Top 23 Python Sast Projects

Sast

• Add a project

1. DeepAudit

   1 1 7,168 8.9 Python

   DeepAudit：人人拥有的 AI 黑客战队，让漏洞挖掘触手可及。小白一键部署运行，自主协作审计 + 自动化沙箱 PoC 验证。支持 Ollama 私有部署 ，一键生成报告。支持中转站。​让安全不再昂贵，让审计不再复杂。

   

   Project mention: Show HN: DeepAudit – open-source auditing agent (LLMs and Static Analysis) | news.ycombinator.com | 2025-12-15

2. AppSignal

   www.appsignal.com sponsored

   AppSignal knows why the f*#k it crashed. Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.

   

3. mantis

   2 2 2,437 8.9 Python

   A modular, stack-agnostic toolkit for AI coding agents to autonomously find, reproduce, and patch vulnerabilities.

   

   Project mention: Bloated Clouds, Anyone? | dev.to | 2026-09-18

   Provision managed resources (Postgres, MongoDB, Kafka, RabbitMQ, etc.) from DigitalOcean, Supabase, Scaleway, AWS, or Google Cloud. It doesn't really matter which; they all offer good SLAs.

4. skylos

   3 7 846 9.8 Python

   Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

   

   Project mention: GitHub Actions Security and GitLab CI Security: Static Analysis for CI/CD | dev.to | 2026-05-12

   pip install "git+https://github.com/duriantaco/skylos.git" skylos . --danger

5. mobsfscan

   4 1 792 7.5 Python

   mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.

   

6. OpenAnt

   5 1 774 9.7 Python

   OpenAnt from Knostic is the leading open source LLM-based vulnerability discovery product, helping defenders proactively find verified security flaws while minimizing both false positives and false negatives. Stage 1 detects. Stage 2 attacks. What survives is real.

   

   Project mention: OpenAnt: OSS Vulnerability Discovery (no one wants to compete with Anthropic) | news.ycombinator.com | 2026-03-02

7. automated-security-helper

   6 1 700 9.6 Python

   ASH is an extensible, open source SAST, SCA, and IaC security scanner orchestration engine.

   

   Project mention: Zero to shipped - a year in review | dev.to | 2025-12-04

   During the demo I show how to integrate a really nice open source project from AWS called Automated Security Helper, that runs a collection of open source tools that provide security and quality checks of the code. To add this to your AI coding assistant, its as simple as adding it as an MCP server

8. ThreatPlaybook

   7 2 282 0.0 Python

   A unified DevSecOps Framework that allows you to go from iterative, collaborative Threat Modeling to Application Security Test Orchestration

   

9. SaaSHub

   www.saashub.com sponsored

   SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

   

10. LAST

    8 1 187 1.6 Python

    Use AI to Scan Your Code from the Command Line for security and code smells. Bring your own keys. Supports OpenAI and Gemini (by latiotech)

    

11. fraim

    9 2 159 9.3 Python

    A flexible framework for security teams to build and deploy AI-powered workflows that complement their existing security operations.

    

12. PySpector

    10 1 151 9.1 Python

    PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. It leverages a powerful Rust core to deliver high-speed, accurate vulnerability scanning, wrapped in a developer-friendly Python CLI.

    

    Project mention: Show HN: PySpector – a hybrid Python SAST with a Rust core, looking4contributors | news.ycombinator.com | 2026-01-10

13. WP-Hunter

    11 1 62 8.5 Python

    Temodar Agent is an AI-powered WordPress plugin and theme security analysis platform built for security researchers, product security teams, auditors, and defenders. It combines AI agent workflows, multi-provider LLM orchestration, Semgrep-powered static analysis, and risk-based WordPress reconnaissance in one local-first Docker application.

    

    Project mention: Show HN: WP-Hunter, WP recon and SAST tool (building Agentic AI pipeline) | news.ycombinator.com | 2026-02-26

14. codeaudit

    12 1 44 9.1 Python

    Codeaudit - Modern Python source code security analyzer based on distrust.

    

15. isitsecure

    13 2 43 9.6 Python

    Find and fix web-app vulnerabilities in one command — SAST + DAST + AI, for devs who aren't security experts.

    

    Project mention: Show HN: Isitsecure – 1-command SAST and DAST and LLM security scanner for web apps | news.ycombinator.com | 2026-07-12

16. lucidshark

    14 3 19 9.5 Python

    Ship AI-generated code without the fear

    

    Project mention: A post-mortem on the fastest database breach of 2026 - and the quality gate that would have stopped it cold. | dev.to | 2026-03-23

    Install it and integrate it with Claude Code in minutes. Visit lucidshark.com for installation instructions and quick-start docs.

17. frame

    15 1 12 - Python

    Frame is a Separation Logic Verification Tool with Security Scanning (by lambdasec)

    

    Project mention: Velonus – Open-source AppSec scanner that deduplicates SAST noise | news.ycombinator.com | 2026-05-14

    You can consider using Frame for the SAST part - https://github.com/lambdasec/frame

18. mcp-safeguard

    16 1 11 7.3 Python

    🛡️ Security scanner for MCP (Model Context Protocol) servers — prompt injection, credential exposure, SSRF, tool poisoning & source-level credential-handling flaws. pip install mcp-safeguard

    

    Project mention: Four vendors, one bad assumption: SSRF in MCP servers | dev.to | 2026-09-28

    mcp-safeguard

19. Vulnchain

    17 2 10 6.3 Python

    AI-powered multi-language security scanner: 154 Semgrep rules, 13 Joern CPG scripts, AI code detection, and attack-chain correlation

    

    Project mention: Why I built attack-chain correlation on top of Semgrep and Joern | dev.to | 2026-04-07

    → github.com/hamzamiladin/Vulnchain

20. Sample-Secret-Keys

    18 1 9 5.3 Python

    A repo full of secrets. This is designed to test SAST secret scanning tools.

    

21. MCP-Sentinel

    19 1 8 9.7 Python

    PortunusMCP Sentinel: build-time security scanning for MCP servers. (by BashaarJavaid)

    

    Project mention: Ask the model for something your code can check | dev.to | 2026-09-16

    Sentinel scans MCP servers for security issues and asks GPT to review candidate findings in structured JSON. The host throws out any review that cites lines it wasn't shown, returns finding IDs that don't match the batch, or proposes a probe plan that doesn't fit the tool's input schema.

22. argus-codescan-mcp

    20 1 8 8.2 Python

    Argus — open-source security scanner (SAST, secrets, malware heuristics, SARIF, MCP). YAML rules welcome — good first issues.

    

    Project mention: How HN: Argus – open-source security scanner with MCP | news.ycombinator.com | 2026-08-05

23. llm-authz-audit

    21 1 7 3.2 Python

    Scan your LLM-powered applications for authorization gaps, leaked credentials, missing rate limits, prompt injection risks, and other security issues — before they reach production.

    

    Project mention: Show HN: LLM AuthZ Audit – find auth gaps and prompt injection in LLM apps | news.ycombinator.com | 2026-02-15

24. scankii

    22 1 6 7.9 Python

    A local-first SAST & Runtime Security scanner built exclusively for LLM Agents. Detects cross-modal data leaks, prompt injections, and intercepts credentials before execution.

    

    Project mention: Scankii: The First Static Security Scanner Built to Stop AI Agents from Leaking API Keys | dev.to | 2026-07-01

    GitHub Repository: https://github.com/ashp15205/scankii Installation: pip install scankii

25. rowan

    23 1 5 4.2 Python

    Static security scanner for AI applications: source code, model files, dependencies and agent/MCP config, with evidence for every finding. (by hedgerow-dev)

    

    Project mention: Show HN: Rowan, an open-source SAST scanner for AI apps (code, models, MCP)" | news.ycombinator.com | 2026-10-02

26. SaaSHub

    www.saashub.com sponsored

    SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

    

Python Sast related posts

• Show HN: Ansede – Free SAST with 100% CVE recall (Semgrep CE got 23%)

  1 project | news.ycombinator.com | 17 Jul 2026

• I Built a 100% Offline SAST Scanner That Finds What Semgrep and CodeQL Miss

  1 project | dev.to | 8 Jul 2026

• Memory Poisoning: The AI Agent Attack Vector Nobody Is Scanning For

  2 projects | dev.to | 5 Jul 2026

• Four Performance Bugs AI Coders Introduce Every Day

  1 project | dev.to | 30 Jun 2026

• I Built an Offline SAST Scanner — Try It on Your Code and Tell Me Where It Fails

  1 project | dev.to | 29 Jun 2026

• Ansede – an offline SAST scanner I built to catch IDOR and auth bypass

  1 project | news.ycombinator.com | 29 Jun 2026

• Securing MCP Servers: A Practical Guide

  4 projects | dev.to | 28 Jun 2026
• A note from our sponsor - AppSignal
  www.appsignal.com | 16 Oct 2026

  Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise. Learn more →

Index

Sponsored

AppSignal knows why the f*#k it crashed.

Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.

www.appsignal.com

Do not miss the trending Python projects with our weekly report!