What it does
Sourcery reviews each pull request or merge request within minutes. It posts a summary of the change, review comments and suggested fixes, and it flags bugs such as logic mistakes, overlooked edge cases and security problems. Suggested changes can be committed to the PR in one click, and PRs judged low risk with nothing blocking can be auto-approved. Security scanning is a separate feature. It checks changed code for vulnerabilities and runs scheduled scans for leaked secrets, vulnerable code, infrastructure misconfiguration and dependencies with known CVEs. Sourcery works with GitHub and GitLab, including self-managed GitLab, and lists VS Code and PyCharm integrations. The site says it reviews every programming language GitHub recognizes, retains nothing of your code once a review finishes, never uses it for AI training, and holds SOC 2 Type II compliance. The Enterprise plan runs inside your own infrastructure with your own LLM keys and also covers GitHub Enterprise Server.
Capabilities
- PR summaries, review comments and suggested fixes
- One-click commit of suggested changes
- Optional auto-approval of PRs judged low risk
- Security scanning in PRs plus scheduled scans of the whole codebase
- Works with GitHub and GitLab, with VS Code and PyCharm integrations
- Self-hosted option on the Enterprise plan
When to use it
- Your team has a pull request backlog and wants a first review within minutes
- You review code written by teammates or by coding agents and want a summary of what changed
- You want security checks on each PR and periodic scans of existing code
- You need reviews to run inside your own infrastructure with your own LLM keys
