deepsec vs shippie
deepsec is much bigger: 7.9k stars against 2.5k. Over the days we have tracked them deepsec moved +154.8% and shippie +5.3%, so deepsec is growing faster right now.
Neither one leads on the six capability axes, so the choice comes down to which of them fits the way you already work.
Stars and commit dates come from our own daily tracking. The six axes are read off each project's documentation by our review pipeline, so they describe what a project says about itself, not what we measured in its code.
Where they stand today
Agent-powered whole-repo vulnerability scanner that scales across workers, resumes interrupted runs, and lets you grow project-specific matchers.
- Stars
- 7.9k
- Tracked growth
- +154.8%
- Maturity
- ●●●●●
- Last commit
- 20h ago
- Language
- TypeScript
- License
- Apache-2.0
- Cost to run
- Uses your model API keys; full-repo scans can be costly for large repos
Provides an extendable agent loop built on flue/pi with Model Context Protocol (MCP) support to explore the repo using real developer tools and integrate external tools.
- Stars
- 2.5k
- Tracked growth
- +5.3%
- Maturity
- ●●●●●
- Last commit
- 1d ago
- Language
- TypeScript
- License
- MIT
- Cost to run
- Your API key, per-PR
Six axes, head to head
Each axis runs 0 to 5. The label under a score is what that project's own docs claim, not a category average.
| Axis | deepsec | shippie |
|---|---|---|
Context depth How much of your codebase it sees before it answers: the open diff, the diff plus related files, or the whole repository. | ●●●●● Whole-repo analysis | ●●●●● Repo exploration |
Noise control How it keeps output volume down — severity thresholds, deduplication, incremental runs over new commits only. | ●●●●● Revalidate + matchers | ●●●●● Configurable filters |
Customization How far it bends to your team: custom rules, prompts, style guides, per-path config. | ●●●●● Plugins & matchers | ●●●●● Rules & prompts |
Privacy Whether your code stays on your own infrastructure: fully local, self-hostable, or cloud API only. | ●●●●● Cloud APIs with key | ●●●●● API-key cloud |
Model freedom Whether you can point it at any provider, or it is wired to one. | ●●●●● BYOK & providers | ●●●●● Multiple providers |
Setup ease What it takes to get a first useful run out of it. | ●●●●● Config + API key | ●●●●● Quick start |
Which one to pick
Pick deepsec if…
High-coverage — pick deepsec when you need an agent-driven, tunable scanner that analyzes entire large codebases and supports custom matchers and distributed execution.
Pick shippie if…
Extensible — pick Shippie when you want a provider-agnostic, extendable code-review workflow that can run locally or in CI and integrate external tools via MCP.
What people want from each one
vercel-labs/deepsec
mattzcarey/shippie
Questions people ask
Is deepsec better than shippie?
Neither one leads on the six capability axes, so the choice comes down to which of them fits the way you already work. deepsec is worth picking when high-coverage — pick deepsec when you need an agent-driven, tunable scanner that analyzes entire large codebases and supports custom matchers and distributed execution.
Which of deepsec and shippie keeps my code private?
deepsec: Cloud APIs with key (3/5). shippie: API-key cloud (3/5).
What does each one cost to run?
deepsec: Uses your model API keys; full-repo scans can be costly for large repos. shippie: Your API key, per-PR.
Full profiles: vercel-labs/deepsec and mattzcarey/shippie. Everything else in Code review agents.