Sast Python Packages

semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

libsast

Generic SAST Library

mobsfscan

mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.

njsscan

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

cycode

Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning

skylos

Open-source PR gate for Python, TS/JS, Java, and Go. Stop merging dead code, secrets, security flows, and AI-code regressions.

medusa-security

AI-first security scanner with 76 analyzers, 9,600+ detection rules, and repo poisoning detection for AI/ML, LLM agents, and MCP servers. Scan any GitHub repo with: medusa scan --git user/repo

semhound

Scan every repository across your GitHub organisations using Semgrep rules, with optional AI triage (Claude · Gemini · GPT · Bedrock)

permi

AI-powered vulnerability scanner for Nigerian developers and global SMBs

codepathfinder

Static Code Analysis for security teams with Inter file taint analysis. Built for finding vulnerabilities, advanced structural search, derive insights and supports MCP

securescan

Security scanning without the SaaS tax. Multi-scanner orchestration, baseline diffing, SBOM + SARIF, signed everything — runs in your terminal, your CI, or a dashboard you own.

ansede-static

Ansede Static: Next-Gen SAST Engine — Fast, Offline, Security for Modern Codebases Detect critical security vulnerabilities and code quality issues in Python, JavaScript, and TypeScript projects with a single command. No dependencies, no cloud, no setup—just download, unzip, and scan any folder instantly.

arcis

Inside-the-app security middleware for Node.js, Python, and Go. 20+ attack vectors. One install, three languages, MIT.

codeaudit

Codeaudit - Modern Python source code security analyzer based on distrust.

crossfire-rules

Regex rule overlap analyzer for DLP, secret scanning, SAST, and IDS tools

terrascan

Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.

precli

Precaution CLI - command line static application security testing tool

alnur

ALNUR — Open-source end-to-end security vulnerability scanner. Detects CVEs, hardcoded secrets, architecture flaws, and port risks across Node.js, Python, PHP, Go, Rust, Java, .NET, Ruby and more

dockerent

A tool to analyse issues with running docker container(s)

finite-state-sdk

Python SDK for the Finite State Platform API

nazar

Autonomous testing tool - scans your project, understands architecture, plans and runs tests

velonus

AI-native security copilot for Python developers. Scans for secrets, vulnerabilities, and dependency CVEs — then tells you how to fix them.

orihime

Cross-repo code knowledge graph for Java/Kotlin/JS/TS — MCP server, taint analysis, call graph, OWASP reports. 95% fewer tokens than source-reading.

joern-lib

Python library for code analysis with CPG and Joern