Static Application Security Testing (SAST) Tools logopeterindia.net
Knowledge Hub

Static Application Security Testing (SAST) Tools

A curated directory of static application security testing tools — source code vulnerability scanning and security analysis for DevSecOps, from enterprise platforms to open-source scanners for Java, Python, Ruby, Go and JavaScript.

42 topics•5 categories•Updated October 2026

Commercial SAST Platforms

12 entries

Enterprise static analysis with deep language coverage, policy and reporting.

01OpenText Fortify SAST (Fortify Static Code Analyzer)Static code analysis for security with deep taint analysis, in the portfolio OpenText took over from Micro Focus. 02CheckmarxApplication security platform with SAST, SCA and API security integrated into IDEs and CI/CD pipelines. 03VeracodePolicy-driven static and dynamic scanning integrated into the developer workflow. 04Coverity SAST (Black Duck)Static analysis engine for security and quality defects, from the former Synopsys Software Integrity business, now Black Duck. 05HCL AppScanApplication security testing for web, mobile and open-source code, including static analysis. 06Snyk CodeDeveloper-focused SAST with IDE-native scanning and fix suggestions. 07Mend SASTStatic application security testing from Mend.io. 08KiuwanStatic application security testing covering OWASP Top 10 and CWE across many languages. 09Qwiet AI (now part of Harness)Code analysis using code property graphs to find vulnerabilities in pull requests; the site is now branded Qwiet AI by Harness. 10ParasoftAutomated testing tools with static analysis and compliance reporting for safety-critical industries. 11Perforce KlocworkStatic code analysis for security, safety and quality, aimed at large and embedded codebases. 12GrammaTech CodeSonarStatic analysis and software assurance for security and safety-critical code.

Developer-Platform & Code Quality Scanners

7 entries

SAST built into developer platforms and code quality tools.

13SonarQubeContinuous inspection of code quality and security across branches and pull requests. SonarQube Community Build 26.10.0 was released on 12 October 2026, according to GitHub. 14GitHub CodeQLCode analysis engine that queries code as data; powers GitHub code scanning. CodeQL CLI v2.27.3 was released on 20 October 2026. 15GitLab SASTStatic analysis built into GitLab CI/CD pipelines. 16CodacyCode quality and security platform for teams using AI-assisted coding. 17DeepSourceAI code review platform with static analysis and security checks. 18Qodana (JetBrains)Static code analysis from JetBrains for CI pipelines. 19CASTSoftware intelligence measuring structural quality, technical debt and architecture risk.

Open-Source & Language-Specific Scanners

11 entries

Free tools, many built for one language or framework.

20SemgrepOpen-source static analysis engine using code-like rules. Semgrep v1.183.0 was released on 29 October 2026, according to GitHub. 21OpengrepOpen-source code security engine forked from Semgrep. Opengrep v1.33.1 was released on 29 October 2026. 22BrakemanStatic analysis security scanner for Ruby on Rails. Brakeman v8.1.0 was released on 30 September 2026. 23BanditSecurity linter that finds common issues in Python code. Bandit 1.9.4 was released on 25 February 2026. GitHub lists 1.9.4 as the latest release, from February 2026. 24gosecSecurity checker for Go source code. gosec v2.30.0 was released on 23 October 2026, according to GitHub. 25SpotBugsStatic analysis for Java bugs; the Find Security Bugs plugin adds security rules. SpotBugs 4.10.5 was released on 12 October 2026. 26Find Security BugsSpotBugs plugin that detects security issues in Java applications. The latest release listed on GitHub is 1.14.0, from June 2025. 27nodejsscanStatic security code scanner for Node.js applications. The latest release listed on GitHub is v4.8, from September 2023, so check that it still fits your stack. 28Coverity ScanFree static analysis service for open-source projects. 29JSHintJavaScript linter for errors and coding-standard issues; a code quality tool rather than a security scanner. 30ESLintPluggable JavaScript linter, often used with security plugins. ESLint v10.14.0 was released on 30 October 2026.

AI-Driven Vulnerability Discovery

3 entries

Agentic tools that go beyond pattern-based scanning by reasoning about a codebase, reproducing findings and proposing patches. Verify their output manually and run them in isolation from production.

31Mantis (Google)Apache-2.0 toolkit of security review skills that lets AI coding agents such as Gemini CLI find, reproduce and patch vulnerabilities, using sandboxed reproduction to reduce false positives. Google says AI-generated reports and patches need manual verification. 32Getting started with the Mantis harnessGoogle Cloud blog post on using Mantis to find and fix bugs. 33InfoQ: Google open-sources MantisNews report on the framework and its approach to false positives.

Related Pages

9 entries

Related directories on this site.

34Application Security Testing ToolsAST platforms covering SAST, DAST, IAST and SCA. 35DAST ToolsDynamic application security testing tools. 36Static Code Analysis ToolsGeneral-purpose static analysis tools. 37Source Code Review ToolsTools for reviewing source code. 38Software TestingHub of software testing directories. 39CybersecurityCybersecurity solutions and services. 40Vulnerability Scanning Tools for AI AgentsRed-teaming and scanners for LLMs, agents and MCP servers, on this site. 41AI Application Security SolutionsSecurity for AI applications and agents, on this site. 42AI Agent Code Verification ToolsChecks for AI-written code: in-agent checks, quality gates, scanning and tests.

Frequently Asked Questions

What is SAST?

Static application security testing analyses source code, byte code or binaries for vulnerabilities without running the program, so developers can fix issues early in the life cycle.

How is SAST different from DAST?

SAST inspects the code from the inside before it runs, while DAST attacks the running application from the outside. They find different kinds of problems, so many teams use both.

Which products were renamed?

Micro Focus Fortify is now OpenText Fortify, Synopsys Coverity is now Black Duck Coverity, and ShiftLeft is now Qwiet AI, which is part of Harness.

Why were Rapid7 and Burp Suite removed?

Both are dynamic (DAST) tools, not SAST, so they are linked from the Application Security Testing Tools and DAST pages instead.

Are the links checked?

Links were checked when this page was updated. MathWorks Polyspace blocked automated checks so it is not listed. OpenText blocked automated checks but loaded in a browser.

Can AI agents find and fix vulnerabilities in source code?

Some open-source frameworks now try. Google's Mantis gives AI coding agents skills to review a codebase, reproduce suspected vulnerabilities in a sandbox and draft patches. Google warns that the reports and patches are not always accurate, so security experts should verify them and run the tools away from production systems.

Which SAST tools are open source and actively released?

According to their GitHub releases, Semgrep (v1.182.0, 20 October 2026), Opengrep (v1.31.0, 15 October 2026), Brakeman (v8.1.0, 30 September 2026), gosec (v2.29.0, 26 August 2026) and SpotBugs (4.10.5, 12 October 2026) have all released recently. Bandit's latest is 1.9.4 from February 2026, Find Security Bugs' is 1.14.0 from June 2025 and nodejsscan's is v4.8 from September 2023.

Where do commercial SAST vendors sit in Gartner research?

The most recent Gartner Magic Quadrant for Application Security Testing that was found was published on 6 October 2025, and it included vendors such as Black Duck, Checkmarx, GitHub, GitLab, HCLSoftware, Mend.io, OpenText, Semgrep, Snyk and Veracode. Checkmarx and OpenText say they were named Leaders. Gartner does not endorse any vendor, and the full report is paywalled, so check Gartner for placements.

How current is this page?

Links were checked in October 2026. OpenText returned an unresolved response and HCL AppScan returned an HTTP 202 to automated checks, so those links may need a manual click. Release facts are from GitHub, and vendor descriptions follow each vendor's own pages.

Which links may need a manual click?

Links were rechecked in October 2026. HCL AppScan returned an HTTP 202 and the OpenText page returned an unresolved response to automated checks; they are kept and may need a manual click. For related tooling, see DAST Software, Software Composition Analysis and Secrets Management Tools.