DeepAudit is an open-source SAST platform that replaces the single-pass rule scan with a multi-agent audit workflow.
Four agents plan the audit, map the attack surface, hunt vulnerabilities, then try to prove each one by running a PoC inside a Docker sandbox.
The project sits at roughly 6,700 GitHub stars with 819 forks and 15 contributors, under an AGPL-3.0 license. It was previously published as XCodeReviewer and rebuilt around the agent architecture in the v3.x line.
What is DeepAudit?
Rule-based scanners report every pattern match and leave the triage to you. DeepAudit inverts that: it treats the audit as a task to be planned, executed, and then verified before anything reaches the report.
The maintainers frame it against three failure modes of traditional SAST: false-positive volume, blindness to cross-file business logic, and no way to tell whether a finding is actually exploitable.
Verification is the part that distinguishes it. The Verification agent writes an exploit script, runs it in an isolated Docker container, and self-corrects on failure. Findings it cannot reproduce are dropped.
| Component | Details |
|---|---|
| Architecture | Python FastAPI backend, React 18 + TypeScript frontend, PostgreSQL, Redis |
| Agents | Orchestrator, Recon, Analysis, Verification |
| Analysis layer | RAG over CWE/CVE knowledge base, Tree-sitter AST chunking, vector database |
| Wrapped scanners | Semgrep, Bandit, Kunlun-M, Gitleaks, TruffleHog, npm audit, safety |
| Verification | PoC generation and execution in an isolated Docker sandbox |
| Vulnerability classes | 12 tracked types including SSRF, XXE, IDOR, insecure deserialization |
| Project sources | GitHub, GitLab, Gitea import, or ZIP upload |
| Reports | PDF, Markdown, JSON export |
| LLM providers | 11 including OpenAI, Claude, Gemini, DeepSeek, Qwen, GLM-4, Ollama |
| License | AGPL-3.0, self-hosted |
The audit workflow
The five stages run in sequence, each owned by a named agent.
| Step | Stage | Agent | Action |
|---|---|---|---|
| 1 | Strategy | Orchestrator | Reads the task, identifies project type, builds an audit plan, dispatches subtasks |
| 2 | Recon | Recon | Scans project structure, identifies frameworks, libraries and APIs, extracts entry points |
| 3 | Analysis | Analysis | Reviews code against the RAG knowledge base and AST analysis to surface candidate vulnerabilities |
| 4 | Verification | Verification | Writes a PoC script and executes it in the Docker sandbox, self-correcting on failure |
| 5 | Reporting | Orchestrator | Aggregates findings, removes anything verification disproved, generates the report |
The activity log exposes each agent’s reasoning as it runs, including which external scanner it decided to invoke and why.
semgrep_scan, bandit_scan for Python, gitleaks_scan for secrets, npm_audit for Node dependencies. The LLM layer then reasons across their combined output.Architecture
The system is split into a multi-agent engine, a RAG pipeline, a security tool suite, and a Docker sandbox, with PostgreSQL underneath for persistence.
The RAG pipeline chunks code with a Tree-sitter AST splitter, embeds it, and stores it in a vector database alongside CWE/CVE patterns and vulnerability signatures.
LLM provider support
DeepAudit treats provider choice as a deployment decision, not a compile-time one. Models are configured in the browser and switched without rebuilding the image.
| Group | Models |
|---|---|
| International | OpenAI GPT-4o / GPT-4, Claude 3.5 Sonnet / Opus, Google Gemini Pro, DeepSeek V3 |
| China-based | Qwen, Zhipu GLM-4, Moonshot Kimi, ERNIE, MiniMax, Doubao |
| Local | Ollama: Llama3, Qwen2.5, CodeLlama, DeepSeek-Coder, Codestral |
The Ollama path is the one that matters for regulated teams. It keeps source code inside the network at the cost of whatever capability gap exists between your local model and a frontier one.
Reporting
Reports export to PDF, Markdown, or JSON. Each finding carries a severity, the affected line, an explanation, the vulnerable code, and a remediation suggestion.
The interface and generated reports are Chinese by default, with output language configurable between zh-CN and en-US. An English README is maintained alongside the Chinese one.
Reported vulnerability discoveries
The maintainers report that a closed-source build of DeepAudit produced 49 CVE identifiers and 6 GitHub security advisories across 17 open-source projects.
The findings are credited to team members @lintsinghua and @ez-lbz , and the advisories themselves are public on NVD and GitHub. Named projects include Dataease, ZenTao PMS, PowerJob, JimuReport, and H2O-3.
Treat the number as a maintainer claim about an internal build rather than a benchmark of the released open-source version. The individual CVEs are verifiable; the attribution to a specific tool version is not.
Getting Started
Deployment is a single docker compose command against the published production compose file. It pulls prebuilt frontend, backend, and sandbox images, then serves the app on port 3000.
Full instructions are in the project README .
Two things to decide before the first run. Pick your LLM provider: Ollama if code cannot leave the network, a hosted API otherwise.
Then confirm Docker can pull and run the sandbox image, since PoC verification depends on it.
Source-based development needs Python 3.11+, Node.js 20+, PostgreSQL 15+, and Docker.
When to Use DeepAudit
It fits teams that want exploitability evidence rather than a longer findings list, and that can run an audit as a deliberate exercise instead of a per-commit gate.
The absence of CI/CD integration is the main constraint. Incremental PR auditing and agent-authored fix PRs are roadmap items, so today this runs as a self-hosted web application you point at an imported project.
The AGPL-3.0 license is the other thing to check early. It is fine for internal use, but the copyleft obligations bite if you plan to redistribute or offer it as a hosted service.
For rule-based scanning inside the pipeline, Semgrep covers the pattern-matching layer that DeepAudit invokes as one of its tools.