Sourcery

Sourcery's pitch is consolidation, and the product backs it up on paper. One install gives you inline review comments, PR summaries with Mermaid diagrams, one-click suggested fixes (including multi-file), and auto-approve for low-risk PRs with no blocking findings. The step that matters commercially is the December 2025 scanner expansion: SAST, SCA, secrets, IaC and license detection now run in a single scanning pass. For a team already paying for a review bot, folding a secrets scanner and a dependency-CVE check into the same gate removes a vendor and a workflow. The tier structure is the honest part of the story and the thing most buyers get wrong. Security scan frequency and repo coverage are tiered, not flat. Open Source and Pro scan biweekly, capped at 3 and 10 repos respectively; only Team moves to nightly scans, and Team covers 50 repos rather than an unlimited number. Review rate limits jump at Team too, so an unusually busy repo can sit below the ceiling on Pro and still hit it. If codebase-wide continuous scanning is why you're buying, Team is the floor, not Pro. Where Sourcery fits best: mid-size engineering orgs adopting Cursor, Windsurf or coding agents that generate PRs faster than reviewers can read them. The IDE surface — VS Code, PyCharm, JetBrains, Cursor, Windsurf, with a rebuilt chat and one-click apply — means the same review rules apply before commit and after push. Custom prompts for the review models and custom review rules give you a way to enforce a style guide mechanically instead of in review threads. Where it doesn't fit: security teams that benchmark scanners on dataflow tracing and blast-radius reporting will find Sourcery shallower than Semgrep or SonarQube, and should keep their dedicated SAST. Small teams with low PR volume will struggle to justify $24/seat/month billed annually. Organizations that need self-hosting, SSO or bring-your-own LLM keys should know those are Enterprise-only, alongside GitHub Enterprise Server support — everyone else gets GitHub, GitLab.com and self-managed GitLab on every plan. One thing to clear with your security team regardless of tier: Sourcery routes code through third-party LLM providers — Microsoft Azure OpenAI, Anthropic, and OpenAI per the vendor's docs. The vendor states it retains no copy after a review and never trains on your code, and it is SOC 2 Type II compliant, but that data path belongs in your own review.