Best SAST Tools in 2026
Updated
Static application security testing tools help you examine code for security issues during development. Compared on analysis targets and languages supported, the entries offer ways to assess what code each can review. IDE support, CI/CD integration and pull request scans show integration points to consider, while automated fixes and custom security rules add further dimensions. Free-plan availability and paid-from pricing provide cost context. Semgrep Code, Snyk Open Source and Veracode DAST are among the named options. As you assess fit, consider the languages and repositories you need to cover, where checks should run in your workflow and whether your team needs rule customization or help addressing findings.
SAST Tools, one module each.A lit port is something its maker publishes; 12 of 12 with a known API signal have a public API.
- 01 Semgrep Code API yesFREE yesDOCS 7.4$30/mo
- 02 Snyk Open Source API yesFREE yesDOCS 7.4$25/mo
- 03 MobSF API yesFREE yesDOCS 7.3$250/mo
- 04 NodeJsScan API yesFREE yesDOCS 7.3Free
- 05 Joern API yesDOCS 7.0
- 06 Veracode DAST API yesDOCS 7.0
- 07 Checkmarx API Security API yesDOCS 6.8
- 08 DerScanner API yesDOCS 6.8
- 09 Kiuwan Code Security API yesFREE noDOCS 6.8$4.08/mo
- 10 Qwiet AI API yesDOCS 6.8
- 11 ZeroPath API yesFREE noDOCS 6.8$1,000/mo
- 12 Fluid Attacks API yesDOCS 6.7
- 13 Bandit FREE yesDOCS 5.9Free
- 14 Brakeman FREE yesDOCS 5.9Free
- 15 Flawfinder FREE yesDOCS 5.9Free
- 16 gosec FREE yesDOCS 5.9Free
- 17 NaiveSystems Analyze FREE yesDOCS 5.9Free
- 18 Security Code Scan FREE yesDOCS 5.9Free
- 19 Bearer FREE yesDOCS 5.8Free
- 20 Black Duck Coverity DOCS 5.5
- 21 CodeSonar DOCS 5.5
- 22 PVS-Studio DOCS 5.5
- 23 HCL AppScan Source DOCS 5.3
- 24 Klocwork DOCS 5.2
- 25 OpenText Fortify SAST DOCS 5.2
Compare all 25 in a table
| # | Platform | Score | Free plan | From | Free plan | Paid from | Analysis targets | Languages supported |
|---|---|---|---|---|---|---|---|---|
| 1 | Semgrep Code | 7.4 | Free plan | $30/mo | Yes | source code | 35 | |
| 2 | Snyk Open Source | 7.4 | Free plan | $25/mo | Yes | source code | 16 | |
| 3 | MobSF | 7.3 | Free plan | $250/mo | Yes | source code, binaries | ||
| 4 | NodeJsScan | 7.3 | Free plan | Free | source code | |||
| 5 | Joern | 7.0 | Yes | source code, bytecode, binaries | ||||
| 6 | Veracode DAST | 7.0 | source code, bytecode, binaries | |||||
| 7 | Checkmarx API Security | 6.8 | No | source code | ||||
| 8 | DerScanner | 6.8 | source code, bytecode, binaries | |||||
| 9 | Kiuwan Code Security | 6.8 | No | $4.08/mo | No | 49 /user/mo | source code | |
| 10 | Qwiet AI | 6.8 | No | source code and dependencies | ||||
| 11 | ZeroPath | 6.8 | No | $1,000/mo | No | 60 /user/mo | source code | |
| 12 | Fluid Attacks | 6.7 | No | source code | 14 | |||
| 13 | Bandit | 5.9 | Free plan | Free | Yes | source code | ||
| 14 | Brakeman | 5.9 | Free plan | Free | source code | |||
| 15 | Flawfinder | 5.9 | Free plan | Free | Yes | source code | ||
| 16 | gosec | 5.9 | Free plan | Free | Yes | source code | ||
| 17 | NaiveSystems Analyze | 5.9 | Free plan | Free | Yes | source code | ||
| 18 | Security Code Scan | 5.9 | Free plan | Free | source code | |||
| 19 | Bearer | 5.8 | Free plan | Free | Yes | source code | ||
| 20 | Black Duck Coverity | 5.5 | No | source code | ||||
| 21 | CodeSonar | 5.5 | source code, binaries | |||||
| 22 | PVS-Studio | 5.5 | No | source code | ||||
| 23 | HCL AppScan Source | 5.3 | No | source code | ||||
| 24 | Klocwork | 5.2 | source code | |||||
| 25 | OpenText Fortify SAST | 5.2 | source code, bytecode, binaries |
Is your platform on this list?
Numbered spots on this list can be sponsored, and a sponsored row is labelled as paid.