Sarif Python Packages

lintrunner-adapters

Adapters and tools for lintrunner

ca9

Open source Python CVE reachability analysis for evidence-backed SCA triage. Turn Snyk, Dependabot, Trivy, pip-audit, and OSV alerts into fix, suppress, or investigate decisions.

agent-bom

Open security scanner for AI supply chain and infrastructure: agents, MCP, containers, cloud, GPU, and runtime with blast-radius analysis.

ai-bom

AI Bill of Materials — discover every AI agent, model, and API in your infrastructure

compose-lint

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CIS Docker Benchmark.

agent-audit-kit

Static scanner for MCP-connected AI agent pipelines — 200 rules across 11 categories, 12 compliance frameworks, OWASP Agentic 10/10 + MCP 10/10, GitHub Action, SARIF, 48h CVE-to-rule SLA.

securescan

Security scanning without the SaaS tax. Multi-scanner orchestration, baseline diffing, SBOM + SARIF, signed everything — runs in your terminal, your CI, or a dashboard you own.

agents-shipgate

Static release-readiness gate for AI agent tool surfaces. CLI + GitHub Action. Scans MCP, OpenAPI, OpenAI Agents SDK, Anthropic, Google ADK, LangChain, CrewAI. Apache-2.0.

mcp-wallfacer

Runtime fuzzing and invariant-testing harness for MCP servers.

codesight

Semantic security verification CLI for scanner alerts and AI-written code

velonus

AI-native security copilot for Python developers. Scans for secrets, vulnerabilities, and dependency CVEs — then tells you how to fix them.

simplesecurity

Combine multiple popular python security tools and generate reports or output into different formats

sarix

Code analysis CLI - code review, bugs, security, docs, refactoring. Multi-provider LLM, SARIF output, CI-ready.

red-widow

VSIX, IDE extension, and AI developer workflow security scanner.

selvo

Linux dependency blast-radius ranker — surfaces highest-value CVE patch opportunities

pylint-sarif-unofficial

Pylint output as SARIF

litmus-screener

LitmusAI — Free CLI screener for EU AI Act Article 5 prohibited AI practices. 8 categories, Red/Amber/Clear verdicts, SARIF output. PyPI: litmus-screener. Apache 2.0.

graveyard

Find dead code across Python, JS/TS, Go, and Rust with git-aware confidence scoring.

dockerfile-doctor

Lint, analyze, and auto-fix Dockerfiles for best practices, security, and performance

vulnhawk

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PHP, Ruby.

surface-audit

Deterministic web security smoke tests for preview, staging, and pre-deploy URLs.

pwned-deps

Drop your lockfile in, find out if you're pwned. Compromised-package scanner backed by OSV.dev.

iam-sarif-report

Validate your IAM Policies and SCPs with AWS Policy Validator, and convert those results into SARIF documents for reporting.

trusera-sdk

AI Bill of Materials — discover every AI agent, model, and API in your infrastructure