Topics / #sast

Sast projects on GitHub

Static application security testing and code scanning tools.

As of , the most-starred Sast projects on GitHub are SkillSpector (20.5K stars), semgrep (17.1K stars) and static-analysis (14.8K stars). GitHub.Locker tracks 8 Sast repositories with 64.1K stars combined. The fastest-growing on October 17 was SkillSpector, with +60 stars in a day.

8Projects
64.1KStars in total
+105Stars in a day
Browse in the catalog →github.com/topics/sast ↗

Hot right now

Most stars gained in a day · Oct 17

+60

SkillSpector

NVIDIA/SkillSpector · ★ 20.5K

SkillSpector is a security scanner for AI agent skills (used by Claude Code, Codex CLI, Gemini CLI, and MCP) that detects vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risks before you install a skill.

+16

semgrep

semgrep/semgrep · ★ 17.1K

Semgrep is a fast, open-source static analysis tool that scans source code to find bugs, security issues, and enforce coding standards using rules that look like ordinary code rather than abstract syntax trees or regex.

+14

openqodex

openqodex/openqodex · ★ 762

OpenQodex is an open source AI code review tool for Claude Code and Codex that runs before you push: it scans only the lines you changed, then has a separate reviewer process check every scanner finding.

+5

mantis

google/mantis · ★ 2.5K

Mantis is a toolkit of skills plus a reference agent harness (built on Google's ADK) that lets AI coding agents autonomously find, reproduce, triage, and patch vulnerabilities in a codebase.

The all-time top

8 projects · by stars

  1. #1 · NVIDIA/SkillSpector

    SkillSpector

    SkillSpector is a security scanner for AI agent skills (used by Claude Code, Codex CLI, Gemini CLI, and MCP) that detects vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risks before you install a skill.

    20.5K
  2. #2 · semgrep/semgrep

    semgrep

    Semgrep is a fast, open-source static analysis tool that scans source code to find bugs, security issues, and enforce coding standards using rules that look like ordinary code rather than abstract syntax trees or regex.

    17.1K
  3. #3 · analysis-tools-dev/static-analysis

    static-analysis

    A curated list of static analysis (SAST) tools, linters and formatters for all programming languages, config files and build tools, focused on tools that improve code quality.

    14.8K
  1. 4

    DeepAudit

    7.2Klintsinghua/DeepAudit · Python

    DeepAudit is a multi-agent AI platform for code security auditing. It mimics how a security expert thinks, using cooperating agents (Orchestrator, Recon, Analysis, Verification) to find vulnerabilities and then verify them with automated sandbox PoC exploitation.

  2. 5

    mantis

    2.5Kgoogle/mantis · Python

    Mantis is a toolkit of skills plus a reference agent harness (built on Google's ADK) that lets AI coding agents autonomously find, reproduce, triage, and patch vulnerabilities in a codebase.

  3. 6

    openqodex

    762openqodex/openqodex · TypeScript

    OpenQodex is an open source AI code review tool for Claude Code and Codex that runs before you push: it scans only the lines you changed, then has a separate reviewer process check every scanner finding.

  4. 7

    VulnHunter

    741nealbridges/VulnHunter · Python

    An open-source, agentic AI security scanner that reasons like an attacker to find exploitable vulnerabilities in source code, proves them with executable proof-of-concept exploits, and fixes them test-first. It is a maintained fork of Capital One's VulnHunter, rebuilt to run on any agent harness instead of just Claude Code.

  5. 8

    0

    5140sec-labs/0 · TypeScript

    0 is an open-source, self-evolving, multi-model AI harness for security research that finds, verifies, and fixes vulnerabilities, built by the Swiss Applied AI & Cybersecurity Research Lab.

Often tagged together