PyPI
semgrep/semgrep
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
LGPL-2.12026年9月16日 · 指标 2.10.0
全部标签
目录标签
#sast
公开记录中带有此标签的全部仓库——标签来自其 GitHub 主题或软件包注册表发布的关键词。健康度量遵循与记录其余部分相同的版本化方法论。
55 条记录
npm
NodeSecure/js-x-ray
JavaScript & Node.js open-source SAST scanner. A static analyser for detecting most common malicious patterns 🔬.
MIT2026年9月16日 · 指标 2.10.0
Go · npm
Bearer/bearer
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
自定义许可证2026年9月20日 · 指标 2.10.0
PyPI · crates.io
duriantaco/skylos
Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/
Apache-2.02026年9月15日 · 指标 2.10.0
PyPI
cycodehq/cycode-cli
Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning
MIT2026年9月14日 · 指标 2.10.0
npm
ofri-peretz/eslint
Security and code-quality ESLint plugins — 477 rules across 30 packages: 272 security rules mapped to CWE + OWASP, 107 quality, 98 React/a11y. ESLint 8.40/9/10 + Oxlint. The lint layer AI-generated code needs.
MIT2026年9月13日 · 指标 2.10.0
npm
NodeSecure/scanner
⚡️ A package API to run a static analysis of your module's dependencies. This is the CLI engine!
MIT2026年9月18日 · 指标 2.10.0
npm
asamassekou10/ship-safe
CLI security scanner built for the agentic era. Detects CI/CD misconfigs, agent permission risks, MCP tool injection, hardcoded secrets, and DMCA-flagged AI dependencies.
MIT2026年9月6日 · 指标 2.10.0
Go
betterleaks/betterleaks
Find leaked secrets everywhere.
MIT2026年10月19日 · 指标 2.10.0
npm · crates.io
0sec-labs/foxguard
A fast universal code security scanner, written in Rust. Batteries included: supports 14 languages, TUI for triage, secrets, post-quantum audits, diff-aware scans and more 𓃥
MIT2026年9月10日 · 指标 2.10.0
Go
DataDog/datadog-saist
AI-native SAST
Apache-2.02026年9月11日 · 指标 2.10.0
PyPI
jimmy058910/jmo-security-repo
JMo Security Suite - Terminal-first security audit toolkit with many tools, multi-target scanning, & compliance
自定义许可证2026年9月15日 · 指标 2.10.0
PyPI
squid-protocol/gitgalaxy
Convert source code into a repository-scale structural model. Air gapped, zero dependencies, SARIF and SBOM outputs.
自定义许可证2026年10月20日 · 指标 2.10.0
PyPI
cpeoples/ansible-security-scanner
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
Apache-2.02026年9月9日 · 指标 2.10.0
Go
glsec/glsec
Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, SARIF output, OWASP CICD-SEC and CWE mappings.
Apache-2.02026年9月10日 · 指标 2.10.0
PyPI
sjkim1127/Reversecore_MCP
A security-first MCP server that empowers AI agents to perform automated reverse engineering, malware analysis, forensics, vulnerability research, and SAST — powered by Radare2, YARA, LIEF, Capstone, and more.
MIT2026年9月12日 · 指标 2.10.0
Go · npm · PyPI
KKloudTarus/synapse-ce
Synapse - a governed control plane for software composition analysis, recon, evidence, and reporting. Verify Everything. Trust Nothing.
Apache-2.02026年9月17日 · 指标 2.10.0
RubyGems
0dayInc/pwn
PWN is an open security automation framework that aims to stand on the shoulders of security giants, promoting trust and innovation.
MIT2026年9月5日 · 指标 2.10.0
npm
willfarrell/sast-json-schema
Meta-schema for the Static Application Security Testing (SAST) of JSON Schemas
MIT2026年9月20日 · 指标 2.10.0
Packagist
ShieldCI/laravel
Automated code analysis for Laravel applications with 73 open-source analyzers covering security, performance, reliability, code quality, and best practices. ShieldCI Pro adds 82 more (155 total). Laravel 9+.
MIT2026年10月20日 · 指标 2.10.0
Go
draugr-dev/draugr
Run Trivy, Semgrep, Gitleaks and more from one file. Consolidates SAST, SCA, secrets, IaC and container findings into one SARIF report and one pass/fail gate for CI — ranked by real risk, and can fail a PR on new findings only.
Apache-2.02026年9月11日 · 指标 2.10.0
PyPI
marshallguillory86/secure-code-agent
Deterministic security gate + bounded AI remediation prompts. NIST SSDF / OWASP ASVS / CWE Top 25 anchored. The security sibling to maintainability-agent.
MIT2026年10月5日 · 指标 2.10.0
npm · PyPI
sinewaveai/agent-security-scanner-mcp
Security scanner MCP server for AI coding agents. Prompt injection firewall, package hallucination detection (4.3M+ packages), 1000+ vulnerability rules with AST & taint analysis, auto-fix.
MIT2026年10月9日 · 指标 2.10.0
Go
Vulnetix/cli
Automate vulnerability triage which prioritizes remediation over discovery
自定义许可证2026年10月21日 · 指标 2.10.0
npm
agentgg-dev/agentgg
Open source agentic SAST. The engine behind hundreds of disclosed zero-days. 100+ AI security agents, any repo or PR diff, bring your own model.
Apache-2.02026年9月17日 · 指标 2.10.0
Go
vyprai/vyql
Multi-language taint and graph security scanner. Follows tainted data through your code and shows why each finding is a finding.
Apache-2.02026年10月18日 · 指标 2.10.0
Packagist
ShieldCI/analyzers-core
ShieldCI Analyzers Core - Shared foundation for building static analysis tools. Includes abstract analyzer classes, result formatters, file parsers, and utilities. Used by both shieldci/laravel and shieldci/laravel-pro packages.
MIT2026年10月21日 · 指标 2.10.0
PyPI
ajinabraham/njsscan
njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.
LGPL-3.02026年9月21日 · 指标 2.10.0
npm
goklab/guardvibe
Security infrastructure your AI can't be — deterministic, daily CVE intel past your model's training cutoff, whole-repo-aware, author-independent, and shift-left: secure_prompt secures the prompt before code generation. The security MCP for vibe coding: 450 rules, 39 tools, CLI + doctor for Next.js, Supabase, Clerk, Stripe, Prisma, Hono & MCP.
Apache-2.02026年9月10日 · 指标 2.10.0
PyPI
CoreTrace/coretrace-python-analyzer
Python static analysis tool.
Apache-2.02026年10月16日 · 指标 2.10.0