PyPI
semgrep/semgrep
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
LGPL-2.1Sep 16, 2026 · metrics 2.10.0
All tags
Catalogue tag
#sast
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
55 records
npm
NodeSecure/js-x-ray
JavaScript & Node.js open-source SAST scanner. A static analyser for detecting most common malicious patterns 🔬.
MITSep 16, 2026 · metrics 2.10.0
Go · npm
Bearer/bearer
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
Custom licenseSep 20, 2026 · metrics 2.10.0
PyPI · crates.io
duriantaco/skylos
Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/
Apache-2.0Sep 15, 2026 · metrics 2.10.0
PyPI
cycodehq/cycode-cli
Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning
MITSep 14, 2026 · metrics 2.10.0
npm
ofri-peretz/eslint
Security and code-quality ESLint plugins — 477 rules across 30 packages: 272 security rules mapped to CWE + OWASP, 107 quality, 98 React/a11y. ESLint 8.40/9/10 + Oxlint. The lint layer AI-generated code needs.
MITSep 13, 2026 · metrics 2.10.0
npm
NodeSecure/scanner
⚡️ A package API to run a static analysis of your module's dependencies. This is the CLI engine!
MITSep 18, 2026 · metrics 2.10.0
npm
asamassekou10/ship-safe
CLI security scanner built for the agentic era. Detects CI/CD misconfigs, agent permission risks, MCP tool injection, hardcoded secrets, and DMCA-flagged AI dependencies.
MITSep 6, 2026 · metrics 2.10.0
Go
betterleaks/betterleaks
Find leaked secrets everywhere.
MITOct 19, 2026 · metrics 2.10.0
npm · crates.io
0sec-labs/foxguard
A fast universal code security scanner, written in Rust. Batteries included: supports 14 languages, TUI for triage, secrets, post-quantum audits, diff-aware scans and more 𓃥
MITSep 10, 2026 · metrics 2.10.0
Go
DataDog/datadog-saist
AI-native SAST
Apache-2.0Sep 11, 2026 · metrics 2.10.0
PyPI
jimmy058910/jmo-security-repo
JMo Security Suite - Terminal-first security audit toolkit with many tools, multi-target scanning, & compliance
Custom licenseSep 15, 2026 · metrics 2.10.0
PyPI
squid-protocol/gitgalaxy
Convert source code into a repository-scale structural model. Air gapped, zero dependencies, SARIF and SBOM outputs.
Custom licenseOct 20, 2026 · metrics 2.10.0
PyPI
cpeoples/ansible-security-scanner
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
Apache-2.0Sep 9, 2026 · metrics 2.10.0
Go
glsec/glsec
Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, SARIF output, OWASP CICD-SEC and CWE mappings.
Apache-2.0Sep 10, 2026 · metrics 2.10.0
PyPI
sjkim1127/Reversecore_MCP
A security-first MCP server that empowers AI agents to perform automated reverse engineering, malware analysis, forensics, vulnerability research, and SAST — powered by Radare2, YARA, LIEF, Capstone, and more.
MITSep 12, 2026 · metrics 2.10.0
Go · npm · PyPI
KKloudTarus/synapse-ce
Synapse - a governed control plane for software composition analysis, recon, evidence, and reporting. Verify Everything. Trust Nothing.
Apache-2.0Sep 17, 2026 · metrics 2.10.0
RubyGems
0dayInc/pwn
PWN is an open security automation framework that aims to stand on the shoulders of security giants, promoting trust and innovation.
MITSep 5, 2026 · metrics 2.10.0
npm
willfarrell/sast-json-schema
Meta-schema for the Static Application Security Testing (SAST) of JSON Schemas
MITSep 20, 2026 · metrics 2.10.0
Packagist
ShieldCI/laravel
Automated code analysis for Laravel applications with 73 open-source analyzers covering security, performance, reliability, code quality, and best practices. ShieldCI Pro adds 82 more (155 total). Laravel 9+.
MITOct 20, 2026 · metrics 2.10.0
Go
draugr-dev/draugr
Run Trivy, Semgrep, Gitleaks and more from one file. Consolidates SAST, SCA, secrets, IaC and container findings into one SARIF report and one pass/fail gate for CI — ranked by real risk, and can fail a PR on new findings only.
Apache-2.0Sep 11, 2026 · metrics 2.10.0
PyPI
marshallguillory86/secure-code-agent
Deterministic security gate + bounded AI remediation prompts. NIST SSDF / OWASP ASVS / CWE Top 25 anchored. The security sibling to maintainability-agent.
MITOct 5, 2026 · metrics 2.10.0
npm · PyPI
sinewaveai/agent-security-scanner-mcp
Security scanner MCP server for AI coding agents. Prompt injection firewall, package hallucination detection (4.3M+ packages), 1000+ vulnerability rules with AST & taint analysis, auto-fix.
MITOct 9, 2026 · metrics 2.10.0
Go
Vulnetix/cli
Automate vulnerability triage which prioritizes remediation over discovery
Custom licenseOct 21, 2026 · metrics 2.10.0
npm
agentgg-dev/agentgg
Open source agentic SAST. The engine behind hundreds of disclosed zero-days. 100+ AI security agents, any repo or PR diff, bring your own model.
Apache-2.0Sep 17, 2026 · metrics 2.10.0
Go
vyprai/vyql
Multi-language taint and graph security scanner. Follows tainted data through your code and shows why each finding is a finding.
Apache-2.0Oct 18, 2026 · metrics 2.10.0
Packagist
ShieldCI/analyzers-core
ShieldCI Analyzers Core - Shared foundation for building static analysis tools. Includes abstract analyzer classes, result formatters, file parsers, and utilities. Used by both shieldci/laravel and shieldci/laravel-pro packages.
MITOct 21, 2026 · metrics 2.10.0
PyPI
ajinabraham/njsscan
njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.
LGPL-3.0Sep 21, 2026 · metrics 2.10.0
npm
goklab/guardvibe
Security infrastructure your AI can't be — deterministic, daily CVE intel past your model's training cutoff, whole-repo-aware, author-independent, and shift-left: secure_prompt secures the prompt before code generation. The security MCP for vibe coding: 450 rules, 39 tools, CLI + doctor for Next.js, Supabase, Clerk, Stripe, Prisma, Hono & MCP.
Apache-2.0Sep 10, 2026 · metrics 2.10.0
PyPI
CoreTrace/coretrace-python-analyzer
Python static analysis tool.
Apache-2.0Oct 16, 2026 · metrics 2.10.0