Devin's Code Scans turns broad goals into pull requests

Cognition has added Code Scans to its AI software engineer Devin: a feature that starts from a broad engineering goal rather than a specific change and turns it into concrete pull requests. Instead of a developer first spending time figuring out where in a codebase to even look, they describe the outcome they want, such as improving SEO, cutting maintenance overhead, or making the application compile faster, and Devin investigates the codebase, evaluates what it finds, and proposes the changes as PRs ready for review. A user can also supply their own criteria, such as a team's coding standards, an accessibility checklist, or the requirements for an upcoming migration, and Devin uses those to decide what to inspect, what to skip, and what counts as a finding. Once the scope is confirmed, Devin runs the investigation and returns a prioritized list of findings that can be discussed before asking it to open PRs for the ones worth fixing.

Code Scans is built on Agentic MapReduce, the same architecture Cognition built for Devin Security Swarm, now applied beyond security to whatever engineering goal a user defines. The architecture runs in four phases: Devin studies the repository and plans rules for identifying relevant code (Plan); those rules divide the matching code into focused batches (Shard); parallel Devin agents investigate each batch, reading surrounding code as needed (Map); and a final agent combines the findings, removes duplicates, and prioritizes them into one report (Reduce). Cognition says this keeps each agent's context focused on its own batch rather than repeatedly searching the whole codebase, and that because every selected batch must be processed, the approach ensures the investigation is complete rather than sampling.

Cognition gives two results from teams testing Code Scans before launch. Asked to speed up compilation in the Dioxus repository, Devin found ways to streamline dependencies and build configuration, including making heavyweight CLI features opt-in instead of compiled by default; after applying the changes locally, clean debug build time across the 22 workspace crates tested dropped from 58.6 seconds to 21.0 seconds, a 64% reduction. Separately, a scan for SEO issues across the devin.ai and cognition.com repositories surfaced 44 findings, and fixes were shipped over the following days. Comparing Ahrefs crawls before and after, devin.ai's Ahrefs health score rose from 87 to 92 and its count of slow pages fell 73%, while missing image alt text was eliminated on cognition.com. To try it, a user types /scan in the Devin webapp.

Key facts

Code Scans lets a user hand Devin a broad goal (improve SEO, cut maintenance overhead, speed up builds) instead of a specific file-level task, and Devin investigates the codebase and turns findings into pull requests.
It runs on Agentic MapReduce, the architecture built for Devin Security Swarm, working in four phases: Plan, Shard, Map (parallel agents investigate batches) and Reduce (one agent merges and prioritizes findings).
On the Dioxus repository, Code Scans cut clean debug build time from 58.6 seconds to 21.0 seconds, a 64% reduction, across 22 workspace crates tested.
An SEO scan across devin.ai and cognition.com surfaced 44 findings; after fixes, devin.ai's Ahrefs health score rose from 87 to 92 and slow pages dropped 73%, while missing image alt text was eliminated on cognition.com.
Access is through typing /scan in the Devin webapp; Cognition gives no launch date, pricing or plan-tier details for the feature.

Why it matters

Most AI coding assistants still wait for a developer to point at a specific file or bug. Code Scans inverts that: it takes a goal stated in plain terms and does the investigation work itself, which is often the part that keeps such goals stuck on the backlog. It also generalizes the Agentic MapReduce architecture Cognition built for security scanning, showing that architecture is meant to be a reusable pattern for open-ended codebase-wide investigation rather than a one-off for Devin Security Swarm.

Who it affects

Engineering teams already using Devin, particularly those with backlog items framed as outcomes rather than tickets, such as reducing build time, cleaning up unused code, or fixing accessibility gaps. It also affects teams who want to enforce their own standards, like coding conventions or migration requirements, as scan criteria rather than manual review checklists.

How to use it

A user types /scan in the Devin webapp, describes the goal (Cognition's own example: find unused code in a web app, excluding generated files and test fixtures, checking indirect references before recommending removal), optionally supplies custom criteria, confirms the scope, and lets Devin run the investigation. The result is a prioritized list of findings that can be discussed before asking Devin to open pull requests for the ones worth acting on. Cognition does not state a price or plan tier for Code Scans, or when it becomes generally available.

How solid is it

The two results Cognition reports, the Dioxus build-time cut and the SEO improvements on its own sites, are concrete and numeric, but both come from Cognition's own pre-launch testers and its own properties rather than independent verification, and the announcement names no individual engineer behind the work. The 64% build-time reduction and the SEO metrics are specific enough to check once the feature ships more broadly, but for now they are self-reported case studies rather than external benchmarks.

Risks and caveats

The architecture's completeness guarantee, that every selected batch must be processed, depends entirely on the upfront Plan phase correctly identifying which code is relevant; code the planning rules miss would not be scanned at all. The SEO case study also does not say how many of the 44 findings were actually fixed, only that fixes were shipped over the following days, so the reported score and slow-page improvements may reflect a subset of the identified issues rather than all of them.