Hi there, HN! We’re Jai and Sanket from DeepSource (YC W20), and today we’re launching Autofix Bot, a hybrid static analysis + AI agent purpose-built for in-the-loop use with AI coding agents.

AI coding agents have made code generation nearly free, and they’ve shifted the bottleneck to code review. Static-only analysis with a fixed set of checkers isn’t enough. LLM-only review has several limitations: non-deterministic across runs, low recall on security issues, expensive at scale, and a tendency to get ‘distracted’.

We spent the last 6 years building a deterministic, static-analysis-only code review product. Earlier this year, we started thinking about this problem from the ground up and realized that static analysis solves key blind spots of LLM-only reviews. Over the past six months, we built a new ‘hybrid’ agent loop that uses static analysis and frontier AI agents together to outperform both static-only and LLM-only tools in finding and fixing code quality and security issues. Today, we’re opening it up publicly.

Here’s how the hybrid architecture works:

- Static pass: 5,000+ deterministic checkers (code quality, security, performance) establish a high-precision baseline. A sub-agent suppresses context-specific false positives.

- AI review: The agent reviews code with static findings as anchors. Has access to AST, data-flow graphs, control-flow, import graphs as tools, not just grep and usual shell commands.

- Remediation: Sub-agents generate fixes. Static harness validates all edits before emitting a clean git patch.

Static solves key LLM problems: non-determinism across runs, low recall on security issues (LLMs get distracted by style), and cost (static narrowing reduces prompt size and tool calls).

On the OpenSSF CVE Benchmark [1] (200+ real JS/TS vulnerabilities), we hit 81.2% accuracy and 80.0% F1; vs Cursor Bugbot (74.5% accuracy, 77.42% F1), Claude Code (71.5% accuracy, 62.99% F1), CodeRabbit (59.4% accuracy, 36.19% F1), and Semgrep CE (56.9% accuracy, 38.26% F1). On secrets detection, 92.8% F1; vs Gitleaks (75.6%), detect-secrets (64.1%), and TruffleHog (41.2%). We use our open-source classification model for this. [2]

Full methodology and how we evaluated each tool: https://autofix.bot/benchmarks

You can use Autofix Bot interactively on any repository using our TUI, as a plugin in Claude Code, or with our MCP on any compatible AI client (like OpenAI Codex).[3] We’re specifically building for AI coding agent-first workflows, so you can ask your agent to run Autofix Bot on every checkpoint autonomously.

Give us a shot today: https://autofix.bot. We’d love to hear any feedback!

---

[1] https://github.com/ossf-cve-benchmark/ossf-cve-benchmark

[2] https://huggingface.co/deepsource/Narada-3.2-3B-v1

[3] https://autofix.bot/manual/#terminal-ui

Ten Years – OpenAI

Data Science Weekly – Issue 629

ChatGPT Is Pitching in to Help Federal Officers Misrepresent Protesters

What you should know about constraints in PostgreSQL

Show HN: A(nother) co-living directory for founders moving to SF

The AI Bolt-On Fallacy

Aule-Attention, FlashAttention That Works on AMD GPUs

Software Engineering Daily Podcast: Feross on AI, Open Source, and Supply Chain

The Farthest Christmas Tree

23,746 Patients Died on Waitlists in Past Year

The 1.4TB Bluff: Why my IDE thinks it's 700x bigger than it is

Andrew Braybrook "Discography"

Show HN: A Real-Time 4D Fractal Explorer in the Browser Using WebGPU

Developer career path: frontend or backend?

Show HN: A lightweight Git history explorer written in Go

A 3-hit metabolic signaling model for core symptoms of autism spectrum disorder

AI Generated Art Is Unmonetizable

Show HN: Pick and visualize real manufacturer paint colors on your home

Two new RSC protocol vulnerabilities uncovered

React2Shell and related RSC vulnerabilities threat brief

Powder and Stone. Or, Why Medieval Rulers Loved Castles

Cold Agglutinin Disease

Built an app to optimise men's energy, mood and testosterone – 6 months free

Surprise discovery under sands of Utah desert

Microsoft Is Back to Working on "Hornet" Security for eBPF Programs on Linux

Rivian is making AI chips that are more powerful than Google's

Evolving MSFT's approach to coordinated security research: In scope by default

New AI tool turns social chatter into pure sales Intel

Pg_ClickHouse Postgres Extension

Show HN: Autofix Bot – Hybrid static analysis and AI code review agent

Career Advice