Codeep vs VulnFeed

Codeep and VulnFeed are both cli coding agents tracked by AIDiveForge. Below is a side-by-side comparison of pricing, capabilities, platforms, and ownership — sourced from each tool's live website and verified before publishing.

Codeep

Codeep is an open-source, terminal-native autonomous agent that reads your project structure, plans a sequence of steps, edits files, runs shell commands, and checks its own output against your build and test suite before declaring done. You describe the goal; it handles the steps. The self-verification loop — where it catches a broken typecheck and fixes it without prompting — is the part that separates it from a glorified shell wrapper. The ceiling appears on projects where the agent's context window fills before it has mapped the full dependency graph; community reports suggest large monorepos with deep cross-module dependencies push that limit faster than single-service repos. At that point, teams either scope tasks more tightly or reach for a dedicated sub-agent delegation pattern.

VulnFeed

VulnFeed is an MCP server that reads your lockfile directly, cross-references NVD and GitHub Advisories against only the packages you ship, and surfaces results ranked by EPSS — the exploit probability score that separates CVEs attackers are actually using from the ones sitting dormant for years. It runs locally via a single uvx command and feeds results into Claude Code, Cursor, VS Code, or Windsurf. The free tier caps at 10 scans per day and one monitored project; teams that scan frequently or monitor multiple repos will hit that ceiling fast. At that point, the choice is a paid upgrade or a full migration to something like Snyk, which adds code-level remediation context VulnFeed does not provide.

Attribute	Codeep	VulnFeed
Pricing	Free	Paid
Price	—	$14/mo
Free trial	No	No
Open source	Yes	No
Has API	Yes	Yes
Self-hosted option	Yes	Yes
Platforms	macOS, Linux, Windows (WSL)	Claude Code, Claude Desktop, Cursor, VS Code, Windsurf
Released	2026-05-30	—
Pros	Self-verification after every change set — the agent runs your build and tests and fixes failures before surfecting results — so you are not debugging a half-finished diff at the end of a long task. Provider-agnostic model routing across 9+ providers including local Ollama models, so switching away from a hosted API when costs spike is a config change rather than a platform migration. Plan Mode shows every file and command before execution, so teams with sensitive codebases or compliance requirements can review the agent's intent before a single line changes. Sub-agent delegation keeps the main context focused by offloading self-contained tasks (research, review, testing) to specialist agents that run in their own fresh windows, which means large tasks stay coherent longer than a single flat context allows. Apache 2.0 open-source with self-hosted option, so organizations running custom or private LLM infrastructure are not forced to route code through a third-party SaaS platform.	Reads your actual lockfile rather than scanning the full language ecosystem, which means you see only CVEs that affect packages you ship — not hundreds of irrelevant hits from packages you never installed. EPSS scoring surfaces CVEs by real-world exploit probability alongside severity, so you patch the vulnerability attackers are using instead of the one with the highest CVSS number that has sat unexercised for three years. Returns the exact upgrade version per package rather than stopping at 'you are vulnerable,' which means the fix is actionable inside the same conversation with your AI client. Continuous monitoring indexes new CVEs shortly after publication, so a vulnerability disclosed overnight appears in results at your next morning session rather than at your next scheduled scan. Flat-rate paid tier is not per-seat or per-repo, which means a team adding a second developer or a third project does not trigger a pricing jump.
Cons	On large monorepos with deep cross-module dependencies, the agent's context window fills before it has mapped the full dependency graph — tasks that span many modules require manual scoping or staged sub-agent delegation, and the verification loop can cycle on failures it cannot resolve without broader context. Codeep is CLI-first; teams that rely on an IDE canvas to visualize agent state, inspect intermediate steps, or approve changes inline will find the terminal output model insufficient — those teams typically switch to an IDE-native agent like Cursor or a visual workflow tool. With roughly 4,500 downloads in the past 30 days and 19 GitHub stars at time of data capture, the community is early-stage — production war stories, third-party integrations, and community-maintained skill libraries are sparse compared to established agent frameworks, which means debugging edge cases lands entirely on your own investigation or the vendor's docs.	The free tier caps at 10 scans per day and one monitored project — a developer running scans across multiple services or triggering scans on file save will exhaust the daily quota before noon, at which point scanning stops until the counter resets. VulnFeed identifies vulnerable versions and recommends upgrade targets but provides no code-level remediation: no PR generation, no inline diff, no analysis of whether your specific call path reaches the vulnerable function. Teams that need that layer move to Snyk or Socket, both of which offer it — at significantly higher per-developer cost. The tool set covers scanning, CVE lookup, monitoring, and alerts, but there is no policy enforcement layer. Teams that need to fail a build when a CRITICAL CVE with high EPSS is introduced have to wire that logic themselves outside VulnFeed.

Bottom line

Codeep is free while VulnFeed is paid; Codeep is open source. Choose based on which difference matters most for your workflow.

Frequently asked questions

What is the difference between Codeep and VulnFeed?

Codeep is Free and open source, while VulnFeed is Paid. Compare pricing, free trial, API, platforms, and pros/cons in the table above on AIDiveForge.

Is Codeep better than VulnFeed?

It depends on your workflow. Use the side-by-side attributes (pricing, open source, API, self-hosted, platforms) to decide. AIDiveForge does not rank a universal winner — we publish verified facts so you can choose.