PyPI
CoreTrace/coretrace-python-analyzer
Python static analysis tool.
Apache-2.0Oct 16, 2026 · metrics 2.10.0
All tags
Catalogue tag
#sast
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
55 records
Go
csnp/cryptodeps
Cryptographic Dependency Scanner - Identify quantum-vulnerable cryptographic algorithms in your software dependencies. Part of the QRAMM Toolkit.
Apache-2.0Sep 19, 2026 · metrics 2.10.0
PyPI
raccioly/websec-validator
Local-first security recon that briefs your AI coding agent: facts + tailored probes, code-in / artifacts-out. No LLM, no server, no running app.
MITSep 14, 2026 · metrics 2.10.0
PyPI
toniantunovi/lucidshark
Ship AI-generated code without the fear
Apache-2.0Sep 19, 2026 · metrics 2.10.0
npm
subodhkc/ai-appsec
Evidence-backed AppSec for AI applications and agents. Powered by HAIEC.
MITSep 20, 2026 · metrics 2.10.0
Go · npm
scagogogo/cwe-skills
AI-native CWE (Common Weakness Enumeration) integration layer — Skills, Go SDK, CLI & MCP. Ship CVE/CWE tooling to SAST/DAST, vuln-management & AI agents.
MITSep 11, 2026 · metrics 2.10.0
Go
alexpermiakov/sast-triage
AI-powered triage for SAST findings.
MITSep 13, 2026 · metrics 2.10.0
Go
famclaw/honeybadger
Security scanner for AI agent skills and MCP servers. Detects secrets, CVEs, supply chain attacks, and prompt injection in SKILL.md files before they're installed. Pre-install gate for Claude Code, OpenClaw, PicoClaw, NanoBot, FamClaw, and CI/CD pipelines. Single Go binary, MIT licensed.
MITSep 9, 2026 · metrics 2.10.0
PyPI
jared0565/aramid
Deterministic security & quality gate engine for git repos. Installs pre-commit/pre-push hooks that run secret scanning (gitleaks), SAST (semgrep/OWASP), linting (ruff/eslint), type checks, dependency audits, and tests — security findings block, quality issues warn. Event-sourced findings ledger, one-command setup: aramid init <repo>.
MITSep 18, 2026 · metrics 2.10.0
npm
subodhkc/mcp-tenant-isolation
Static analysis scanner for multi-tenant SaaS and MCP server code. 57 deterministic rules for cross-tenant data leakage, IDOR, RLS, and MCP-specific risks. Includes MCP server, SARIF output, and GitHub Action.
MITSep 20, 2026 · metrics 2.10.0
PyPI · crates.io · npm
mattybellx/Guardmarly
Find authorization bugs before attackers do. Free SAST — IDOR detection, 100% CVE recall, 0% false positives. 5 languages. Fully offline.
Custom licenseSep 10, 2026 · metrics 2.10.0
PyPI
VanshBhardwaj1945/FlowSec
CI/CD pipeline security analyzer — scans GitHub Actions workflows for attack vectors and maps findings to MITRE ATT&CK
MITSep 18, 2026 · metrics 2.10.0
npm
sudoeren/arhus
local-first security analysis for TypeScript & JavaScript
MITSep 10, 2026 · metrics 2.10.0
PyPI
PramanKasliwal/MaunPrekshak
The Silent Observer — Fast, local-first security scanner for dependencies (SCA), exposed secrets & git history, SAST, Dockerfiles, and GitHub Actions with multi-provider AI remediation.
Apache-2.0Oct 12, 2026 · metrics 2.10.0
Go
greprules/greprules
CLI & Agent plugin for fetching SAST rule packs from greprules.io and scanning local code changes.
Apache-2.0Sep 10, 2026 · metrics 2.10.0
npm
iAMv1/omnisectester
Nation-state grade, defense-in-depth security testing framework. Tests web apps, extensions, desktop, mobile, cloud, AI/LLM, hardware, and supply chain from a single CLI.
MITSep 22, 2026 · metrics 2.10.0
crates.io
eezz4/zzop
Deterministic cross-repo contract analysis for AI agents: which frontend calls hit which backend endpoints (and which don't) — exact joins, disclosed blind spots, no guessing. TypeScript/JavaScript, Python, Java, C#, Rust, Go, Prisma, SQL natively; anything else via a documented adapter envelope. Rust core, zero network.
MITSep 13, 2026 · metrics 2.10.0
Go
fabricatorsltd/euprovguard
EU-compliant Software Bill of Materials (SBOM) generator with Qualified Electronic Signature (QES) support.
MITSep 19, 2026 · metrics 2.10.0
npm
KaraboGerald/SeamShieldCLI
SeamShield Community CLI: local-first access-lane scanning for AI-built apps
MITSep 16, 2026 · metrics 2.10.0
Go
malandas/andas
Sift real security risk from the noise — a cross-platform CLI that live-validates leaked secrets and reachability-ranks npm/Yarn vulnerabilities, so you fix what's actually exploitable.
MITSep 17, 2026 · metrics 2.10.0
Go
sanks205/getobserver
Finds what's wrong — and shows you the fix. Code, deps, config & infra — one offline scan, one report.
MITSep 18, 2026 · metrics 2.10.0
Go
FYFran/ironwall
8-step open-source security audit CLI. Secrets, SAST, dependency CVEs, IaC, supply chain. MIT. AI-assisted.
MITSep 6, 2026 · metrics 2.10.0
Go · Maven · PyPI
seqra/opentaint
The open source taint analysis engine for the AI era. A formal dataflow analysis tool you can customize and self-host, built so AI agents drive your application security analysis without burning tokens on every scan. AI-ready open source alternative to Semgrep Pro and CodeQL.
Apache-2.0Sep 10, 2026 · metrics 2.10.0
npm · PyPI
wangai003/scan5
No repository description published.
No licenseSep 9, 2026 · metrics 2.10.0
PyPI
FuzzingLabs/secpipe
MCP server for AI-driven security pipelines
Custom licenseAug 4, 2026 · metrics 2.10.0