What is SAST?

SAST parses your code, usually into an AST or an intermediate representation, and matches it against rules describing insecure patterns: SQL injection, XSS, command injection, unsafe deserialisation, weak cryptography and so on. Because it never executes anything, it can run on every commit and reach code paths a test suite never triggers.

That is also its weakness. Without runtime facts, a SAST engine has to reason about what *could* happen, so it over-reports. The difference between a usable SAST tool and an ignored one is almost entirely about false-positive rate and whether findings arrive somewhere developers already work.

Top 19 SAST tools

Every tool in the directory documented as supporting SAST, with what its own documentation says.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

1. 1
   CodacyQuality PlatformTeam

   Bandit, Checkov, Clang-Tidy, Gosec, Opengrep, SpotBugs across 20+ security categories.

2. 2
   AikidoCode Security Platform

   13 named languages; SQLi, XSS, CSRF, deserialization, crypto, command injection, path traversal, XXE

3. 3
   ChatGPT / CodexAgent Coding ToolPro/business/enterprise/edu (not plus)

   Codex Security agent finds, validates and reports vulnerabilities with SARIF export.

4. 4
   Checkmarx OneCode Security Platform

   Graph-based SAST needing no compilation; hundreds of queries per language, Best Fix Location, visual Attack Vector.

5. 5
   Claude CodeAgent Coding ToolPro

   Agentic security review statically finds injection, SSRF, auth bypass, IDOR and weak crypto in code.

6. 6
   CodeAnt AIPR Review

   Security rules engine covering 9 named OWASP Top 10 2021 categories with language-specific checks

7. 7
   CodeRabbitPR ReviewPro

   Catalog includes Semgrep, OpenGrep, Brakeman, PHPStan, fbinfer, PMD, detekt; tool support from Pro

8. 8
   CorgeaCode Security Platform

   BLAST AI-native SAST, ~900 CWEs, 11 languages

9. 9
   Cursor (Bugbot)PR ReviewTeam

   Bugbot flags security issues in diffs; Security Agents scan for vulnerabilities, no engine or rule detail.

10. 10
    DeepSourceQuality Platform

    Bug risk, security, anti-pattern, performance, and typecheck issues across 18 core analyzers.

11. 11
    Gemini Code AssistAgent Coding ToolGating not documented (preview)

    PR review flags injection, CSRF, IDOR, input-validation and insecure-storage issues in changed code.

12. 12
    GitHub Advanced SecurityCode Security PlatformFree on public repos; add-on: Code Security ($30/committer/mo) for private

    CodeQL semantic analysis with default and security-extended query suites, plus an AI engine for uncovered languages

13. 13
    GreptilePR Review

    Opengrep rule-based pattern-matching SAST engine plus AI review catch SQLi, SSRF, injection and more

14. 14
    QltyQuality PlatformFree (CLI)

    Semgrep plus Bandit, Brakeman, PMD, radarlint analyzers and ESLint security rules

15. 15
    QodoPR Review

    Compliance checks flag SQL injection, XSS, CSRF and insecure data handling in PR diffs.

16. 16
    SemgrepCode Security Platform

    Pattern plus taint rules; intraprocedural in CE, cross-function default, cross-file needs Pro Engine (Teams).

17. 17
    SnykCode Security Platform

    Snyk Code semantic SAST (DeepCode AI engine) across IDE, CLI, SCM and CI/CD.

18. 18
    SonarQubeQuality Platform

    Injection, arbitrary file read/write, access control, authentication, and cryptography rules.

19. 19
    VeracodeCode Security Platformadd-on

    Upload and Scan plus Pipeline Scan on compiled/packaged artifacts, CWE-mapped, 0-5 severity scoring

What to look for

• Whether the engine does real data-flow analysis or only pattern matching
• False-positive rate on your own codebase during a trial
• Per-language depth, since support lists are broader than analysis quality
• Whether you can write custom rules for your own frameworks

Related terms

FAQ