Sast Python Packages

semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

libsast

Generic SAST Library

njsscan

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

cycode

Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning

kingfisher-bin

Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.

skylos

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

mobsfscan

mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.

repo-security-scanner

Pre-clone security scanner for Git repos. Detects crypto miners, backdoors, obfuscation, and vulnerable dependencies before git clone touches your machine. Python CLI with JSON/CSV/SARIF output.

maunprekshak

The Silent Observer — Fast, local-first security scanner for dependencies (SCA), exposed secrets & git history, SAST, Dockerfiles, and GitHub Actions with multi-provider AI remediation.

websec-validator

Local-first security recon for AI coding agents: map attack surfaces, stage tailored probes, and produce a fact-grounded brief. Part of the Guard family with DocGuard and TestGuard.

medusa-security

AI-first security scanner. NEW in v2026.7: Claude Code compromise detection — vet .claude/ hooks, permissions & skills before you clone — plus an always-on AI attack-signature scanner and native Rust & PHP rules. Also: medusa scan --git to vet any repo, medusa secrets scan for leaked API keys. 40,000+ patterns, zero setup.

valvur

Offline security scanning for AI-generated code: seven open-source scanners and AI-specific checks in one command. It finds secrets, vulnerable, hallucinated and malicious dependencies, poisoned agent configuration, and infrastructure and code flaws. An MCP server for Claude Code and Kiro, and a CLI. Your source never leaves your machine.

gitgalaxy

Convert source code into a repository-scale structural model. Air gapped, zero dependencies, SARIF and SBOM outputs.

kingfisher-secret-scanner

Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.

husk-scanner

Static security scanner for AI agent skills. Built against the bypass techniques that beat Snyk, Cisco & Vercel scanners. Offline, deterministic, zero dependencies, CI-ready. Benchmarked on 11, 225 real malicious skills.

cobolwork

Security analysis for COBOL, JCL and CICS. Zero runtime dependencies.

argus-security

Argus brings “a hundred eyes” to your project, combining leading open source security tools into a scalable, automated, continuous security pipeline.

safeai-static-analyzer

Static analysis and attack-surface scanner for AI agents — SAST for prompts, tools, MCP servers, and agent workflows. Detects capabilities, prompt risks, tool permissions, and governance gaps before deployment.

actenon-scan

Find where agent-controlled intent reaches consequential actions without an authority check. Python + TypeScript + Go. Zero-dependency SAST for AI agents.

mcpwatchman

Independent security and quality audit for Model Context Protocol servers — static analysis, dependency CVE scanning, and evidence-linked scores for every server in the official MCP registry.

deluluscan

AI-augmented, evidence-first security auditor for authorized testing — web, API, LLM/AI, container, cloud & source code. Pluggable AI (Claude/OpenAI/DeepSeek/Ollama), agentic exploitation, deep verification, multi-format reports. AGPL-3.0.

stoa-agent-risk

Local-first AI agent inventory and risk scanner: finds agent candidates with evidence, maps capabilities and integrations, and gates newly introduced high-confidence critical risks.

codepathfinder

Static Code Analysis for security teams with Inter file taint analysis. Built for finding vulnerabilities, advanced structural search, derive insights and supports MCP

grey-panda

The calm guardian for AI, agent, and MCP code — a zero-dependency, OWASP-anchored AI security toolkit.