Cognition launches Devin Code Scans to turn engineering goals into codebase-wide PRs

What Code Scans does

Cognition has launched Code Scans, a new capability of its AI engineer Devin that takes broad engineering goals — improve SEO, cut maintenance overhead, make an application compile faster — and turns them into prioritized findings and, eventually, codebase-wide pull requests. According to the company's announcement, dated September 16, 2026 and surfaced on the Hacker News front page, the feature targets work that sits on the backlog because the investigation alone is a sizable project.

Users start by typing /scan in the Devin webapp and describing an outcome rather than pointing at specific files — for example, asking Devin to find unused code while excluding generated files and test fixtures, and checking for indirect references before recommending removal. Teams can also supply their own criteria, such as coding standards, an accessibility checklist, or requirements for an upcoming migration, and Devin helps establish what to inspect, what to skip, and what should count as a finding. Once the scope is confirmed, Devin runs the investigation, returns a priority-ordered list of findings, and can open PRs for the issues the user selects after reviewing the evidence and discussing the results.

Under the hood: Agentic MapReduce

Code Scans is built on Agentic MapReduce, the architecture Cognition originally built for Devin Security Swarm, and it processes large investigations in four phases:

• Plan: Devin examines the repository and writes rules that identify code relevant to the stated goal.
• Shard: the rules are executed across the codebase and the matching code is grouped into focused batches.
• Map: multiple Devin agents work through the batches in parallel, reading surrounding code as needed and reporting what they find.
• Reduce: a final agent consolidates the results, strips out duplicates and ranks the remaining issues into a single report.

The stated benefit is that each agent's context stays narrow, directing the reasoning budget toward relevant code instead of repeated searching.

The numbers Cognition shared

To demonstrate the feature, Cognition ran a compile-time scan against the Dioxus repository. Devin proposed streamlining dependencies and build configuration, including making heavyweight CLI features opt-in rather than compiled by default. After applying the changes locally, clean debug build time reportedly fell from 58.6 seconds to 21.0 seconds — a 64% reduction across the 22 workspace crates tested. The scan surfaced issues such as a default mounted feature pulling web-sys, js-sys and wasm-bindgen into every non-web renderer, cargo-generate being compiled unconditionally in dioxus-cli despite serving only the scaffolding path, and dioxus-ssr depending on tokio's full feature set while using only its fs and io-util modules.

A second scan for SEO issues across devin.ai and cognition.com surfaced 44 findings, with fixes shipped over the following days. Comparing Ahrefs crawls before and after, Cognition says the health score on devin.ai rose from 87 to 92, slow pages dropped by 73%, and missing image alt text was eliminated on cognition.com. Sample findings included case-study pages emitting relative Open Graph image URLs where the spec requires absolute ones, a two-hop redirect chain on a URL with 157 live backlinks, a homepage og:url resolving to a non-canonical /index, and an expired webinar page left indexable with metadata still advertising registration.

A customer quoted in the announcement reported an estimated 96% PR merge rate across several repositories and more than 700 engineering hours saved during the short testing period, covering software quality, bug fixes, stability, performance, and compliance including security and privacy.

Why it matters

Most AI coding assistants handle narrowly scoped changes well; Code Scans is aimed at outcome-shaped work, where the bottleneck is investigating an entire codebase before anyone writes a line of code. Architecturally, the MapReduce approach — many small-context agents running in parallel, followed by a synthesis step — is a concrete answer to context limits on large repositories, and it is notable that Cognition is reusing infrastructure built for security work in a general-purpose product. All figures above come from Cognition's own announcement, its own repositories and a quoted customer, so independent verification is pending. But if merge rates near 96% hold up more broadly, the pattern of agents investigating and drafting while humans review could make long-deferred improvement projects routine rather than aspirational.