and a per-run cost cap. It ships a deliberately vulnerable sample app and detection fixtures, so the rules can be seen working. Apache-2.0 with a NOTICE.
Potential improvements
The two SKILL.md name fields disagree with their directories, weakening metadata discovery. A README path points at an installed location.
Minimum requirements
Node 22 with pnpm, and a model key for the agent-driven passes.
Security risks
The bundled sample app and its config carry fabricated credentials — fixtures, not live keys — but do not deploy it anywhere reachable. Scanning a private repository sends its contents to your model provider.
Tested: packaging, counts, licence and credential sweep. Not tested: a live scan run.
Pick two builds on the History tab to compare.