Dataset·Catalogue

Agentic Developer Tools

Name: Agentic Developer Tools
Creator: Hermosa AI
Published: 2026-09-07
License: https://creativecommons.org/licenses/by/4.0/

Coding agents started as the product. They are becoming an engine other tools drive. These are the tools that point one at an existing codebase to do a single fixed job: review a pull request, audit for vulnerabilities, generate tests, run a migration. Not the agents that write your features, the tools that check them. Browse it below, or take the raw files.

Snapshot: 2026-09-07
Coverage: 25tools·7jobs covered·1drive coding agents·8self-hostable
Download

About this dataset

[show]

Unit: One row = one tool that drives an LLM or coding agent over an existing codebase, with the job it owns, the engine it drives, deployment model, whether it writes code, surface, pricing, maturity, and a source.
Scope: The boundary against a coding harness is who sets the goal. A harness takes open-ended instruction: you tell it what to build. A tool here owns one fixed job and you point it at a codebase. Writing code is therefore in scope, so long as finding is the primary job: an autofixer that patches what it found belongs here, an agent you brief to build a feature does not.
Engine: Whether the tool drives an external coding agent, runs a model the vendor hosts, pairs static analysis with a model pass, or an ensemble the vendor does not decompose. A purely deterministic linter, SAST scanner or codemod with no model is out of scope.
Claims: Every vendor in this category claims benchmark superiority and most of it is marketing. Accuracy, false-positive and benchmark figures are quoted and explicitly attributed as vendor-claimed or independent. Treat an unattributed number as unverified.
Unknowns: A capability a vendor does not document is left unset and reads as unknown, never as a no. Absence of a claim is not evidence of absence.
Sources: Each row is verified against vendor documentation, launch posts, changelogs or the source repository. URLs travel with the dataset.
License: Free to use, distribute, and reproduce with attribution to Hermosa Labs LLC (CC BY 4.0).
Cite: Hermosa Labs LLC, “Agentic Developer Tools,” 2026-09-07.

The catalogue

Code review6

Baz

[GA]

Baz·self-hosted or SaaS·own model·launched 2025-01

Engineering review platform whose Reviewer agent reads the whole codebase to give inline pull-request feedback, alongside Custom Reviewers trained on a team's past PR discussions and a Planner product that pushes review earlier into the implementation-plan stage.

Surface: PR bot (GitHub), web-based review workspace
Codebase context: full-repo: Baz's own description says it reads the whole codebase rather than only the diff
Pricing: seat-based pricing plus usage-based Engineering Work Credits

Benchmark signals

Listed among the tools evaluated in Martian's independent Code Review Bench per Martian's own description of its tool set. No vendor-published or independently confirmed F1/precision/recall score specific to Baz was located for this entry.

Filed as job: review. Baz names security findings as one of several review surfaces (alongside implementation plans, pull requests and merge decisions), which the validator judged a facet of review rather than a co-equal product line, unlike CodeAnt. engineModel is the discoverer inference and is not confirmed by any vendor technical statement, so treat it as unverified until a teardown or a vendor architecture page supports it. Founded by Bridgecrew founder Guy Eisenkot; emerged from stealth with an $8M seed round around January 2025 and raised a further $9M seed extension in June 2026 (both secondary-sourced). writesCode is omitted: a 'Fixer' agent role is referenced in vendor materials but no page read for this entry confirmed whether it commits to the repo or only proposes a fix.

Source: Baz homepage

Bugbot

[writes code][GA]

Cursor (Anysphere)·SaaS·hybrid ensemble·launched 2025-06

AI code review bot from Cursor that automatically reviews GitHub pull requests for logic bugs and posts comments with fix suggestions, with an optional Autofix mode that spawns a Cloud Agent to push a fix directly to the branch.

Surface: PR bot (GitHub), Cursor editor, Cloud/Background Agent
Pricing: usage-based billing; consumes included usage first, then bills additional reviews through on-demand spend (moved off a flat per-seat subscription in 2026 per third-party reporting, not confirmed on Cursor's own pricing page for this entry)

Benchmark signals

Listed among the tools evaluated in Martian's independent Code Review Bench (per Martian's own GitHub repository description of the benchmark's tool set, which names Cursor Bugbot alongside CodeRabbit, Greptile, Qodo, Graphite, Baz, CodeAnt and others). No vendor-published or independently confirmed F1/precision/recall score specific to Bugbot was located for this entry; Cursor's own docs claim a review-usefulness figure instead: '70%+ of flags get resolved before merge,' which is a vendor-reported adoption metric, not a benchmark placement.

Separately named, separately billed (per-review usage pricing) product from the Cursor IDE/CLI that is already tracked in harnesses.csv, satisfying this topic's fixed-job test even though it shares Cursor's account and some of its models. Docs also state: 'Bugbot Autofix automatically spawns a Cloud Agent to fix bugs found during PR reviews,' which can 'push fixes to the existing branch or a new branch,' the basis for writesCode: true. Engine per Cursor's own docs: 'Bugbot uses a combination of frontier and in-house models to review code.'

Source: Cursor Bugbot docs

cubic

[writes code][GA]

cubic (YC S25)·SaaS·hybrid ensemble·launched 2025-04

AI code review platform, marketed as 'cursor for code review,' that reviews every pull request against the whole codebase and past merges to reduce noisy one-size-fits-all warnings, and can generate a fix through a connected coding agent on request.

Surface: PR bot (GitHub), IDE, web platform, CLI (Team plan and above)
Engines: Docs state cubic 'uses multiple model providers, with different models for different review tasks,' and that its coding-agent fix step will 'Generate fixes when requested, using your configured provider.'
Pricing: Starter is free (20 PR reviews/month); Team is $30 to $40/developer/month depending on billing term; Pro is $79 to $99/developer/month; Enterprise is custom; public and open-source repositories get free access

Benchmark signals

Vendor-reported placement on Martian's independent Code Review Bench: cubic's own recap states it holds the top spot with a 61.8% F1 score and that 'cubic scores 16.3 percentage points above the next well-known tool on the list.' As with the other vendors on this leaderboard, this is a dated snapshot (published around 2026-03-25); Martian's benchmark updates continuously and other tools (Qodo, Greptile, CodeRabbit) have separately claimed top placement on different dates with different scores.

Founded in 2025 (YC Spring 2025 batch) by Allis Yao and Paul Sangle-Ferriere, per Y Combinator and press coverage; publicly launched on Product Hunt 2025-04-28 (secondary-sourced). writesCode is true both via an on-request coding-agent fix step and, per third-party reporting, an automatic commit-and-open-PR path on the Team plan and above; only the on-request path is confirmed directly in cubic's own docs for this entry.

Source: cubic homepage

Graphite AI Reviews (formerly Diamond)

[writes code][GA]

Graphite·SaaS·own model·launched 2025-03-17

AI reviewer that comments on every GitHub pull request with codebase-aware findings and suggested fixes, and can apply a fix and commit it through an in-page chat once a developer approves it. Launched as a standalone product named Diamond in March 2025 and later absorbed into Graphite's core AI Reviews feature under the main Graphite brand.

Surface: PR bot (GitHub), web app (app.graphite.com), IDE (VS Code, per the original Diamond launch)
Pricing: Diamond originally offered a free tier up to 100 PRs/month; the current Graphite homepage offers a free 30-day trial synced to a GitHub account, with paid tiers on a separate pricing page not read for this entry

Benchmark signals

Independent finding from Martian's own Code Review Bench writeup (not a vendor claim): 'Graphite: highest precision and lowest recall in both benchmarks.' This is Martian's own characterization of Graphite's result profile rather than a headline F1 ranking.

Distinct from the already-tracked Graphite CLI/stacking product (not itself a review tool and not tracked in harnesses.csv). Now writes and commits code when a developer approves a fix in Graphite Chat, per the homepage: it lets you resolve CI failures, apply suggested fixes, and commit your changes in one conversation, unlike Greptile, which never applies a patch itself.

Source: Graphite homepage

Greptile

[find only][GA]

Greptile, Inc.·self-hosted or SaaS·hybrid ensemble·launched 2023

AI code review agent that builds a dependency-graph index of the whole codebase before commenting on a pull request, using a swarm of parallel agents to trace dependencies and flag logical, security and style issues with supporting evidence.

Surface: PR bot (GitHub, GitLab), IDE integrations (Cursor, Claude Code, Codex, Devin), CLI, API/MCP
Codebase context: full-repo index; docs describe indexing the entire codebase into a dependency graph before reviewing any single PR, rather than reviewing the diff in isolation (paraphrased from Greptile's own product description)
Pricing: freemium: Starter is free for one developer with 50 credits/month; Pro is $30/seat/month with 50 credits/seat (1 credit = 1 standard review, 3 credits = 1 TREX test-writing review), additional credits $1 each

Benchmark signals

Vendor-reported placement on Martian's independent Code Review Bench: Greptile's own recap (dated 2026-07-30) states 'Greptile is the top-performing AI code reviewer overall as of July 30, 2026. Greptile ranks #1 in F1 score at 60.8% and leads all evaluated tools in precision at 76.2%.' The Martian leaderboard is a continuously updated, open-source benchmark (codereview.withmartian.com, launched 2026-02-26), and multiple vendors (Qodo, cubic) have separately claimed the #1 spot on other dates with different scores, so treat any single vendor's '#1' claim as a dated snapshot of a moving leaderboard rather than a fixed ranking.

Distinct from CodeRabbit in this dataset by never writing or committing code itself: every finding routes to an external coding agent for the actual fix (docs describe a 'Fix with your Agent' action that hands the issue to Claude Code, Codex, Conductor, Cursor, or Devin rather than Greptile applying the patch). Deployment is both self-hosted and SaaS per docs ('Greptile Cloud (SOC2 Type II)' alongside Docker Compose and Kubernetes with Helm for self-hosting); pluggableEngines is left unset because the docs mention 'custom LLMs' only in passing on that deployment-options list without naming which providers/models are actually supported. Founded 2023, YC W24 batch, per Georgia Tech and press coverage (secondary-sourced, not confirmed on Greptile's own site).

Source: Greptile docs, Introduction

Qodo

[GA]

Qodo (formerly CodiumAI)·SaaS·hybrid ensemble

AI code review platform, evolved from the open-source PR-Agent project into Qodo Merge and now folded into the unified Qodo platform, that runs specialized agents in parallel to assess correctness, standards compliance, architecture and risk on a pull request, then merges their findings with a judge agent before commenting.

Surface: PR bot (GitHub, GitLab, Bitbucket, Azure DevOps), IDE (VS Code, JetBrains), CLI, Git workflows
Engines: Enterprise plan supports bring-your-own LLM keys per Qodo's pricing page, which lists BYOK as an Enterprise-tier feature; specific model options are not disclosed.
Pricing: credit-based: free 14-day trial, Pro Team plan from $30/month with credits at $0.012 each pooled across the team, custom Enterprise pricing, and a free tier for qualifying open-source projects

Benchmark signals

Vendor-reported placement on Martian's independent Code Review Bench: Qodo's own recap (dated 2026-03-15) states 'With an F1 score of 64.3%, Qodo surpasses other AI code review tools, ahead of the next leading tool by +10.5%.' As with other vendors on this leaderboard, this is a dated snapshot; Martian's benchmark updates continuously and other tools (CodeRabbit, cubic, Greptile) have separately claimed top placement on different dates with different scores.

writesCode is left unset: the product page describes generating an 'implementation-ready prompt for any AI coding agent' for a developer to hand to their own assistant, which shows a handoff path exists but does not settle whether Qodo's own /improve-style suggestions are ever applied and committed directly, so neither true nor false is confirmed. Rebrand lineage: CodiumAI became Qodo; the open-source PR-Agent project (github.com/The-PR-Agent/pr-agent) that Qodo Merge grew from still exists as a separate community project and explicitly states it 'is not the Qodo free tier.'

Source: Qodo Merge product page

Security audit7

Copilot Autofix

[writes code][GA]

GitHub (Microsoft)·SaaS·static analysis plus a model·launched 2024-08-14

A code-scanning feature that turns CodeQL alerts into a suggested code fix: CodeQL finds the vulnerability deterministically, then an LLM is fed the alert data and surrounding code to draft a fix and an explanation for a developer to review and apply.

Surface: PR bot, CI
Pricing: no Copilot subscription required and it does not consume Copilot AI credits; free on public repositories, included for private/internal repos with a GitHub Code Security license
Open source: no

Distinct from the already-tracked Copilot harness (harnesses.csv row 16, the general-purpose IDE/CLI coding agent): Autofix is a narrow, fixed-job feature bound to CodeQL code-scanning alerts, not an open-ended coding agent you prompt with 'build me X'. It generates a single reviewable suggestion; it does not on its own open a pull request, so writesCode is true in the sense of producing a mergeable patch, but a human applies it. GitHub also has a newer 'agentic Autofix' variant in public preview that iterates with tests; that variant is not what is described here, only the GA classic Autofix. No quantified accuracy figure for classic Autofix was found on GitHub's own docs, so benchmarkSignals is omitted.

Source: GitHub Docs: About Copilot Autofix for code scanning

Corgea (BLAST)

[writes code][GA]

Corgea·SaaS·static analysis plus a model·launched 2025-04-02

An AppSec platform whose BLAST detection engine combines LLMs with AST-based analysis to find vulnerabilities, including business-logic flaws like broken auth and authorization gaps that pattern-based scanners miss, then generates and opens pull-request fixes for the developer to approve, across GitHub, GitLab, Azure DevOps and Bitbucket.

Surface: PR bot, CI
Codebase context: BLAST is described as tracing converging code routes to a shared weak point and mapping impact to vulnerable code and packages, i.e. cross-file/data-flow context rather than single-file analysis
Open source: no

Benchmark signals

Vendor-claimed only: Corgea's own blog post states traditional SAST tools have false-positive rates exceeding 20 percent, while BLAST keeps false positives below 5 percent. The previously cited '2x more true positives,' '3x less false positives,' and '+90% auto-fix accuracy' figures do not appear on the cited page and could not be confirmed, so they are replaced with the figures actually found on that page. No independent benchmark of Corgea was located.

This entry covers Corgea's codebase-scanning-and-fix product (BLAST/AI SAST). Corgea separately markets an 'AI Pentest' product for autonomous penetration testing of applications an organization already owns; that is a different fixed job (dynamic testing vs static codebase scanning) and is not what is scored here, though it would likely also be in-scope under the offensive-tooling test since it targets systems the customer owns rather than third parties. The engine description ('combines Large Language Models (LLMs) with AST-based security analysis, providing deep contextual (semantic) understanding of code') is a faithful paraphrase from the same source page, quoted separately from the definitional sentence above rather than joined with an ellipsis.

Source: Corgea: Introducing BLAST: The Future of Security Testing is Here

deepsec

[find only][GA]

Vercel·self-hosted·drives a coding agent·launched 2026-05-04

Open-source security review tool. Static analysis shortlists security-sensitive files, then coding-agent models investigate each one, tracing data flows and checking for mitigations, and the run emits ranked findings with severity ratings. Runs on your own machine with optional fanout to Vercel Sandboxes.

Surface: CLI (npx deepsec init), run locally, with optional remote execution on Vercel Sandboxes
Engines: Claude Opus 4.7 and GPT 5.5 through Vercel AI Gateway by default; bring your own key (OpenAI, Anthropic, or a custom HTTPS provider) with --model-auth direct, or use an existing Claude or Codex subscription
Codebase context: static analysis shortlists candidate files, then per-file agent investigation; runs on Vercel's own monorepos routinely scale past 1,000 concurrent sandboxes, and an interrupted run resumes without re-analysing finished files
Pricing: free and open source; you pay only for model usage, either through AI Gateway or your own key
License: Apache-2.0
Open source: yes

Benchmark signals

Vendor-claimed only: Vercel reports the false positive rate is 'roughly 10-20%' on its own monorepos. No independent benchmark of deepsec was located.

Vercel calls deepsec 'a security harness powered by coding agents', which collides with this repo's harnesses dataset, where harness means the coding agent itself. deepsec is a consumer of harnesses rather than a member of that set: it owns a fixed job (find vulnerabilities), drives coding agents as an engine, and never authors features. This entry is the case that motivated the topic.

Source: Vercel, Introducing deepsec

Pixeebot

[writes code][GA]

Pixee·SaaS·hybrid ensemble·launched 2023-08-31

A GitHub App that runs codemods against pull requests and existing codebases to remediate vulnerabilities and harden code. Deterministic AST-based codemods handle the majority of known patterns; for cases that don't map to a fixed rule (complex business logic, custom auth flows), its 'MagicMods' use an LLM to read surrounding code context and generate a fix in the codebase's own style, validated through a three-layer check before being proposed.

Surface: PR bot
Codebase context: MagicMods read call graphs, data flow, and framework conventions around the vulnerable code before generating a fix

openSource is intentionally omitted rather than set: the underlying codemodder transformation framework Pixeebot is built on is open source, but the Pixeebot GitHub App service itself is not, and the entity here is the service, not the framework. At its August 2023 launch, LLM-assisted codemods were described as a future capability; this entry documents the current (2026) state where MagicMods actively generate fixes per the cited 2026 post. No verbatim, Pixee-owned benchmark figure (merge rate, false-positive reduction) could be confirmed during this pass, so benchmarkSignals is omitted rather than repeating third-party aggregator numbers.

Source: Pixee: Java Vulnerability Remediation: From Scanner Alert to Merged Fix

Snyk Agent Fix

[writes code][GA]

Snyk·self-hosted or SaaS·static analysis plus a model·launched 2026-05-26

Snyk Code (deterministic/ML SAST) finds a vulnerability; Agent Fix then runs an agentic loop that prompts an LLM with dynamic few-shot examples from Snyk's own database of 35,000+ expert-written fixes, and if the generated fix fails a re-scan by Snyk Code, feeds the error back into the model and retries until a verified fix is produced. Formerly named DeepCode AI Fix.

Surface: IDE, PR bot
Codebase context: fixes are validated by re-running the deterministic Snyk Code scan against the generated patch before it is offered, with failed attempts fed back to the model for another try
Open source: no

Benchmark signals

Vendor-claimed only: Snyk's own blog post on Agent Fix's architecture reports Golden Test results of an 85.4% functional-and-secure fix rate for Opus 4.6 with Snyk Intelligence and 82.5% for Sonnet 4.6 with Snyk Intelligence. Snyk's docs separately state a median fix time under 8 seconds, with retries on large files taking up to 2 minutes. The previously cited 'industry-leading 80% accuracy' and 'average fix generation time of just 12 seconds' figures do not appear on the cited source page or in Snyk's docs and could not be confirmed, so they are replaced with the figures actually found. No independent benchmark of Agent Fix's accuracy was located.

Named precisely as Snyk names this specific generative-fix product, not the broader 'Snyk' or 'DeepCode AI' brand (DeepCode AI is the underlying symbolic/ML detection engine that predates the generative fixer and is a separate mechanism). In GitHub PRs, fixes are invoked with @Snyk /fix and applied with @Snyk /apply rather than opened automatically, so a human triggers and accepts the change.

Source: Snyk: New Agentic Architecture for Snyk Agent Fix

ZeroPath

[writes code][GA]

ZeroPath·SaaS·static analysis plus a model·launched 2024

An AI-native SAST product built to reason about code the way a pentester would: it combines LLM analysis with AST-based source-to-sink taint tracing to find vulnerability classes like business-logic flaws and auth bypasses that rule-based scanners miss, then opens ready-to-merge pull requests with the fix.

Surface: PR bot, CI
Open source: no

Benchmark signals

Vendor-claimed only: ZeroPath's blog describes a reachability-aware data-flow analysis that reduces false positives by accounting for sanitization functions, authentication checks and execution context. The previously cited '75% fewer false positives' figure does not appear on the cited page and could not be confirmed, so it is removed rather than repeated.

Y Combinator-backed (S24); founded 2024 by Raphael Karger, Etienne Lunetta and Dean Valentine. launched is left at year-precision because the founding year is well corroborated (YC batch, funding trackers) but no single precise public-launch date for the product itself (as opposed to the company) was confirmed on a vendor page during this pass.

Source: ZeroPath: How ZeroPath Works

Semgrep Assistant (Autofix)

[writes code][Beta]

Semgrep, Inc.·self-hosted or SaaS·static analysis plus a model·launched 2026-03-16

An AI layer on top of the Semgrep static-analysis engine: Semgrep's deterministic rules find a finding, then an LLM auto-triages true/false positives (with retrieval over the codebase and past triage decisions) and Autofix generates a proposed patch, which is checked by re-running the Semgrep engine against the generated code before being opened as a PR/MR.

Surface: CI, PR bot, CLI
Codebase context: Autofix's self-evaluation loop runs the generated fix back through the Semgrep engine to confirm the original finding is resolved before surfacing it
Open source: no

Benchmark signals

Vendor-claimed only: Semgrep states Autofix is 'deprioritizing more than 95% of false positives' and cites a '+95% agreement rate' for AI-assisted triage against its own security researchers. No independent benchmark of Autofix was located.

Entered under Semgrep's own product name rather than a generic 'Semgrep' entry. The underlying open-source Semgrep CLI/rule engine is self-hostable (Apache-2.0), but Assistant/Autofix itself is a hosted AppSec-platform feature layered on top of it, so openSource is marked false for this specific capability. Autofix is explicitly labeled public beta by Semgrep as of the March 2026 announcement; the separate auto-triage capability has been live longer.

Source: Semgrep: Accelerate and Automate Remediation with Semgrep Autofix

Test generation3

Keploy Unit Test Generator (UTG)

[writes code][maturity unknown]

Keploy Inc.·self-hosted or SaaS·static analysis plus a model

A component of the open-source Keploy platform that reads pull-request diffs and code semantics, uses LLMs to write unit tests with mocked dependencies and edge cases, then validates that each test builds, runs and passes before suggesting it.

Surface: CLI, CI (PR comments), IDE (VS Code extension)
Open source: yes

Scoped deliberately to Keploy's Unit Test Generator sub-feature, which is genuinely LLM-driven. Keploy's flagship capability (eBPF-based production-traffic capture for API/integration test generation) is a deterministic recording mechanism and would fail the LLM-engine filter on its own; this entry covers only the LLM-driven UTG piece, per the task's instruction to scope narrowly.

Source: Keploy Docs: Unit Test Generator

Momentic

[writes code][maturity unknown]

Momentic·SaaS·own model

A testing platform whose autonomous agent explores a web/mobile app to discover critical user flows, writes end-to-end tests from natural-language intent, and keeps them passing via self-healing, intent-based locators as the UI changes.

Surface: web (dashboard), CI
Pricing: freemium (free to start; enterprise via contact sales)

Fixed job: maintains a regression test suite for a given app. The agent interprets each test's intent fresh at runtime (an LLM-in-the-loop, not a driven external coding-agent binary), which is what makes the self-healing locators work, so it clears the LLM-engine filter distinctly from Meticulous (checked and rejected this round, deterministic session record/replay despite 'AI engine' marketing copy).

Source: Momentic homepage

TestSprite

[writes code][maturity unknown]

TestSprite·SaaS·own model

An autonomous testing agent that plans, generates and executes UI, API and end-to-end tests in its own cloud sandboxes, self-repairs flaky steps, and feeds structured bug reports and fix suggestions back to a coding agent or developer.

Surface: CI, IDE (MCP server into Cursor, Windsurf, Claude Code, VS Code), web

Checked specifically for filter 3 (own orchestration loop vs. MCP-tool-only): the plan/generate/execute/self-repair loop runs in TestSprite's own cloud sandbox; the MCP server and IDE integrations are additional entry points into that same backend loop rather than the loop itself, so it clears the bar rather than being merely a prompt pack injected into a host agent.

Source: TestSprite: Autonomous Software Testing

Migration and refactor2

AWS Transform

[writes code][maturity unknown]

AWS (Amazon Web Services)·SaaS·own model

A collaborative enterprise workbench where purpose-built AI agents run mainframe, VMware, Windows/.NET, and custom application migrations end to end, including language/framework version upgrades and SDK migrations.

Surface: web (workbench dashboard)

Benchmark signals

Vendor-claimed: AWS states .NET modernization through AWS Transform can reduce 'operating costs by up to 70%' by moving off legacy licenses; no independent verification located for this figure.

Distinct from Amazon Q Developer's built-in /transform Java-upgrade command, which AWS is winding down (per AWS's own end-of-support notice, Java upgrades delivered through the Q Developer IDE plugins lose support after 2027-04-30). AWS Transform is a separately branded, standalone workbench, not a feature bolted onto the Q Developer coding-agent harness. maturity is deliberately omitted: the fetched product page states some capabilities (e.g. continuous modernization) are still 'Preview' and gives no single overall GA date, so a blanket 'ga' would overstate what the source supports. Correction for the orchestrator: Amazon Q Developer itself is not currently a row in harnesses.csv (only Kiro, also AWS, is tracked there), contrary to the task brief's assumption.

Source: AWS Transform product page

Codemod (Codemod AI / Codemod2.0)

[writes code][maturity unknown]

Codemod, Inc.·self-hosted or SaaS·hybrid ensemble

A code-migration platform whose Codemod AI engine drafts a codemod with an LLM, iteratively repairs it against compiler, codemod-runner and diff feedback until it is verified correct, then runs the transformation as an orchestrated 'Migration Campaign' across any number of repositories.

Surface: CLI (npx codemod ai), CI

Distinct from Moderne/OpenRewrite (checked and rejected this round: AI there only helps author recipes for a deterministic execution engine). Here the LLM performs the actual code transformation step, gated by deterministic compiler/runner checks, and Migration Campaigns is the product's own multi-repo orchestration layer, not a prompt pack injected into someone else's harness.

Source: Codemod blog: Codemod AI iterative system

Documentation3

DeepWiki

[find only][GA]

Cognition·SaaS·hybrid ensemble·launched 2025-05

A tool from Cognition (maker of the Devin coding agent) that turns any GitHub repository into an interactive, wiki-style documentation site: swap github.com for deepwiki.com in a repo URL and it indexes the repo, builds a navigable table of contents with architecture diagrams and cross-referenced module pages, and adds a conversational Q&A interface grounded in the source, built on what Cognition calls Devin Wiki and Devin Search.

Surface: Web (deepwiki.com URL substitution), plus an official DeepWiki MCP server (mcp.deepwiki.com) exposing read_wiki_structure, read_wiki_contents and ask_question tools for use inside Claude Desktop, Cursor and similar clients
Pricing: Free for public repositories; indexing a private repository requires signing up for a Devin account rather than a separate DeepWiki price

Distinct from Devin itself (the general coding agent, out of scope as a harness) and from the DeepWiki MCP server considered alone (that would be an infrastructure building block): this entry is the wiki-generation product, which owns the fixed job of producing and updating documentation from an existing codebase. Launch is dated to month precision only: Cognition's own announcement page carries an ambiguous dateline ('05.05.25') while other secondary blogs cite late April 2025, so the exact day is not treated as sourced.

Source: Cognition: DeepWiki announcement

Komment

[GA]

Komment·self-hosted or SaaS·own model

A documentation engine that connects to a GitHub, GitLab or Bitbucket repository across 90+ languages and generates a full documentation site (usage instructions, API docs, architecture diagrams, in-code comments, security insights), then automatically re-documents the software whenever it detects the code and docs have diverged.

Surface: Connects to GitHub, GitLab and Bitbucket; publishes into Confluence, Notion, ReadMe, Slack and VS Code; SaaS dashboard at app.komment.ai or self-hosted
Codebase context: Per Komment's own site, the platform 'automatically re-documents your software when it detects divergence between code and docs' after connecting to the repository.
Pricing: Freemium: free forever for unlimited public repositories with no credit card required; paid Build/Grow/Scale tiers (private-repo limits, automatic updates, access control, custom scheduling) with amounts not disclosed on the pricing page fetched for this entry

Komment's own marketing explicitly distances the product from being a wrapper on 'generic language models' ('Komment is more than just AI'), so engineModel is recorded as own-model based on the vendor's own description rather than a confirmed model architecture; no independent technical teardown was located. Deployment self-host option is documented as VPC deployment via AWS, Azure or GCP. This is the weakest of the four candidates: a validator may reasonably bounce it on the LLM/agent-engine test since the vendor actively disclaims being 'just AI' and no third party confirms the mechanism.

Source: Komment homepage

Mintlify Agent

[find only][GA]

Mintlify·SaaS·hybrid ensemble

An AI agent inside the Mintlify docs platform that clones a customer's specified code repositories for context, watches for merged pull requests (or runs on a schedule), reads the diff to identify documentation that is now out of date, drafts the update, and either opens a pull request or pushes the change directly to the docs deployment branch.

Surface: Mintlify dashboard (Products -> Agent) for configuring automations; also reachable from Slack per Mintlify's own engineering blog
Codebase context: Per Mintlify's own blog, on each automation run 'the agent clones any specified repositories as context, follows the prompt, and either opens a pull request or pushes changes directly to your deployment branch' (paraphrase of the cited post; not copied verbatim from the docs page).
Pricing: Gated behind a paid tier: Mintlify's own pricing page lists Agent and Automations as included starting at the Pro plan and above, and explicitly not included on the free Starter plan; the page did not render a reliable dollar figure to cite.

Distinct from the older, free, open-source Mintlify Doc Writer (github.com/mintlify/writer, a highlight-and-generate IDE completion feature with no standing loop): this entry is specifically the newer Agent/Automations feature, which owns a fixed job (keep docs in sync with a monitored codebase) via its own trigger-clone-diff-draft-PR loop rather than a per-keystroke completion.

Source: Mintlify docs: What is the agent?

Dependency upkeep1

Infield

[GA]

Infield AI, Inc.·SaaS·hybrid ensemble

A managed dependency-upgrade service: it connects to a repo (GitHub app or CLI), builds a living upgrade plan across direct and indirect dependencies weighted by risk and effort, uses LLMs to read changelogs and flag updates likely to cause issues, and combines that with a team of expert developers to remediate breaking changes and ship upgrades, positioned explicitly against scanners like Dependabot that only flag issues rather than fixing them.

Surface: GitHub app, CLI

Distinct from Renovate and Dependabot (deterministic version bumpers, not tracked in this catalogue) because Infield names LLMs specifically as the mechanism doing changelog risk analysis, on top of which a team of expert developers (not a fully autonomous coding agent) remediates breaking changes; per Infield's own site, 'Infield combines automation with a team of expert developers to upgrade open source software safely.' writesCode is true because the service explicitly remediates breaking changes and ships upgrades, though the press release does not specify whether the AI or a human developer authors the final diff in every case.

Source: PR Newswire: Infield announces $3M funding to use AI to manage open-source dependency updates

Mixed3

CodeAnt AI

[GA]

CodeAnt AI·static analysis plus a model

Platform that bundles AI-driven pull-request review (line-by-line comments, auto-suggested fixes, AI PR summaries) with static analysis products (SAST, secrets detection, IaC misconfiguration scanning, SCA) and, more recently, agentic pentesting, as co-equal lines rather than review being the sole product.

Surface: PR bot (GitHub, GitLab, Bitbucket, Azure DevOps), IDE, CLI, cloud dashboard
Pricing: offers a free tier for open-source projects ('100% off for open source') and a 14-day free trial with no credit card required; tiered pricing for private repositories is on a separate pricing page not fully read for this entry

Benchmark signals

Listed among the tools evaluated in Martian's independent Code Review Bench per Martian's own description of its tool set. CodeAnt has also published its own blog post summarizing that benchmark ('Best AI Code Review Tools in 2026, Ranked by a 300,000-PR Benchmark'), but no CodeAnt-specific F1/precision/recall figure from Martian's own page was confirmed for this entry, so no score is recorded here.

Marked job: mixed (rather than review) because, unlike CodeRabbit's narrower 'agentic code-security monitoring' add-on, CodeAnt's own homepage positions AI Code Review, Code Security, Code Quality and AI Pentesting as separate, co-equal product lines under one platform. Founded 2023 per Y Combinator and press coverage (secondary-sourced); deployment and writesCode are omitted here because no page read for this entry confirmed them (a self-hosting FAQ question was found but not its answer, and only 'auto-suggested fixes,' not automatic commits, was confirmed).

Source: CodeAnt AI docs, Introduction

CodeRabbit

[writes code][GA]

CodeRabbit Inc.·SaaS·hybrid ensemble

Hosted AI code-review service that reviews pull requests line by line, triages and prioritises them, and adds what it calls agentic code-security monitoring. It comments on the PR and can also commit a fix.

Surface: GitHub and GitLab pull-request bot, IDE reviews, CLI reviews, web dashboard, and Slack
Pricing: freemium; a free tier and free trial are offered, with paid tiers on a separate pricing page not read for this entry
Open source: no

Benchmark signals

Martian's Code Review Bench (codereview.withmartian.com) is a real, independently run benchmark built by a research lab that does not sell a code review product; it launched 2026-02-26. Martian's own primary post describes the dataset as '200K+ PRs and updates daily', a live, continuously updated leaderboard rather than a fixed one-time count, and states that CodeRabbit has the highest recall in the benchmark's online data, at 0.54. CodeRabbit's own recap of its placement on that leaderboard states it evaluated 10 tools and reports an F1 score of 51.2% and a precision of 49.2%. Other vendors, including Qodo, cubic and Greptile, have separately claimed the top spot on other dates with different scores, so any single tool's ranking should be read as a dated snapshot of a moving leaderboard rather than a fixed, final result. Treat exact tool-count and PR-count figures as best checked live at codereview.withmartian.com rather than as fixed published numbers.

Seeded as the contrasting shape to deepsec: a hosted SaaS pull-request bot that commits fixes, against a self-hosted find-only CLI. Its engine is described only as an 'Ensemble of models & tools', and whether a customer model can be supplied is not stated, so pluggableEngines, codebaseContext, license and launched are left unset rather than assumed.

Source: CodeRabbit product site

DeepSource (Autofix)

[writes code][GA]

DeepSource·SaaS·static analysis plus a model

An AI code-review platform combining over 5,000 deterministic rules with an AI review agent to find issues including security vulnerabilities across a codebase, paired with Autofix, which generates pre-validated, mergeable patches for most identified issues rather than free-text suggestions.

Surface: PR bot, CI
Open source: no

Benchmark signals

DeepSource states it scored 84.51% F1 on the OpenSSF CVE Benchmark, run on 165 real CVEs from the OpenSSF dataset, and reports this as the highest of the tools it tested. This benchmark was run by DeepSource itself (using an LLM, Claude Opus 4.5, as its own judge) rather than published by OpenSSF or another independent third party, so despite drawing on OpenSSF's CVE dataset it should be treated as vendor-run rather than fully independent verification.

Categorized job as 'mixed' (like the already-tracked CodeRabbit) rather than 'security' because DeepSource markets itself first as a general AI code-review platform ('DeepSource automates code reviews') with security scanning and Autofix as one part of that, not a security-first tool. This is the tool the task brief itself named as the source of the 84.51 F1 claim; that figure is confirmed on DeepSource's own benchmarks page, and this entry reports it as vendor-run rather than repeating it as an independent result. No launched date was confirmed on a vendor page, so it is omitted. Quote lightly punctuation-normalized (em dash replaced with a comma) to satisfy this repo's no-em-dash copy rule while preserving the verbatim wording.

Source: DeepSource: Benchmarks

Agentic Developer Tools

Snapshot

2026-09-07

Coverage

25tools·7jobs covered·1drive coding agents·8self-hostable

Download