Deepsec is an open-source security-focused coding agent harness developed by Vercel Labs. It is designed to orchestrate LLM-driven security audits, vulnerability discovery, and automated remediation across codebases, operating directly from terminal workflows and automated environments. Deepsec functions by scanning project repositories, identifying potential security weaknesses using configured LLMs and dedicated prompt samples, and testing against known vulnerability patterns. It integrates with workspace authentication (such as workspace OIDC) and executes targeted analysis against local or remote codebases using structured skills and agent prompts. Unlike general-purpose coding agents that focus broadly on feature implementation and refactoring, Deepsec specializes in security verification and vulnerability probing. Its architecture includes structured skill definitions (such as SKILL.md and CLAUDE.md configurations), fixture testing suites, and dedicated sample evaluation pipelines tailored for security auditing. Deepsec is distributed as an open-source TypeScript monorepo under the Vercel Labs GitHub organization. It requires developers to supply their own LLM API credentials or workspace tokens to orchestrate security inspection runs.
Specialized security auditing harness — Orchestrates AI agent workflows focused on discovering, analyzing, and patching code vulnerabilities. - Skill-based agent configuration — Defines modular agent capabilities and operational boundaries using structured definition files like SKILL.md. - Workspace OIDC integration — Supports authenticated enterprise runs and subscription routing with workspace-level OIDC credentials. - Monorepo architecture — Organizes core scanning, execution packages, and CLI utilities within a modular TypeScript package ecosystem. - Fixture and prompt test suites — Includes built-in vulnerable application fixtures and prompt sample validation for consistent security benchmark evaluations.
Use cases
Use Case: Automated Security Auditing A security engineer runs Deepsec against a pull request or local repository to detect insecure coding patterns, unvalidated inputs, or authorization bypasses before merging code into staging.
Use Case: Agent-Driven Vulnerability Remediation A developer uses Deepsec to inspect flagged vulnerabilities in application dependencies or custom logic and generate verified code patches directly within the repository.
Use Case: Benchmark Testing for Security Prompts A team testing custom LLM security prompts uses Deepsec's included fixture test applications and prompt samples to evaluate how reliably different models identify and resolve security exploits.
Who it is for
Deepsec is designed for DevSecOps engineers, security researchers, and software developers who need automated, LLM-powered security assessments and patch generation within their terminal workflows. It is less suited for developers seeking a general-purpose interactive IDE assistant for everyday feature coding.
Install guide
Installation Deepsec is maintained as a monorepo. Clone the repository and install dependencies using pnpm (inferred standard for Vercel Labs TypeScript projects): bash git clone https://github.com/vercel-labs/deepsec.git cd deepsec pnpm install pnpm build
First Run Configure your environment variables by copying the provided template and supplying required model and authentication keys: bash cp .env.example .env # Edit .env with your required API credentials and workspace tokens
Example Session Run an analysis pass against the bundled test fixtures or your local project: bash pnpm start --fixtures/vulnerable-app
SWE-agent — SWE-agent is an open-source autonomous software engineering agent harness built and maintained by researchers from Princeton University and Stanford University.…
Kiro — Kiro is an agentic engineering platform and CLI coding agent built and operated by AWS. It extends beyond standard code-completion…
Amp — Amp (developed by AmpCode) is an autonomous coding agent platform and remote development harness designed to execute software engineering tasks…
Weaver — Weaver is an open-source agent harness and orchestration framework maintained by sean35mm on GitHub. Built on top of the Bun…
Ona — Ona (formerly Gitpod's agentic platform, now part of OpenAI) is an enterprise-grade cloud agent orchestration platform that manages and runs…
Conductor — Conductor is a multi-agent orchestration harness developed by Melty Labs. It is designed to manage, coordinate, and execute parallel coding…