AI Code Reviews

What is Sourcery?

Sourcery is an AI-powered code review and code security platform designed for development teams. It can automatically generate summary of changes, line-by-line comments, and improvement suggestions in pull requests, as well as continuously scan code repositories for security issues.

The product can be connected to GitHub, GitLab, and enterprise-hosted code platforms, and it integrates into developers’ daily workflows through IDE extensions. Teams can also create custom review rules to ensure that the automated feedback aligns better with internal engineering standards.

A one-sentence summary

Sourcery uses AI to automatically review pull requests and scan for security risks in repositories, helping teams to identify defects more quickly, enforce consistent coding standards, and reduce the burden of manual reviews.

Core functions

• Pull request summary: Outlines the purpose of this change, the scope of its impact, and the key documents involved.
• Line-by-line code comments: Indicate potential defects, readability issues, or areas for improvement next to the relevant code lines.
• Senior review comments: Provide overall feedback from the perspectives of design, logic, maintainability, and risks.
• One-click repair suggestions: Provide modification solutions that can be applied directly or further adjusted for certain issues.
• Review status check: The results of the automatic review are displayed within the merging process, which facilitates the establishment of quality standards.
• Warehouse-level analysis: Helps teams monitor code quality, review activities, and issue distribution.
• Custom rules: Automatic review is carried out in accordance with team structure, security policies, and coding standards.
• IDE assistance: Interpreting code in the editor, adding tests, generating documentation, or optimizing implementations.

Automatic review of pull requests

Once installed in the code repository, Sourcery triggers reviews for new pull requests or subsequent commits. The results include a summary, overall feedback, line-by-line suggestions, and status checks, which developers can handle within the existing collaboration interface.

• It is possible to quickly understand significant changes without having to open every file one by one.
• Obvious errors, missing boundaries, and inconsistent implementations were detected prior to manual review.
• Have the reviewers focus their attention on the architecture, product logic, and complex risks.
• Recheck after submitting the update to see if the issue has been resolved.

Code security scanning

Sourcery’s security capabilities go beyond merely checking for current differences; it can also scan connected repositories. The official documentation classifies the areas that are scanned into categories such as keys, static application security, Infrastructure as Code, dependencies, and licenses.

• Key scanning: Identifies tokens, passwords, and credentials that may be submitted to a repository.
• Static application security: Identifying common security vulnerabilities and risky data flows in code.
• Infrastructure as Code: Check cloud resources and deployment risks in the configuration files.
• Dependency scanning: Identifies known vulnerabilities, outdated components, or supply chain issues.
• License scanning: Helps teams identify license risks associated with third-party dependencies.

Custom review rules

The recommendations provided by general AI may not suit the technical capabilities and business constraints of each team. Sourcery allows teams to set up custom rules, using natural language or project configurations to specify the criteria that should be continuously checked.

• When requesting the addition of a new interface, it is necessary to include authentication, permission checks, or parameter validation as well.
• Restrict libraries, patterns, or outdated interfaces that the team no longer wishes to use.
• Check whether the logs, exception handling, testing, and documentation comply with internal standards.
• Add domain review prompts for financial, medical, or enterprise software.
• Transform the repeatedly appearing manual review comments into reusable rules.

Code summary and visualization

Plans Pro and higher include the capability to view request summaries and visual representations, which helps reviewers quickly get an overview of the changes. In cases involving multiple modules, collaborative work among several people, or legacy systems, it is more efficient to first read the structured summaries rather than going straight to the details.

AI programming assistance in IDEs

Sourcery can be used in VS Code, Cursor, Windsurf, and the JetBrains series of IDEs. Developers can understand old code during the coding phase, generate tests and documentation, improve readability, and reduce the number of issues that are discovered only after the code is submitted in a pull request.

• Explain unknown functions, module relationships, and the intended purpose of existing code.
• Add unit tests, edge cases, and documentation strings to the existing logic.
• Look for implementations that affect readability, performance, or maintenance costs.
• Handle automatically detectable quality issues before submission.

Supported platforms and integrations

Which users are it suitable for

• Software development teams that need to reduce the waiting time for pull requests.
• Platform engineering teams that aim to establish unified code review standards for multiple warehouses.
• Small and medium-sized teams that lack dedicated security personnel but require basic, ongoing scanning.
• Engineering organizations that are responsible for maintaining large legacy codebases, cross-language projects, or complex services.
• Maintainers who wish to obtain free automatic review for open-source projects.
• Large enterprises that require private deployment, built-in models, or strict data control.

Typical use cases

• Function development: Check for logical errors, missing tests, and exception handling before merging.
• Code refactoring: Verify that the refactoring does not introduce any changes in behavior or new maintenance risks.
• New member collaboration: Use consistent feedback to help new members understand the project standards.
• Open-source maintenance: Provides the first round of automatic review for external contributions to public repositories.
• Security governance: Regularly scan for issues related to keys, dependencies, and static code.
• Multi-warehouse management: Centralized monitoring of risks and review activities for a large number of projects.
• Compliant development: Enhance control over sensitive code through rules and private deployment.

Sourcery usage tutorial

1. Create a Sourcery account using your work account, and choose GitHub or GitLab as the connection method.
2. Install the corresponding application or complete the authorization process, and select only the organizations and repositories for which you want to enable review.
3. Create a new test pull request to verify that the summary, comments, and status checks appear as expected.
4. Adjust the number of comments, the triggers, and notification settings according to the project’s language and team processes.
5. Add a small number of high-value custom rules, and use actual changes to verify false positives.
6. Developers are invited to participate in the trial, with the review speed, acceptance rate, and any issues missed being recorded.
7. After confirming the effectiveness, expand it to more private repositories and set up seats and permissions.

How to configure custom rules

1. By gathering the review comments repeatedly submitted by the team, rules that can be clearly determined are given priority.
2. Formulate the rules as specific requirements, and add applicable categories, languages, or exceptions.
3. Test the rules on sample pull requests to check whether ambiguous or duplicate comments are generated.
4. Have the engineer in charge of this module verify whether the suggestions are accurate and feasible to implement.
5. Introduce rules gradually and regularly remove projects that are of low value, outdated, or generate many false positives.

How to use security scanning

1. Start by selecting a small number of representative warehouses to conduct scanning; do not assign all past issues to the team at once.
2. View findings categorized by key, application security, infrastructure, dependencies, and licenses.
3. Give priority to addressing high-risk issues that can be exploited, affect production, or contain genuine credentials.
4. Assign responsible persons and deadlines for the confirmed issues, and document the criteria used to determine false alarms.
5. After the repair, scan again, and add preventive rules to the submission and merging processes.

Suggestions for implementing the team approach

1. It is clear that AI is responsible for the first round of checks, while the final decision on merging the results remains with human reviewers who have context awareness.
2. Establish a baseline for the pilot project, and compare the wait times, defect rates, and acceptance rates of comments before and after its implementation.
3. Limit the density of robot-generated comments to prevent a large number of low-priority suggestions from overwhelming the genuine risks.
4. Integrate security findings into existing ticketing, vulnerability response, and exception approval processes.
5. Review custom rules, false positives, and ignored comments on a monthly basis, and continuously optimize them.

Package price

Sourcery charges on a monthly basis based on the allocated seats, with an annual payment option that offers a 20% discount. Public repositories and open-source projects can use the free plan, while private repositories require a paid version tailored to needs related to auditing, security scanning, and enterprise deployment.

Differences in packages

Subscription and Seat Rules

• An annual subscription can save 20% compared to a monthly one.
• The fee is calculated only based on the seats allocated to the members.
• Private warehouses can be tried out for free for 14 days first.
• It can be canceled or downgraded at any time, and remains valid until the end of the current payment cycle.
• Public repositories and open-source projects offer free code review services.
• The price for Enterprise requires a quote based on deployment, support, and organizational requirements.

What can you do with the free version?

The Open Source program is designed to serve public repositories, offering automated code review capabilities on a level close to that of the Pro version. Security scans are provided free of charge for 3 repositories, once every two weeks, which is ideal for developers who want to experience the core processes.

The fact that open-source projects are supported free of charge does not mean that the Sourcery commercial platform itself is open source; private repositories, additional security scans, analysis tools, and enterprise-level features still require paid subscriptions.

Data and Privacy

Sourcery needs to read and examine the code in question, and it utilizes model services such as Azure OpenAI, Anthropic, and OpenAI to carry out certain processing tasks. According to the official statements, models are not trained using customers’ code or messages, and Sourcery itself does not store such code or messages.

• Code is usually handled in the form of differences from pull requests or the segments required to complete review.
• Model service providers do not use customer code and messages for training.
• The official statement is that third-party storage lasts no more than 30 days.
• Companies can evaluate the option of no retention, using their own model endpoints, or opting for a self-hosted solution.
• For sensitive projects, it is still necessary to verify the contracts, data areas, access permissions, and deletion mechanisms.

Enterprise security capabilities

• SOC 2 certification is used to assist companies in reviewing their control measures.
• The zero-retention option is suitable for teams with more stringent requirements regarding the storage of third-party data.
• It includes its own large-model endpoints, enabling organizations to use approved model services.
• Self-hosted Sourcery to minimize the extent to which code leaves the internal environment.
• It supports enterprise code platforms and allows connection to internal GitHub or GitLab instances.
• Prioritize support and customer success services to assist with large-scale launches.

Product advantages

• It is integrated directly into the pull request process, eliminating the need for developers to switch tools frequently.
• It covers both code quality review and various types of security scanning.
• Custom rules are supported, allowing team experience to be transformed into ongoing checks.
• Compatible with GitHub, GitLab, enterprise self-hosted platforms, and major IDEs.
• Open-source projects are free of charge and suitable for maintenance processes as well as community contributions.
• Team and Enterprise offer multi-warehouse analysis, built-in models, and options for private deployment.
• The pricing is based on the allocated seats, and the package tiers are fairly clear.

Usage restrictions and precautions

• AI review may produce false positives, omissions, or misinterpretations of the business context, and it cannot replace human approval.
• Automatic summarization and line-by-line suggestions are not equivalent to a complete architecture and threat modeling.
• The number of security scanning repositories and their frequency for Open Source and Pro are limited.
• Pro’s security scanning is a limited version and not suitable as a replacement for a comprehensive security operation system.
• The cost of payment increases as the number of allocated seats and the size of the team grow.
• To handle proprietary code, it is necessary to organize the evaluation of model providers, determine retention periods, and define data areas.
• Too many custom rules can lead to duplicate comments and review noise.
• Features such as self-hosting, priority support, and invoicing are available only in Enterprise.
• Warehouse languages, generated code, and complex business logic can affect the quality of recommendations.
• Security findings still require manual confirmation, sorting, correction, and retesting.

GitHub and open source

The official Sourcery GitHub organization has made available a repository named sourcery; this repository is licensed under the MIT license and contains product documentation, pre-commit hook configurations, demonstration materials, as well as some project settings. Currently, there is no code in any identifiable programming language within this repository.

Therefore, the MIT license applies only to the files in that public repository; it cannot be inferred that the Sourcery code review service, the security scanning backend, or the entire enterprise platform are open source. The tool catalog should label the core product as a closed-source commercial service, while explicitly stating that the official public repository is licensed under MIT.

Basic information

Recommendation score

4.5 / 5. Sourcery is suitable for development organizations that wish to integrate the first round of AI reviews, security scans, and team rules into their existing pull request processes; it offers a clear range of services along with well-defined package options. However, AI-generated feedback still requires human evaluation, and teams working with private code must first conduct risk assessments of their data and the suppliers involved.

Frequently Asked Questions

What is Sourcery mainly used for?

It automatically reviews pull requests, generates summaries of the changes along with line-by-line suggestions, and scans the repository for security issues.

Does Sourcery support GitLab?

It supports GitLab.com and self-hosted GitLab, as well as GitHub.com and GitHub Enterprise Server.

Is Sourcery free?

Public repositories and open-source projects can use the free plan, while private repositories usually start with a 14-day trial before the user can choose the Pro plan or a higher tier.

How much is Sourcery?

Pro costs $12 per seat per month, Team costs $24 per seat per month, while Enterprise requires a customized quote; paying annually saves 20%.

What security issues can it scan for?

The official documentation lists keys, static application security, Infrastructure as Code, dependency, and license scanning.

Does Sourcery use code to train models?

The official statement is that Sourcery and its model service providers do not use customer code or messages to train models.

Does Sourcery support self-hosting?

It is supported, but self-hosting is an Enterprise feature; you need to contact the officials for evaluation and a quote.

Can one use the company’s own large models?

The Team includes built-in large model capabilities; the specific methods of support and data pathways should be confirmed with the official party prior to deployment.

Is Sourcery open source?

The core code reviews and security platform are not open source; the official GitHub documentation states that the repository is licensed under the MIT license, but it does not contain the complete code for the product.