# deepsec Scanner

Runs the deepsec AI scanner on a repo, branch or uncommitted changes.

- Repository: https://github.com/vercel-labs/deepsec (8302 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-09-29
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add vercel-labs/deepsec --skill deepsec -g -a claude-code -y`
Codex: `npx skills add vercel-labs/deepsec --skill deepsec -g -a codex -y`
Cursor: `npx skills add vercel-labs/deepsec --skill deepsec -g -a cursor -y`
Gemini CLI: `npx skills add vercel-labs/deepsec --skill deepsec -g -a gemini-cli -y`

## Description

Run deepsec, an AI-powered cyber-security vulnerability scanner. Activates when the user invokes /deepsec, asks to run deepsec, or wants to scan their repo, branch, or uncommitted changes for vulnerabilities.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# /deepsec, scan this repository with deepsec

`deepsec` is an AI-powered vulnerability scanner.

- Modern AI models are great at security code review.
- Most review solutions only run on pull requests.
- That means most legacy code was never reviewed, and your code from 6
  months ago was reviewed by older models.
- Instead deepsec does security review on ALL of your existing code using
  scaled VM fanout.
- Vercel's deepsec is open source, runs in your own infrastructure, and
  supports strong agent sandboxing.

A fast regex scan flags candidate files, then AI agents investigate each 
candidate in depth and record findings with severity ratings; findings can
later be revalidated, triaged, and exported. Everything it adds to a repository 
lives in a single `.deepsec/` workspace (config, installed package, per-project
data). Because processing runs real AI agents, it costs money in proportion 
to how much code it investigates.

Follow this runbook when the user invokes `/deepsec` or asks for a scan.

## 1. Ask for scope first

Ask the user which scope to process, using a structured question tool if you
have one (AskUserQuestion in Claude Code), otherwise plain text:

- **Uncommitted changes**, working tree + untracked files
- **Diff to main**, changes vs `origin/main` (use `main` if there is no
  `origin` remote)
- **Entire codebase**, warn that this is the expensive option: AI
  processing investigates every candidate file and can cost real money on a
  large repository

Ask before doing anything else so the rest of the flow can run unattended.

## 2. Detect onboarding state

From the repository root:

- **No `.deepsec/deepsec.config.ts`** → not onboarded. Do step 3 in full.
- **`.deepsec/` exists but `.deepsec/node_modules/deepsec` is missing, or a
  previous setup was interrupted** → re-run the init command from step 3; it
  resumes from checkpoints and repairs the install rather than starting over.
- **Otherwise** → onboarded; skip to step 4.

The rest: https://github.com/vercel-labs/deepsec/blob/HEAD//SKILL.md