Sast Python Packages

semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

libsast

Generic SAST Library

njsscan

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

mobsfscan

mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.

skylos

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

cycode

Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning

medusa-security

AI-first security scanner. NEW in v2026.7: Claude Code compromise detection — vet .claude/ hooks, permissions & skills before you clone — plus an always-on AI attack-signature scanner and native Rust & PHP rules. Also: medusa scan --git to vet any repo, medusa secrets scan for leaked API keys. 40,000+ patterns, zero setup.

ansible-security-scanner

🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.

pipeline-check

CI/CD Security Posture Scanner

aina-scan

Enterprise SAST — Python/Java/C/C++/TypeScript/C#/Go/Rust — tree-sitter AST, 7-language support, interprocedural taint (3-hop BFS), AINA L3 causal chains, i18n (en/ko), 6-report output

ansede-static

Offline SAST that detects IDOR, missing authentication, and ownership bypass. OWASP recall 62%, CVE recall 96.3% across 5 languages. Beats Semgrep OSS on recall.

hookwarden

Find every webhook-verification bug in your codebase in under five minutes. Three-state verdicts across 21 providers in JS/TS, Python, PHP, and Go. Zero off-machine traffic.

arcis

Inside-the-app security middleware for Node.js, Python, and Go. 20+ attack vectors. One install, three languages, MIT.

argus-security

Argus brings “a hundred eyes” to your project, combining leading open source security tools into a scalable, automated, continuous security pipeline.

impactguard

ImpactGuard — Lightweight multi-language API impact analyzer

codepathfinder

Static Code Analysis for security teams with Inter file taint analysis. Built for finding vulnerabilities, advanced structural search, derive insights and supports MCP

redteam-mcp

Active red-teaming for MCP servers. Source analysis + live exploitation + auto-fix. Claude Code plugin.

codeaudit

Codeaudit - Modern Python source code security analyzer based on distrust.

openhack

Open Source Agentic Security Scanner

scan4secrets

Find credentials and secret with 170+ rules covering across source code, Web URL, and CI/CD, verifies them against vendor APIs, and generates SARIF, JSONL, HTML, PDF, or Excel reports.

precli

Precaution CLI - command line static application security testing tool

brasscoders

The bug scanner for AI coders. Local-first, deterministic CLI that catches the bugs your AI coding assistant misses. 12 scanners in one tool. Apache 2.0.

terrascan

Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.

ragsec

Static security scanner for RAG pipelines. Detects injection, secret logging, auth gaps, SSRF, and more in Python codebases.