Sourcegraph Cody - Enterprise AI That Actually Reads Your Whole Damn Codebase

UPDATE: As of July 23, 2025, Cody is enterprise-only. Sourcegraph killed the free and pro tiers. This review is still accurate for enterprise users, but individual developers need to look elsewhere.

Ask Copilot about your company's internal API and you'll get generic garbage. "Try using fetch() to call the API" - thanks genius, but which endpoint? What headers? What's the response format when authentication fails?

Sourcegraph has been building enterprise code search for years. Companies with monster codebases that would make VS Code cry. Now they've plugged that search engine directly into an AI that can actually see how your 47 microservices connect to each other.

Here's the difference: ask Cody to write error handling and it'll use the same patterns you already have in 73 other places in your codebase. It knows you use custom ApiError classes, that you log to Datadog with specific tags, and that your frontend expects {error: {code, message}} format.

Enterprise Setup Sucks But Works

Your security team will panic about sending code to external APIs. Mine spent 3 weeks asking questions like "what if Sourcegraph gets hacked?" Fair point, honestly.

You can run this whole thing on your own servers if you want. Deploy Sourcegraph first (that's the search engine), then bolt Cody on top. Took me a week and a half, mostly waiting for security approval and fighting with Kubernetes configs.

Memory usage is brutal. Plan for 60+ GB of RAM if you're indexing anything over 500k lines. Our 2M line monolith maxed out a 64GB box and we still had to restart the indexing job twice. Docker containers kept getting OOMKilled until we bumped the limits way up.

Pro tip: If you're on Kubernetes, the default resource limits will kill your indexing pods. Learned this the hard way after watching it fail at 90% completion three times.

VS Code works great. IntelliJ is okay but feels like an afterthought. Don't bother with Eclipse unless you hate yourself. GitHub repos work perfectly, GitLab is fine, Bitbucket integration exists but has weird edge cases.

The Magic Actually Works

Ask Cody to write a function that calls your user service and it'll use the right endpoint URL, include the auth headers your API expects, and handle the response format you actually return. Because it's read your OpenAPI spec and seen 47 other places where you call that service.

Writing database queries? It knows you use Prisma, that your User table has a deletedAt column for soft deletes, and that you always eager-load the profile relationship. Not magic, just more context.

Indexing is slow as hell though. Took 8 hours to churn through our React monolith the first time. Had to re-run the whole thing when we moved auth logic around and renamed half our API endpoints.

It uses Claude 3.5 by default which is pretty good at understanding messy codebases. You can switch to GPT-4 if you want but honestly Claude works fine and doesn't hallucinate as much.

So how does this actually stack up against the competition? That's what everyone really wants to know.

After 6 months of daily use, here's what Cody does well and where it'll make you want to throw your laptop out the window.

The Chat Actually Knows Your Weird Code

Ask it "How does auth work in our user service?" and it won't give you generic JWT explanations. It'll tell you about your custom AuthenticationMiddleware class, how you store session data in Redis with a 2-hour timeout, and why you have that weird refreshTokens table with the UUID primary keys.

You can @ mention specific files like @UserController and it'll pull up the actual implementation, not make up methods that sound reasonable. Works across different repos too, so it knows how your React frontend calls your Node.js API.

New hires love this because they can ask stupid questions without bothering senior devs. "What's this validatePermissions function do?" Instead of getting a sarcastic "read the code" response, they get an actual explanation. Cut our onboarding from 3 weeks to maybe 10 days.

Auto-Edit: Sometimes Brilliant, Sometimes Disaster

Change a function signature and Cody will suggest updating all the places that call it. Rename an API endpoint and it'll find the frontend components that hit that route. When it works, it's magic.

When it doesn't work, it'll suggest changing your database models to mutate Redux state directly. Broke our payment flow twice before I learned to double-check anything involving state management. The suggested changes look reasonable until you realize they'll crash production.

Still beats doing manual find-and-replace across 15 files though. Just run your tests after accepting suggestions, especially anything involving async code or state updates.

Custom Prompts: Worth the Setup Time

You can create shared prompts that know your team's weird conventions. "Generate unit tests using our Jest setup with the custom matchers" or "Review this code for SQL injection but ignore the admin endpoints."

Takes forever to write good prompts though. Spent half a day tweaking our test generation prompt because it kept creating tests that used the wrong mocking library. But now junior devs can generate tests that actually follow our patterns instead of copying random examples from Stack Overflow.

Pro tip: steal prompts from other teams and modify them. Don't start from scratch.

Why the Indexing Actually Matters

Cody builds a map of how all your code connects. When you're writing a database query, it knows you use Postgres with UUID primary keys, that you have a users_archive table for soft deletes, and that you always include the created_at timestamp in responses.

Working on an API endpoint? It knows which React components call that endpoint, what error format they expect, and that you always include CORS headers for the admin dashboard.

It reads everything - your README files, Docker configs, even your GitHub Actions workflows. Ask about deployment and it'll tell you about your staging environment setup and why you have that weird PRE_DEPLOY_HOOK script.

For Security Teams Who Don't Trust Clouds

Your security team will ask "what if Sourcegraph gets breached?" Fair question. They don't store your code long-term and you can see exactly what gets sent in the audit logs.

You can also run everything on your own AWS/Azure/GCP accounts using your own API keys. More complex setup but your code never leaves your cloud environment.

Full paranoid mode: run everything on-premises with no external API calls. Performance suffers because you're stuck with smaller local models, but some companies need that level of control. Takes weeks to set up properly.

Performance: Pretty Fast, Setup Sucks

Chat responses take 2-3 seconds, autocomplete is fast enough you don't notice delays. No complaints there.

The real pain is initial indexing. Took 8+ hours for our 2M line monolith, and the indexing process crashed twice when we ran out of memory. Once it's indexed though, search is fast even with our whole team using it.

Just don't expect to run this on your laptop. Budget for real hardware - 32GB+ RAM minimum, preferably 64GB if you're indexing anything substantial.

Also, the VS Code extension occasionally crashes when you have large files open. Seems to happen with files over 5k lines, especially JavaScript files with lots of imports. Restart VS Code and you're fine.

Want to see this thing in action? Here's the most useful setup tutorial I've found.