DeepSource

You will notice the difference between a comment and a correction. Most reviewers tell you what is wrong; this one applies the change, so the gap between finding a problem and closing it collapses to an approval. That is the deciding daily trait, because the reason review debt accumulates is not ignorance of the issues, it is the twenty minutes each one costs to fix.

Pick it if you want one tool covering review, security and coverage. Pick Codacy when you would rather catch things in the editor before they ever reach a branch.

Writing to the branch is a different level of trust from commenting on it. A comment that is wrong costs a reviewer thirty seconds; a commit that is wrong enters history, passes whatever gates the branch already satisfied, and is reviewed by a human who now assumes the automated part was the safe part. Anti-pattern corrections are the risky category, because they change behaviour under the description of style.

What it does right: thousands of deterministic rules produce most of the findings, so the majority of what this tool says is reproducible rather than generated.

1. The pipeline layers rule-based analysis, security scanning, infrastructure checks and secret detection beneath a model that comments on top, which is a sensible ordering because the cheap deterministic passes run first. 2. Findings are exposed over a tool-server interface so another agent can consume them, making this a context source rather than only a reviewer. 3. Nothing verifies the model's output before it becomes a suggested change.

No evaluation set, no false-positive rate and no benchmark are published. The observation: the deterministic half would make an excellent control group, and the vendor has not used it as one.

Two revenue lines with different growth curves is the right structure. The seat price is predictable revenue that funds the deterministic engine, and the metered review line grows with code volume, which grows on its own. Reserving customer-supplied inference and on-premises processing for the top tier is the classic move: give the compliance-driven buyer exactly one place to go.

Likely acquirer: a code host or a security platform wanting an established rules engine with a model layer already attached. Position: solid business, defensible asset, and pricing power concentrated in the metered half.

One sentence on the demo: it fixed three things while I watched. The problem is forecasting. The seat line is $1,440 a month and predictable; the review line is charged against processed volume, and the included annual credit is small enough that it functions as a trial rather than an allowance, so a busy quarter and a quiet one produce very different invoices. It runs on every pull request, which suits our pipeline.

Onboarding is a configuration file per repository. Approved with conditions: a hard cap on the metered line.

The capability I want is here and I am not allowed to have it. Supplying my own provider credentials and running the model layer inside my own network is exactly right, and it is reserved for the tier with no published price, so the honest description is that self-hosted inference is a negotiating chip rather than a feature.

What I do get is a tool-server endpoint and a documented interface, so my own agents can read the findings. That is programmable output from an unprogrammable producer. The analysers stay closed, the models stay theirs, and nothing runs on my hardware without a contract.