DeepAudit is an open-source, AGPL-3.0 licensed multi-agent system for mining code vulnerabilities, written in Python, that gives individual developers, small security teams, and DevSecOps groups an AI audit crew they can deploy and run themselves.

What it is

DeepAudit is a multi-agent code audit platform that lives in the Developer Tools / Version Control & Collaboration ecosystem. A React 18 and TypeScript 5.7 frontend talks to a FastAPI 0.100+ backend on Python 3.11 or newer, and the agents inside it collaborate autonomously to review a codebase and then verify what they suspect by executing an automated sandbox proof of concept. The project is described as the first open-source multi-agent system of its kind for code vulnerability mining, with version 3.0.4 published on its releases page.

The concrete problem it targets is the cost and complexity of security audit. Traditional static analysis tools produce long lists of unverified candidates that a human must triage, while commercial AI audit platforms are closed, expensive, and require shipping source code to a vendor. DeepAudit replaces that combination with an open, self-hostable pipeline in which the reasoning is visible in a live audit-stream log and each candidate finding can be pushed through sandbox PoC verification before anyone acts on it. Its topic list places it squarely among SAST, security-scanner, code-review, and DevSecOps tooling.

Key capabilities

• Multi-agent collaborative audit, with the audit-stream log showing agent reasoning and execution step by step as the review proceeds.
• Automated sandbox PoC verification of suspected vulnerabilities, so findings arrive confirmed rather than as raw candidates.
• Ollama private deployment, allowing the language model to run locally, plus support for relay stations where a hosted model endpoint is needed.
• Instant analysis mode that accepts pasted code or an uploaded file and returns results directly.
• Project management that imports repositories from GitHub, GitLab, and Gitea and tracks multiple projects side by side.
• One-click report export in PDF, Markdown, and JSON formats.
• A dashboard view of overall project security posture, and a published track record of 49 CVE identifiers and 6 GHSA advisories across 17 well-known open-source projects.

Who uses it and how

• Individual developers and small teams without a dedicated security function use the one-click deployment path to run an audit without standing up a security programme.
• DevSecOps groups that cannot send proprietary source code to a third party run the model through Ollama private deployment instead of an external API.
• Security researchers auditing third-party open-source software, as in the OpenClaw engagement where six confirmed advisories covering command injection, signature verification bypass, code execution, credential exposure, resource exhaustion, and information disclosure were reported.
• Organisations managing several repositories import them from GitHub, GitLab, or Gitea and use the dashboard to compare security posture across the portfolio.
• Teams with reporting obligations export findings as PDF, Markdown, or JSON for handoff and remediation tracking.

Getting started

The README describes one-click deployment intended to work without deep setup experience, with the model backend supplied either by an Ollama private deployment or by a relay station. The current release is version 3.0.4; the facts here do not list a package name, Docker image, or compose file, so installation specifics should be read from the repository itself.

How it compares

No list of paid products that this project replaces is provided in the facts, and no comparable tools are named either, so DeepAudit stands alone in this registry. Its distinguishing property is that it is the open-source member of a category otherwise represented by closed products, which is what makes its AGPL-3.0 licence and self-hosting story relevant.

When to use it — and when not to

A self-hoster must operate the FastAPI backend and React frontend together and supply a model, either locally through Ollama or through a relay station; the facts do not specify the database, storage, or mail services involved, so those requirements should be confirmed before planning a deployment. Anyone expecting the published CVE and GHSA record to be reproduced by the open-source edition should note that the 49 CVEs and 6 advisories were found by the closed-source version, and the open repository currently carries 94 open issues. Teams unwilling to accept AGPL-3.0 copyleft obligations, or those needing a vendor-supported contract with defined SLAs, are not the right fit.