Sourcegraph Cody
Sourcegraph's coding agent with deep-context awareness across very large monorepos. Strong enterprise security story.
Delv Safety Grade: A
Score 82/100 · assessed 2026-04-18
Sourcegraph is a well-established enterprise code intelligence vendor with significant VC backing and Fortune 500 customers. Cody's maintainer credentials are excellent. The agent requires broad filesystem read access to index entire codebases, network access to Sourcegraph's backend or self-hosted instances, and can write code changes across multiple files. Permissions are appropriately scoped for a coding agent but still substantial. Supply chain is solid via official IDE extensions through VSCode and JetBrains marketplaces. Transparency is good with open documentation though the core agent logic appears partially proprietary. One known incident in 2023 involved prompt injection concerns in early versions, since addressed. The enterprise security story is genuine with SOC 2 compliance and self-hosted options, but the broad codebase access means compromised credentials or a supply chain attack would have significant blast radius.
Green flags
- Established enterprise vendor with SOC 2 Type II compliance
- Self-hosted deployment option for air-gapped environments
- Distributed via official IDE extension marketplaces
- Active security disclosure program and bug bounty
- Strong enterprise customer base including Fortune 500
Red flags
- Requires read access to entire codebase including proprietary code
- Network calls to Sourcegraph backend with code context
- 2023 prompt injection vulnerability in context retrieval
- Partial proprietary components limit full auditability
Permissions requested
Pricing
Platforms
Review
Worth paying for if you work in a large, established codebase where understanding beats speed. Skip it if you're building something new or working solo - the indexing overhead and price don't justify the gains over cheaper alternatives.
Good at
- Cross-repo context actually works - knows your entire codebase, not just open files
- Enterprise security options (self-hosted, on-prem) rare among AI coding tools
- Excellent for onboarding - surfaces architecture and data flow faster than docs
- Refactoring proposals span call sites across multiple services
- Integrates with existing Sourcegraph deployments if you already pay for those
Watch out
- Free tier severely limited (20 queries/day, no custom context)
- Overkill and slow for small projects - indexing overhead not worth it
- Pricing steep compared to Cursor or Continue unless already using Sourcegraph
- UI feels functional rather than polished, especially in VS Code
- Initial indexing can take hours for very large monorepos
Use cases
- Navigating huge legacy codebases
- Cross-repo refactors
- Security-conscious orgs needing on-prem
- New-engineer onboarding