AI code security agents
Twelve verified listings whose primary job is code/application security (SAST/SCA findings, AI suggested fixes, or PR security review). Coding platforms that only integrate with scanners (Tembo, Devin, Factory Droids, GitHub Copilot coding agent) are listed in the Code security category with an “agent platform with security integrations” tag and are omitted from this table so they are not presented as dedicated AppSec tools. Fields come from the open dataset. This is not a ranking or score.
| Field |  GitHub Copilot Autofix |  Claude Code security review |  Cursor Bugbot |  Snyk |  Aikido AI AutoFix |  SonarQube AI CodeFix |  Codacy AI Reviewer |  Checkmarx One Assist |  Semgrep Multimodal |  GitLab Duo Vulnerability Resolution |  Veracode Fix |  Amazon Q Developer security scanning |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | GitHub | Anthropic | Anysphere | Snyk | Aikido Security | SonarSource | Codacy | Checkmarx | Semgrep | GitLab | Veracode | Amazon Web Services |
| HQ | United States · North America | United States · North America | United States · North America | United States · North America | Belgium · Europe | Switzerland · Europe | Portugal · Europe | Israel · Middle East | United States · North America | United States · North America | United States · North America | United States · North America |
| Primary category | Code security | Code security | Code security | Security | Code security | Code security | Code security | Code security | Code security | Code security | Code security | Code security |
| Also listed in | Code security, Security | Code security, Security | Code security, Security | Security, Code security | Code security, Security | Code security, Security | Code security, Security | Code security, Security | Code security, Security | Code security, Security | Code security, Security | Code security, Security |
| Summary | LLM-generated suggested fixes for GitHub code-scanning alerts (CodeQL). Part of GitHub Code Security / Advanced Security; no separate Copilot subscription is required. | Anthropic automated security review in Claude Code: the /security-review command and the anthropics/claude-code-security-review GitHub Action for pull-request comments. | Cursor’s AI pull-request reviewer. Official docs say it identifies bugs, security issues and code-quality problems and comments with explanations and suggested fixes. | Developer-first application security platform; Snyk Agent Fix (formerly DeepCode AI Fix) generates and validates AI-suggested remediations for Snyk Code findings. | Aikido AutoFix turns SAST, SCA, IaC, container, pentest and AI code-audit findings into reviewable pull requests or IDE patches. Vendor is Belgium-founded with a Ghent European HQ. | Sonar LLM-generated fix suggestions for a documented subset of SonarQube issues, in Cloud Team/Enterprise and Server Enterprise/Data Center editions. | Hybrid AI pull-request reviewer from Codacy (Lisbon). Combines static analysis with LLM context; vendor pages include security-vulnerability feedback and suggested fixes. | Family of agentic AppSec agents on Checkmarx One (Developer Assist in the IDE, plus triage/remediation). Checkmarx Ltd’s registered office is Ramat Gan, Israel. | Semgrep’s AI layer (successor branding to Semgrep Assistant) for detection, triage, remediation guidance and optional autofix on the Semgrep AppSec Platform. | GitLab Duo features that explain SAST vulnerabilities and open merge requests with proposed AI remediations, including an agentic resolution flow. | Veracode’s AI-assisted remediation for SAST flaws and SCA dependency vulnerabilities, with suggested patches in IDE, CLI and SCM workflows. | Amazon Q Developer code reviews that scan for SAST issues, secrets, IaC misconfigurations, quality issues, deployment risks and SCA, with some in-IDE suggested fixes. |
| Framework tags (Agent Index) | — | — | — | SOC 2, ISO 27001 | — | — | — | — | — | — | — | — |
| Frameworks (vendor-claimed) | — | — | — | — | — | — | — | — | — | — | — | — |
| Capabilities / tasks | appsec, sast, remediation, vulnerability management, pr review | appsec, pr review, sast, vulnerability management | pr review, appsec, remediation | vulnerability management, appsec, remediation, sast | appsec, remediation, sast, vulnerability management, iac | appsec, sast, remediation, code quality | pr review, appsec, sast, code quality, remediation | appsec, sast, remediation, vulnerability management, ide assist | appsec, sast, remediation, pr review, vulnerability management | appsec, sast, remediation, vulnerability management | appsec, sast, remediation, vulnerability management, sca | appsec, sast, secrets detection, sca, iac, remediation |
| Pricing (as published) | Included with GitHub Code Security. Public repositories: available at no extra Code Security licence. Private/internal repositories: GitHub Code Security is published at $30 USD per active committer/month on github.com/security/plans. Not a Copilot seat add-on; GitHub docs say no Copilot subscription is required. | Included with Claude Code for users on individual paid plans (Pro or Max) and pay-as-you-go API Console accounts, per Anthropic’s help centre. Public Claude plan list prices are on claude.com/pricing; the GitHub Action uses a Claude API key. | Usage-based on Individual and Teams plans; no separate Bugbot subscription. Cursor’s Bugbot page states Individual plans use included usage first, Teams bill from on-demand usage, and the average review costs $1.00–$1.50 depending on PR size. Enterprise trials are arranged with the account team. | Published plans on snyk.io/plans (Free / Team / Enterprise style tiers; verify current amounts on the plans page). | Published plans on aikido.dev/pricing include a free option and paid team plans (Basic listed at $300/month for 10 users on the pricing page at last check). Confirm current amounts on the vendor pricing page. | AI CodeFix is a paid-edition feature (SonarQube Cloud Team/Enterprise; Server Enterprise/Data Center). Sonar’s plans page lists SonarQube Cloud Team from $32/month; Enterprise and Server commercial editions are quote or sales-led. Community Build does not include AI CodeFix. | Developer IDE plugin is $0. Team plan, which includes AI Reviewer, starts at $18 per developer/month billed annually ($21 monthly) on codacy.com/pricing. Business is custom. | Not verified | Free Edition: no charge for up to 10 contributors, 60 AI credits included, up to 10 private repositories. Teams starts at Code or Supply Chain $30/month/contributor and Secrets $15/month/contributor, with 20 AI credits per developer/month. Enterprise is volume/quote with 50 AI credits per developer/month. Figures from semgrep.dev/pricing at last check. | Requires GitLab Ultimate and a GitLab Duo add-on (Duo Enterprise or Duo with Amazon Q per docs). GitLab.com Premium is published at $29 per user/month billed annually with included GitLab Credits; Ultimate is listed on about.gitlab.com/pricing without a public dollar amount (sales/credits). Confirm current Duo add-on prices with GitLab. | Not verified | Free Tier with monthly limits; Amazon Q Developer Pro is $19 per user/month on aws.amazon.com/q/developer/pricing. Security scanning is a capability of those tiers, not a separately priced SKU on that page. |
| Pricing model | freemium | published-tiers | published-tiers | freemium | freemium | published-tiers | freemium | quote | freemium | published-tiers | quote | freemium |
| Primary source | https://docs.github.com/en/code-security/concepts/code-scanning/autofix-for-code-scanning | https://support.claude.com/en/articles/11932705-automated-security-reviews-in-claude-code | https://cursor.com/docs/bugbot | https://snyk.io/plans/ | https://www.aikido.dev/code/autofix | https://docs.sonarsource.com/sonarqube-cloud/managing-your-projects/administering-your-projects/ai-features/enable-ai-codefix | https://www.codacy.com/ai-reviewer | https://checkmarx.com/product/checkmarx-one-assist/ | https://semgrep.dev/products/semgrep-multimodal | https://docs.gitlab.com/user/application_security/remediate/duo/ | https://www.veracode.com/products/fix/ | https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/code-reviews.html |
| Last checked | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 |
| Official site | https://docs.github.com/en/code-security/concepts/code-scanning/autofix-for-code-scanning | https://support.claude.com/en/articles/11932705-automated-security-reviews-in-claude-code | https://cursor.com/docs/bugbot | https://snyk.io/ | https://www.aikido.dev/code/autofix | https://docs.sonarsource.com/sonarqube-cloud/managing-your-projects/administering-your-projects/ai-features/enable-ai-codefix | https://www.codacy.com/ai-reviewer | https://checkmarx.com/product/checkmarx-one-assist/ | https://semgrep.dev/products/semgrep-multimodal | https://docs.gitlab.com/user/application_security/vulnerabilities/ | https://www.veracode.com/products/fix/ | https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/code-reviews.html |
Coding platforms that only reach this category through a scanner integration are tagged agent platform with security integrations and are omitted from this table so they are not presented as dedicated AppSec products: Tembo, Devin, Factory Droids, GitHub Copilot coding agent.
Side-by-side data is generated from the open dataset. “Vendor-claimed” frameworks are as marketed by each vendor and not verified by Agent Index; framework tags indicate relevance, not certification. Request current quotes from each vendor before buying. This page does not rank or score vendors. Sponsored comparisons, if any, will be labelled.
Related
- GitHub Copilot Autofix alternatives
- Claude Code security review alternatives
- Cursor Bugbot alternatives
- Snyk alternatives
- Aikido AI AutoFix alternatives
- SonarQube AI CodeFix alternatives
- Codacy AI Reviewer alternatives
- Checkmarx One Assist alternatives
- Semgrep Multimodal alternatives
- GitLab Duo Vulnerability Resolution alternatives
- Veracode Fix alternatives
- Amazon Q Developer security scanning alternatives
- Best code security AI agents