Best SAST Tools in 2026
Updated
In short: Semgrep Code is ranked #1 of 20 as of 30 September 2026, ahead of GitHub CodeQL and PVS-Studio. The best-ranked option with a free plan is GitHub CodeQL. The lowest first paid tier on this page is Semgrep Code at $30/mo.
20 sast tools ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
| # | Platform | Score | Why | From | Free plan | Paid from | Analysis targets | |
|---|---|---|---|---|---|---|---|---|
| 1 | Semgrep Code | 9.0 | RecognisedAPIDocumented | $30/mo | Yes | — | source code | View |
| 2 | GitHub CodeQL | 7.5 | RecognisedAPIDocumented | $30/mo | Yes | — | source code | View |
| 3 | PVS-Studio | 7.1 | RecognisedAPIDocumented | — | No | — | source code | View |
| 4 | CodeSonar | 6.6 | RecognisedAPIDocumented | — | — | — | source code, binaries | View |
| 5 | NaiveSystems Analyze | 6.6 | RecognisedAPIDocumented | — | Yes | — | source code | View |
| 6 |  MobSF | 6.5 | RecognisedAPIDocumented | — | Yes | — | source code, binaries | View |
| 7 | DerScanner | 6.4 | RecognisedAPIDocumented | — | — | — | source code, bytecode, binaries | View |
| 8 | Bearer | 6.4 | RecognisedAPIDocumented | — | Yes | — | source code | View |
| 9 | Joern | 6.0 | RecognisedAPIDocumented | — | Yes | — | source code, bytecode, binaries | View |
| 10 | Fluid Attacks | 5.8 | RecognisedAPIDocumented | — | No | — | source code | View |
| 11 | Kiuwan Code Security | 5.8 | RecognisedAPIDocumented | — | No | 49 /user/mo | source code | View |
| 12 |  Bandit | 5.6 | RecognisedAPIDocumented | — | Yes | — | source code | View |
| 13 | Qwiet AI | 5.5 | RecognisedAPIDocumented | — | No | — | source code and dependencies | View |
| 14 |  gosec | 5.5 | RecognisedAPIDocumented | — | Yes | — | source code | View |
| 15 |  Security Code Scan | 5.4 | RecognisedAPIDocumented | — | — | — | source code | View |
| 16 |  HCL AppScan Source | 5.3 | RecognisedAPIDocumented | — | No | — | source code | View |
| 17 |  NodeJsScan | 5.3 | RecognisedAPIDocumented | — | — | — | source code | View |
| 18 | Flawfinder | 5.3 | RecognisedAPIDocumented | — | Yes | — | source code | View |
| 19 |  Brakeman | 4.8 | RecognisedAPIDocumented | — | — | — | source code | View |
| 20 | ZeroPath | 4.7 | RecognisedAPIDocumented | — | No | 60 /user/mo | source code | View |
Is your platform on this list?
Numbered spots on this list can be sponsored. They are labelled, and the editorial order and scores never change for payment.
Questions about this list
Which sast tool is ranked first on Inferse?
Semgrep Code is ranked #1 of 20 with a score of 9.0. GitHub CodeQL is second and PVS-Studio third.
How many of these have a free plan?
2 of the 20 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, Semgrep Code has the lowest first paid tier we found: $30/mo.
How is this list ranked?
Ranked on what each maker publishes, open and connectable first: a public API, open-source code, the depth of its documentation and a free tier to try it on. Model lists are sorted by the figure in their title, exactly as each provider publishes it. Paid placements never change a rank.