Windsurf: Devin Introduces Code Scans for Codebase-Wide Audits

Devin Gets a Goal-Driven, Codebase-Wide Audit Mode

Windsurf's Devin introduced Code Scans on September 16, 2026, a new way to turn a broad engineering goal, rather than a specific file or bug, into concrete pull requests. Instead of pointing Devin at a location in the codebase, developers now describe what they want to achieve, such as improving SEO, reducing maintenance overhead, or speeding up compilation, and Devin investigates the whole repository to find what needs to change, evaluates the findings, and proposes the fixes as PRs. Cognition frames this as addressing objectives that are easy to state but expensive to investigate manually, since the investigative phase across an entire codebase is normally the bulk of the work.

How Code Scans Work: Agentic MapReduce

Code Scans is built on Agentic MapReduce, the same architecture Cognition previously built for Devin Security Swarm, adapted here for general-purpose codebase audits. It runs in four phases:

• Plan: Devin studies the repository and defines rules for identifying code relevant to the stated goal.
• Shard: Those rules run across the codebase, and matching code is divided into focused batches.
• Map: Parallel Devin agents investigate each batch independently.
• Reduce: A final agent consolidates the batch results, removes duplicates, and prioritizes findings into a single report.

This lets Devin work through investigations that would otherwise exceed what a single agent could hold in context, by distributing the work and then synthesizing it back into one coherent set of findings.

Results From Early Testing

Cognition published two concrete demonstrations alongside the launch. Running a compilation-focused scan against the open-source Dioxus project, Devin analyzed thousands of files across 22 workspace crates and cut the clean debug build time from 58.6 seconds to 21.0 seconds, a 64% reduction. The findings behind that improvement included a default feature that was forcing in unnecessary web dependencies, an oversized foundational crate carrying volatile logic, proc-macro invocations tied to a 112-element table, unconditional cargo-generate compilation, and unnecessary inclusion of Tokio's "full" feature set.

Devin also ran an SEO-focused scan against Cognition's own sites, devin.ai and cognition.com, surfacing 44 findings that were fixed over the following days. That work raised devin.ai's Ahrefs health score from 87 to 92, cut the number of slow pages by 73%, and eliminated missing image alt text on cognition.com.

Beyond Cognition's own examples, Philips' Digital Computational Pathology team, part of Philips Enterprise Informatics, tested Code Scans ahead of general availability and reported a significant impact on "software quality, bug fixes, stability, performance, and compliance," with an estimated 96% pull request merge rate across several repositories and more than 700 engineering hours saved during the testing window.

Getting Started

Code Scans is available now by typing /scan in the Devin webapp, with full documentation published at docs.devin.ai/work-with-devin/code-scans. Cognition suggests the feature is best suited to goals with measurable, repository-wide requirements, such as migrations that need to touch every call site, enforcing a policy across many services, cleaning up dead code, closing test coverage gaps, checking accessibility or regulatory compliance, or hunting down performance and database-query problems that are scattered across a codebase.