Topics / #sarif

Sarif projects on GitHub

Tooling around security scan result formats, likely SARIF reporting.

As of , the most-starred Sarif projects on GitHub are shannon (49K stars), SkillSpector (20.4K stars) and pgbot (1.4K stars). GitHub.Locker tracks 7 Sarif repositories with 71.5K stars combined. The fastest-growing on October 16 was shannon, with +81 stars in a day.

7Projects
71.5KStars in total
+162Stars in a day
Browse in the catalog →github.com/topics/sarif ↗

Hot right now

Most stars gained in a day · Oct 16

+81

shannon

KeygraphHQ/shannon · ★ 49K

Shannon is an autonomous AI pentester that analyzes your web application's source code, maps attack vectors, and then executes real exploits against the running app to prove vulnerabilities before they reach production — 'no exploit, no report'.

+73

SkillSpector

NVIDIA/SkillSpector · ★ 20.4K

SkillSpector is a security scanner for AI agent skills (used by Claude Code, Codex CLI, Gemini CLI, and MCP) that detects vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risks before you install a skill.

+8

pgbot

pgrundev/pgbot · ★ 1.4K

pgbot is a static binary that connects read-only to a PostgreSQL database, reads its own statistics views, and prints a findings-first health report plus what changed since the last run.

The all-time top

7 projects · by stars

  1. #1 · KeygraphHQ/shannon

    shannon

    Shannon is an autonomous AI pentester that analyzes your web application's source code, maps attack vectors, and then executes real exploits against the running app to prove vulnerabilities before they reach production — 'no exploit, no report'.

    49K
  2. #2 · NVIDIA/SkillSpector

    SkillSpector

    SkillSpector is a security scanner for AI agent skills (used by Claude Code, Codex CLI, Gemini CLI, and MCP) that detects vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risks before you install a skill.

    20.4K
  3. #3 · pgrundev/pgbot

    pgbot

    pgbot is a static binary that connects read-only to a PostgreSQL database, reads its own statistics views, and prints a findings-first health report plus what changed since the last run.

    1.4K
  1. 4

    EvalForge

    210jsdhwfmax/EvalForge · Python

    EvalForge turns AI evaluation results into reviewable, vendor-neutral release evidence for RAG applications and AI assistants, combining an offline RAG evaluator, a portable JSON artifact, and policy-as-code gates that output JSON, JUnit, and SARIF for CI systems.

  2. 5

    Airsec

    150bas3line/Airsec · TypeScript

    Airsec is a CLI tool that drives a coding agent you already have installed (Claude Code, Codex, OpenCode, Command Code) through a structured, multi-pass security audit of your code, then turns the findings into an actionable report.

  3. 6

    workbooklens

    142chenweixin123/workbooklens · Python

    WorkbookLens is a local-first tool that lints, regression-tests, semantic-diffs, and conservatively repairs Excel workbooks, running entirely on your machine without Excel, LibreOffice, an AI key, or a cloud service.

  4. 7

    Myrqen

    137stijnswapped/Myrqen · TypeScript

    Myrqen is a security testing tool that runs inside a coding agent (Claude Code, Codex, or OpenCode) you already use: its own static analysis engine finds vulnerability candidates in your TypeScript/JavaScript code, then the agent dynamically verifies them against the app running on your machine.

Often tagged together