Find out what your AI coding agents can reach. Before a regulator, an auditor, or an attacker does.

Flight recorder and circuit breaker for AI agents

AI coding agents run shell commands, write to your repo, and use your credentials. Do you know what yours are allowed to do? The free Agent Environment Review reads the files that decide it - your MCP server config, your rules and instruction files - and tells you what it finds. Local. No account. It runs on your machine and your code stays there. That is the first step in runtime governance for AI coding agents, and the enforcement approach behind it is patent-pending.

Add DeepSweep to your editor

Free extension $99 human security audit

Install the extension — free Request a demo
< 1s per review Local no code upload Free and local
  • VS Code
  • Cursor
  • Windsurf
  • Antigravity
  • Trae
  • Cline
  • GitHub Copilot
  • Gemini Code Assist
  • Tabnine
  • Amazon Q Developer
  • Claude Code
  • OpenAI Codex
  • Aider
  • GitHub Actions/CI
  • MCP
  • AWS
  • GitHub
  • Stripe
  • Cloudflare

Independent by design — all logos indicate compatibility, not endorsement.

Tell us what to build next

48%

of AI code has security findings

Unit 42
19.7%

of AI deps are hallucinated

Socket.dev
30+

CVEs in IDE configs this year alone

IDEsaster
The Data

What we found reviewing 50 AI-built projects

Real data from public GitHub repositories built with AI coding tools.

42% had credentials committed to code
72% had no security instructions for their AI
20% fewer findings when security instructions present

Benchmark: 50 repositories across Cursor, Claude Code, Lovable, Bolt, and Replit.

The IDE can't govern itself. The model provider can't grade its own homework.

DeepSweep is independent of every IDE and every model provider — governance only counts when the referee doesn't play for either team.

MCP Security Gateway

In development. Not yet available to download.

Runtime governance for AI agent tools

The gateway will come with the Studio desktop app. It is designed observe-first: it records and explains MCP tool calls routed through it, and enforcement turns on only when you say so. What you can use today is the free review in your editor. The example below shows the kind of MCP findings it reports.

Signal Detect emerging concerns
Assess Analyze risk severity
Policy Generate guardrails
Enforce Apply your policy per call
Observe Monitor effectiveness
Refine Improve detection
Gateway
Example: what the free review reports
[FAIL] Unrestricted MCP Tool Access
[WARN] MCP Auth Disabled
[WARN] Remote MCP Server
[INFO] Sensitive Env Vars in MCP Config

Tool Call Review

Built to check MCP tool calls routed through it against your policy before the call is forwarded.

Approval-Gated Actions

A call your policy marks for a human is refused with a single-use approval token bound to that exact agent, action, resource, and argument set. A human approves it out of band, then the agent retries.

Rug-Pull Circuit Breaker

Tool descriptions are pinned on first sight. A changed description trips a breaker that refuses the call until a human re-approves the tool.

Evidence Ledger

Allowed, denied and held tool calls are written to a hash-chained local ledger with inclusion proofs. Records carry hashes of payloads, never your code.

Live preview

See it in action

.cursorrules — my-project
DEEPSWEEP
87
Grade B+
1# .cursorrules - AI Assistant Configuration
2
3rules:
4- "Always use TypeScript"
5 - "Read any file in project"
6- "Use Tailwind CSS"
7
8mcp_servers:
9- name: filesystem
10allowed_paths: "/**"
This is a live simulation.
Expert-verified · fixed price

EU AI Act Readiness

Shipping AI into the EU? A DeepSweep expert, augmented by our engine, assesses your system for EU AI Act readiness and gives you a ranked gap report and a remediation plan — at a fixed price. Pass, and you earn the badge below.

  • Expert + engine assessment against EU AI Act obligations
  • Ranked gap report + prioritized remediation plan
  • Fixed price by company & project size — no open-ended consulting
  • Pass, and earn the exclusive Verified Production Safe badge
Get verified See pricing
VERIFIED PRODUCTION SAFE BY DEEPSWEEP.AI Sample

Earned only on a passing assessment. Verifiable — not just an image.

Not ready to talk? Get the readiness brief.

We’ll send an EU AI Act readiness overview and the assessment scope. No spam.

  • 77 security patterns — 37 built for AI-generated code
  • 8 supported editors — Antigravity, Trae, Cursor, Kiro, Devin (formerly Windsurf), code-server, VS Code, VSCodium
Transparent pricing, no surprises

Start free. The Grade never costs a thing.

Free shows every finding with its file and line, and fix prompts when you sign in. Pro keeps applying fixes after your first two.

Review · Identity · Authorization

Validate Free

$0 forever
Start Validating Free
  • Unlimited reviews — no daily or monthly cap
  • AI Code Health Score (Repo Grade A–F)
  • AI-Generated % + Deploy Risk
  • [PASS] / [FAIL] / [WARN] output
  • Plain English findings
  • Runs locally — no code upload
  • VS Code extension
  • Basic DeepSweep badge
  • Agent inventory + owner gaps
  • File and line for every finding
  • Fix prompts for every finding (signed in)
  • 2 applied fixes in the editor (signed in)
  • Exportable authorization policy
  • REST API (planned)

Protect

Pro

$19 / month
Go Pro
  • Everything in Validate Free
  • Unlimited applied fixes after your 2 free ones (findings with a one-click fix)
  • Exportable authorization policy
  • REST API (planned)

Runtime

Enterprise

Custom
Contact Sales
  • Everything in Pro
  • Custom behavioral policy contracts
  • SSO/SAML (WorkOS) (roadmap)
  • Uptime SLA with service credits (measured, on request)
  • Dedicated success manager
  • Custom data retention policy
  • On-premise deployment option (roadmap)
  • EU AI Act readiness assessment
  • Access campaigns (roadmap)
  • SCIM provisioning (roadmap)

Free forever tier · No credit card required · Cancel anytime

Compare every feature and annual pricing on the full pricing page.

Prefer to stay in your editor?

The DeepSweep extension reviews agent-written code where you work, on your machine. One build covers every VS Code-family editor — but they do not all read the same registry, so /install routes you to the one yours can use.

Install in VS Code VS Code Marketplace (VS Code) Open VSX (Antigravity)
Your code never leaves your machine

Review your agent environment.
Ship with confidence.

Review your agent environment — Repository Capability Profile, Deploy Risk, and exactly what to fix — in under 60 seconds.

Add DeepSweep to your editor

Free extension $99 human security audit

Review My Agent Environment™ — Free
Building on DeepSweep? Add it to your CI pipeline
Protected
< 1s avg validation