DeepSweep — Runtime Governance for AI Coding Agents

中文说明 ↓

When one of your AI agents does something you have to answer for, can you produce the record of what it saw, decided, and did? Your AI coding agent can already run shell commands, reach your database, write to your repo, and call tools over MCP — right now, in this workspace. DeepSweep is the layer that governs those actions and turns them into a record you can stand behind.

DeepSweep is the Agent Evidence Layer — a flight recorder and circuit breaker for AI agents. The full layer sits in front of your MCP servers, enforces your allow / deny / require-human rules on every tool call, and writes each decision to a signed, hash-chained log you can verify offline — your data never leaves your machine, and when the regulator, insurer, or auditor asks, you have the tape.

This extension is the free, local first step. Run one command — DeepSweep: Review My Agent Environment — and in under a second you see every capability your agents have and every gap where they can act beyond what they should. No account, no cloud, nothing leaves your editor. It also flags what AI assistants get wrong as you type — prompt injection, hallucinated packages, leaked secrets, MCP misconfigs — the moment it lands. Works with Cursor, GitHub Copilot, Claude Code, Windsurf, and any AI coding tool. 77 patterns. Sub-second. Zero configuration.

From review to record. The extension shows you what your agents can do, locally and free. The DeepSweep gateway records and enforces what they actually do — signed, tamper-evident, offline-verifiable. Start here; graduate to the record layer when an incident, an auditor, or the EU AI Act's reporting clock makes "we have the tape" the difference.

Start with one command — DeepSweep: Review My Agent Environment — and see the whole picture in under a second: every capability your agent has, and every gap where it can act beyond what it should. Free, local, no account, no cloud, nothing leaves your editor.

And because it all runs on your machine, DeepSweep catches what your AI agent got wrong first — privately, in your editor — before it ever reaches a pull request, a CI pipeline, or your security team's dashboard. Local-first means the review is your private safety net — fix what you find quietly and ship clean. When you need the record instead of the fix — for an auditor, an insurer, or an incident report — the DeepSweep gateway is the tier that produces it.

See it in 20 seconds

Three surfaces, one record. Every line below is a real output from a governed run — nothing staged.

In your editor (Cursor, Windsurf, VS Code, Cline, Copilot): one command maps what each agent can do and where it acts beyond what you authorized.

In the terminal (Claude Code, OpenAI Codex, Aider): the agent's MCP calls pass through the gateway; a write it isn't authorized to make is denied, and the whole session verifies offline.

When a tool changes what it claims to do (any MCP client): the description drifts, the breaker trips, a human re-pins — and every step is in the signed ledger.

Review My Agent Environment

AI coding agents quietly accumulate capabilities you never explicitly granted — MCP servers with broad tool access, shell execution, database reach, repository write, deploy hooks. DeepSweep: Review My Agent Environment maps them in a single local pass:

• [CAPABILITIES] Detects what the agent can actually do — MCP tool access, shell execution, database access, repository write, deploy — by reading your workspace config (.cursorrules, mcp.json, agent settings). Metadata only; no source ever leaves the editor.
• [IDENTITY] Derives a deterministic local agent identity, so the review is stable and reproducible from one run to the next.
• [GAPS] Evaluates an advisory authorization policy and surfaces every gap where the agent can act beyond what it should — as findings you can read and act on, not enforcement that blocks you.

Runs fully on-device in under a second. No account, no cloud, no upload. Free.

The Review is the free on-ramp to agent authorization — knowing which agent is authorized to do what, and where it acts beyond that. Behavioral-Firewall enforcement is where authorization is carried through; the Review is how you start, local-first and at no cost.

Catch what AI assistants miss, as you type

Beyond the one-time environment review, DeepSweep watches every change your AI assistant makes and flags risk the moment it lands.

Traditional SAST tools (Snyk, SonarQube, Semgrep) check hand-written code against hand-written rules. They were not designed for what happens every time an AI agent generates, pastes, or modifies code in your editor.

DeepSweep is the first runtime-aware security tool built for agentic code. It detects the things AI assistants consistently get wrong — prompt injection in rules files, hallucinated dependencies, hardcoded secrets pasted from example code, MCP tool-access misconfigurations, and Unicode backdoors that look invisible to humans but execute faithfully at runtime.

• [VERIFY] Checks every save and keystroke (800 ms debounce). No CI wait.
• [LOCAL] Pattern matching runs entirely on your machine. Source never leaves the editor.
• [AGENTIC] AI-specific patterns with CVE references. Built for the .cursorrules, mcp.json, and agent-config attack surface.

Quick Start

1. Install — search DeepSweep in the Extensions view and click Install.
2. Review your agent — run DeepSweep: Review My Agent Environment from the Command Palette to see your agent's capabilities and authorization gaps.
3. Open a project — DeepSweep then checks AI-generated code automatically on open and on save.
4. Fix findings — click any finding for a one-line fix hint, or copy a remediation prompt and paste it back to your AI assistant.

Keyboard: Cmd+Shift+S (macOS) / Ctrl+Shift+S (Windows/Linux) to check the current file.

What It Detects

77 patterns total — 37 AI-specific and agentic-code-aware (prompt injection, MCP, rules-file, exfiltration, config) plus 40 traditional security patterns.

Features

• Review My Agent Environment — one-command local review of your agent's capabilities, identity, and authorization gaps (no account, no cloud)
• Live Checks — analyzes AI-generated code as you type, with an 800 ms debounce
• Certify-on-Write — catches an AI agent the moment it writes a new critical/high finding, with one-click Revert / Auto-Fix
• Verification Proof — see exactly what was checked: patterns, files, categories, duration
• 9 UI Surfaces — status bar, Problems panel, CodeLens, Quick Fix, tree view, webview, decorations, notifications, output channel
• AI Assistant Detection — identifies which tool generated the code (Cursor, Copilot, Claude, Windsurf)
• Finding Suppression — suppress with reason categories, expiration dates, and audit trails
• Fix All Auto-Correct — one-click static fixes across your workspace
• Security Badge — copy a shields.io-style badge for your README
• Config File Monitoring — auto-rechecks when .cursorrules, .env, or mcp.json change

Pricing

The Repo Grade, the AI Code Health Score, and the Agent Environment Review are free forever. Paid tiers unlock the fixes, never the grade. All checks run locally — no code is sent to external servers for pattern matching.

About: Agent Authorization

Model alignment is a statistical promise, not a per-action proof. An aligned coding agent can still silently delete a permission check, paste a hardcoded credential, or write a .cursorrules file that hides instructions in invisible Unicode — and it can act on your shell, your database, and your repo while doing it.

DeepSweep answers the question alignment can't: which agent is authorized to do what, and where is it acting beyond that? It starts with a free, local review of your agent's capabilities and authorization gaps, and carries that authorization through to the point where actions actually land — turning "we hope it behaves" into "we can see and prove what it did."

This extension is the reference implementation. The full argument lives in the book:

The Authorized Agent: Identity, Authorization, and Audit for AI Agents in Production Book One in the DeepSweep.ai Thesis series, by Brad McEvilly.

Coming Soon: Agent Interoperability Bridge

DeepSweep is building the security layer for the AI agent protocol stack.

• A2A Agent Card Review — 10 new security patterns for Google's Agent-to-Agent protocol
• ACP Manifest Checks — 5 new patterns for IBM's Agent Communication Protocol
• Cross-Protocol Security Graph — map dependencies between MCP, A2A, and ACP configs in your workspace
• Transitive Risk Analysis — when an MCP server is flagged, see which A2A workflows are affected

Phase 1 (A2A review) and Phase 2 (cross-protocol graph) are in development. 15 new patterns total (DS-A2A-001..010, DS-ACP-001..005).

Requirements

• VS Code 1.74.0+, Cursor, or Windsurf
• Node.js runtime (included with VS Code)

Commands

Privacy

DeepSweep runs pattern matching and the agent-environment review locally in your editor. No source code is sent to external servers for analysis. Anonymous usage telemetry helps improve detection accuracy and can be disabled in settings.

Hard telemetry off-switch: set the environment variable DEEPSWEEP_TELEMETRY=off before launching your editor and DeepSweep sends no telemetry at all — no analytics, no diagnostics, no telemetry network calls. Built for CI machines, corporate policy, and air-gapped environments; works in VS Code, Cursor, and Windsurf.

Diagnostics never carry your file paths. When something goes wrong, DeepSweep records the kind of problem — a file it could not read, a request that timed out — and never the message itself, so folder names, project names and your username stay on your machine.

Privacy Policy

Autonomous agent workspaces (Devin and similar)

DeepSweep also runs where no human is watching. In autonomous agent environments such as Devin, add DeepSweep to the machine snapshot the same way you'd install any editor extension — it activates with the workspace, reviews the agent environment on open, and re-checks files as the agent writes them, exactly as it does under a human's hands. The agent's workspace gets the same review a developer's would: prompt injection in rules files, hallucinated dependencies, leaked secrets, MCP misconfigurations — caught in the environment where the agent is actually working, before its output ships.

Teams already run DeepSweep inside Devin sessions today; no special configuration is needed beyond installing the extension into the snapshot.

Governance Studio

Pair the extension with DeepSweep Governance Studio for a seamless compliance and governance experience. Get your builds to production safely — without sacrificing efficacy or efficiency — and maintain a clear audit trail for all agentic AI IDEs: every review, verdict, and authorization decision your agents produce in VS Code, Cursor, and Windsurf, in one place.

The Studio is a desktop app that runs on your own machine. It reviews a workspace without uploading your source code, keeps a tamper-evident record of what your agents were allowed to do, and shows the same verdicts you see in the editor — gathered across every project, not one at a time.

Each surface shows what belongs there: the Studio shows your app version, update status and the last time your record was anchored; the extension offers to open the Studio when you have it.

Download: the Studio is distributed as a signed installer from deepsweep.ai. There is no package-manager install, and there is no command to type.

Links

• Website
• Governance Studio
• Changelog
• Open VSX

DeepSweep — AI 编码智能体的运行时治理

English ↑

DeepSweep 为 AI 编码智能体提供运行时治理：审查每个智能体能做什么，帮助你授权它应该做什么，并治理它实际做了什么——在 AI 助手出错的那一刻（提示注入、幻觉依赖包、泄露的密钥、MCP 配置错误）就当场捕获，赶在问题进入生产环境之前。支持 Cursor、GitHub Copilot、Claude Code、Windsurf、Trae 以及任何 AI 编码工具。77 条检测模式，亚秒级响应，零配置。

从一条命令开始——DeepSweep: Review My Agent Environment（审查我的智能体环境）——一秒内看清全局：你的智能体拥有的每一项能力，以及它可能越权行动的每一个缺口。免费、本地运行、无需账号、无需云端，任何内容都不会离开你的编辑器。

因为一切都在你的机器上运行，DeepSweep 会最先、私密地、在你的编辑器里发现 AI 智能体犯的错——早于 Pull Request、早于 CI 流水线、早于安全团队的仪表盘。本地优先意味着它是你的安全网，而不是你的"记录在案"：安静地修好，第一次就干净地交付。

审查我的智能体环境（Review My Agent Environment）

AI 编码智能体会悄悄积累你从未明确授予的能力——拥有广泛工具访问权的 MCP 服务器、Shell 执行、数据库访问、仓库写入、部署钩子。DeepSweep: Review My Agent Environment 在一次本地扫描中把它们全部映射出来：

• 【能力】 通过读取工作区配置（.cursorrules、mcp.json、智能体设置）检测智能体实际能做什么——MCP 工具访问、Shell 执行、数据库访问、仓库写入、部署。只读取元数据；源代码永远不会离开编辑器。
• 【身份】 派生确定性的本地智能体身份，使每次审查结果稳定、可复现。
• 【缺口】 评估一份建议性授权策略，标出智能体可能越权行动的每一个缺口——以可读、可处理的发现呈现，而不是阻断你工作的强制拦截。

完全在设备端运行，耗时不到一秒。无需账号、无需云端、无需上传。免费。

这份审查是通往智能体授权的免费入口——知道哪个智能体被授权做什么、它在哪里越了权。行为防火墙（Behavioral Firewall）负责把授权贯彻到底；而审查是你的起点，本地优先、零成本。

在你打字的同时，捕获 AI 助手漏掉的问题

除了一次性的环境审查，DeepSweep 还会关注 AI 助手做出的每一次改动，在风险落地的那一刻立即标记。

传统 SAST 工具（Snyk、SonarQube、Semgrep）用手写规则检查手写代码。它们并不是为"AI 智能体在编辑器里生成、粘贴、修改代码"这一新场景设计的。

DeepSweep 是第一款为智能体代码（agentic code）构建的运行时感知安全工具。它检测 AI 助手持续犯错的那些问题——规则文件中的提示注入、幻觉依赖、从示例代码粘贴进来的硬编码密钥、MCP 工具访问配置错误，以及人眼不可见、运行时却忠实执行的 Unicode 后门。

• 【验证】 每次保存和输入都会检查（800 毫秒防抖）。无需等待 CI。
• 【本地】 模式匹配完全在你的机器上运行。源代码永远不会离开编辑器。
• 【智能体感知】 附带 CVE 参考的 AI 专属模式，专为 .cursorrules、mcp.json 和智能体配置这一攻击面而构建。

快速开始

1. 安装 —— 在扩展视图中搜索 DeepSweep，点击 Install。
2. 审查你的智能体 —— 在命令面板运行 DeepSweep: Review My Agent Environment，查看智能体的能力与授权缺口。
3. 打开一个项目 —— DeepSweep 会在打开与保存时自动检查 AI 生成的代码。
4. 修复发现 —— 点击任一发现即可获得一行修复提示，或复制修复提示词，粘贴回你的 AI 助手。

快捷键：Cmd+Shift+S（macOS）/ Ctrl+Shift+S（Windows/Linux）检查当前文件。

检测范围

共 77 条模式 —— 37 条面向 AI 与智能体代码（提示注入、MCP、规则文件、外泄、配置），另有 40 条传统安全模式。

定价

仓库评级（Repo Grade）、AI 代码健康分和智能体环境审查永久免费。付费解锁的是修复能力，永远不是评级本身。所有检查都在本地运行——不会把代码发送到外部服务器做模式匹配。

隐私

DeepSweep 的模式匹配与智能体环境审查在你的编辑器内本地运行。不会把源代码发送到外部服务器进行分析。匿名使用遥测用于改进检测准确率，可在设置中关闭。

遥测硬开关： 在启动编辑器前设置环境变量 DEEPSWEEP_TELEMETRY=off，DeepSweep 将不发送任何遥测——没有分析、没有诊断、没有任何遥测网络请求。适用于 CI 机器、企业合规策略和隔离网络环境；在 VS Code、Cursor、Windsurf 中均生效。

诊断信息永远不携带你的文件路径。 出现问题时，DeepSweep 只记录问题的类型——某个文件无法读取、某个请求超时——绝不记录消息内容本身，因此目录名、项目名和用户名都留在你的机器上。

隐私政策

自主智能体工作区（Devin 等）

DeepSweep 也能在无人值守的环境中运行。在 Devin 这类自主智能体环境中， 只需像安装任何编辑器扩展一样，把 DeepSweep 加入机器快照（machine snapshot）—— 它会随工作区启动，在打开时审查智能体环境，并在智能体写入文件时持续复查， 与在开发者手中的表现完全一致。已有团队在 Devin 会话中运行 DeepSweep； 除了将扩展装入快照外，无需任何额外配置。

Governance Studio（治理工作台）

将扩展与 DeepSweep Governance Studio 搭配使用，获得顺畅的合规与治理体验：为所有智能体 AI IDE 保留清晰的审计记录——你的智能体在 VS Code、Cursor、Windsurf 中产生的每一次审查、判定和授权决策，都汇聚在一处。

Studio 是一款运行在你自己机器上的桌面应用。它在不上传源代码的前提下审查工作区，为"智能体被允许做什么"保留防篡改记录，并展示与编辑器中一致的判定结果——跨所有项目汇总，而不是一次只看一个。

下载： Studio 以签名安装包的形式从 deepsweep.ai 分发。

链接

• 官网
• Governance Studio
• 更新日志
• Open VSX