10 Best SAST Tools in 2026 (Open Source to AI-Powered)

TL;DR

• Our pick if you want free classic SAST: Semgrep Community Edition, or Opengrep for a fork without rules-license strings.
• Our pick if you live on GitHub: CodeQL, free on open source and public repos.
• Our pick if you need enterprise coverage: OpenText Static Application Security Testing (formerly Fortify).
• Our pick for AI triage on a scanner: Endor Labs, or Snyk Code if you work in the IDE.
• Our pick for AI-native review: Trent, which is ours.
• Our pick if you are replacing a paid suite: Semgrep or Opengrep, and Bandit or gosec for SAST, plus Trivy for dependencies and containers, and Checkov for IaC.
• In our CWE-Bench test of five tools, on 28 real Java CVEs, Trent pointed to the right file 25% of the time against 8.7% for Claude Code, 3.6% for Semgrep and 3.7% for CodeQL; on the looser right-bug-class measure Claude Code (65%) and Trent (64.3%) were level. Recall only.

What is a SAST tool?

A SAST tool, or static application security testing scanner, reads your source or compiled code without running it and flags security weaknesses before the code ships. It is the static half of the pair in our glossary entry on static and dynamic analysis, and why static code analysis tools sit in almost every CI pipeline.

How it works:

1. Parse. The scanner turns your code into a structure it can reason over, usually an abstract syntax tree.
2. Trace. It follows data and control flow from untrusted inputs to sensitive sinks, for example, tracking an HTTP parameter into a SQL string.
3. Match and rank. It applies rules or queries to that graph, then sorts findings by severity.

How we chose and how we tested

Of course Trent is on this list, and not only because you are reading the Trent blog. We benchmarked it on real CVEs and published the results; limits included. We also point out the cases where another tool is the more logical choice.

We scored every tool on language coverage, CI fit, the real license and cost, what its AI actually does, and whether any of it is backed by checkable evidence. The pricing, caps, and license information are based on the information available in September 2026 and might change in the future.

We also ran our own benchmark. We put five tools, ours among them, against 28 real CVEs from CWE-Bench-Java in 22 repository snapshots across four CWE classes: cross-site scripting, path traversal, code injection and OS command injection. Each ran three times on a standard configuration; we report recall only. The test did not measure precision, cost, runtime, or developer experience, and the labelled file is an anchor, not the single vulnerable file. The dataset is public at iris-sast/cwe-bench-java.

Comparison table: ten best SAST tools at a glance

We grouped the ten tools by how they find bugs, newest approach first, so you know what kind of tool you are looking at before you compare prices.

• AI-native review. These read your whole repo and work out what your code is trying to do. No rule set.
• SAST with AI triage. You get a rule-based scanner, plus an LLM that sorts the findings and writes the patch.
• Classic. Rules that match patterns and trace untrusted input through your code. The enterprise platforms add more languages and the audit trail a regulated team needs.

The ten SAST scanners, newest to classic

AI-native review

1. Trent. Trent is an AI Security Engineer. It does the SAST job on your code, then keeps going into your cloud, AI agents and MCP servers. Point it at a repo and it reconstructs your architecture from the real code and inventories every component from traditional services and DBs to agents, tools, skills and MCP servers, tagging each by what it can do: Read, Write, Execute, Egress. It draws the capability graph, traces attack chains mapped to MITRE ATLAS techniques and CWE vulnerabilities, hands you the fix and confirms it landed. Trent is a SaaS application with a web UI, and MCP-compatible agents like Claude Code, Codex and Cursor can also connect to its remote MCP server. SAST, DAST, and software composition analysis are not obsolete, and an AI security engineer does not replace them. Not a pentest service, not a WAF, no runtime blocking. On our CWE-Bench-Java run, recall only, Trent reached 25% Detection Rate against 8.7% for Claude Code, on the public cwe-bench-java dataset. The case for it is strongest when you ship agents or AI-written code. Get access.

2. ZeroPath. LLM-based review that reads application context, authentication flows and business logic instead of matching patterns, then opens fix pull requests. It publishes its price, rare in this tier: Team starts at $1,000 a month plus $60 per developer. Its SAST page lists 15+ languages, with GitHub, GitLab, Bitbucket and Azure DevOps, and it imports other scanners’ findings. RSAC 2026 Innovation Sandbox top ten. If your buying process needs a number on a page today, start here, not at a quote-only platform.

3. Corgea. AI-native SAST with autofix, aimed at the gap between a linter and a platform. The free tier covers 2 developers, 10 repositories and 10 autofixes a month; Growth $39 per developer per month, Scale $49. About 11 languages named, with GitHub, GitLab, Azure DevOps, IDE, Jira and Linear integrations. Its pages disagree on some integration statuses, so confirm what you need. Small teams that want fixes rather than a queue get the most from it.

SAST with AI triage and fix

4. Endor Labs. Its docs describe two modes: rule-based SAST powered by Opengrep, and AI SAST, “LLM-powered agents that find vulnerabilities rule-based scans cannot express, and triage rule-based findings to cut false positives”. Reachability analysis and remediation sit on top. The developer tier is free; seat pricing is quote only. Its vendor-run benchmark, published June 2026 and updated September 2026, reports recall of 0.435 and F1 of 0.465 across eight real projects, with the caution due any vendor’s own numbers. Reachability context is the draw here: it rules out code paths nothing calls. Reach for it when your alert queue has stopped being useful. For a team that wants rule-based and AI SAST plus SCA reachability in one seat-priced platform, Endor is a decent choice.

5. Snyk Code. The DeepCode AI engine, with integrations that reach further into the IDE than most. DeepCode AI Fix is now Snyk Agent Fix; in May 2026 it moved to a new agentic architecture covering all Code languages. A free plan exists with monthly test caps: read the numbers on the plans page, because third-party figures are stale. Team is $25 per contributing developer per month. For a team that lives in the IDE and wants fixes suggested as it types, Snyk Code is sound.

Classic, rule-based SAST

6. Semgrep. The default developer SAST. The Community Edition engine is LGPL 2.1, but Semgrep-maintained registry rules moved to the Semgrep Rules License v1.0 in December 2024, not an OSI license. The free platform tier caps at 10 contributors and 10 private repos; Teams starts at $30 per contributor per month per product. Opengrep forked the engine in January 2025 for that reason. If you are a small team writing your own rules and wanting PR checks with no procurement, Semgrep or Opengrep is preferable to any AI-native platform.

7. CodeQL. Semantic analysis: you query your code as data, catching cross-file taint that pattern matching misses. Queries are MIT, the CLI runs under GitHub terms, and it is free for open source and public repos; private code needs GitHub Code Security. It covers ten languages and does not support PHP or Scala. Copilot Autofix suggests patches; a September 2026 AI Scan preview drops the default-setup requirement. If your repos are public and on GitHub, CodeQL is a more logical first move than paying for an AI review layer.

8. SonarQube. A code quality platform first and a security scanner second. Community Build, renamed from Community Edition in December 2024, is an LGPLv3 server with SSALv1 analyzers, analyzes the main branch, and excludes Advanced SAST and SCA. Injection detection sits in Cloud Free and Server, not Community Build, which covers about 21 languages against 35+ in paid editions. Check the feature comparison table for what your edition does on pull requests; that line is ambiguous.

9. Checkmarx One. The regulated-enterprise platform: SAST, SCA, IaC, API security and supply chain in one console, with Developer Assist, Triage Assist and Remediation Assist doing the AI work, plus MCP support. There is no public list price, so it is quote only, priced on how many developers and applications you have. 35+ languages reported. The Fusion hybrid engine and its F1 figures are vendor claims from Checkmarx’s own testing. It fits when you need one auditable platform and a named control owner.

10. OpenText Static Application Security Testing. Formerly Fortify Static Code Analyzer. It claims 44+ languages and more than 1,500 vulnerability categories, which is why it survives in banks and insurers. Version 26.1, January 2026, added an AI analyzer covering languages without hand-written rules, including Bash, Groovy, Perl and PowerShell. Remediation Aviator suppresses false positives and suggests fixes. Quote only. Best for legacy polyglot estates where nothing else reads the older frameworks.

Also worth a look: Veracode, which offers source, binary and hybrid scanning; GitLab SAST if you are on GitLab, built in across Free, Premium and Ultimate; and Bearer CLI, acquired by Cycode in 2024, Elastic License 2.0.

What changed in SAST scanners since 2024

Tools sold as SAST now fall into three groups. Rule-based scanners match patterns and trace taint. The same scanners with an LLM layer triage findings and write patches. AI-native review throws out the rule set and reads what the code is trying to do, across the whole repo.

Two small studies test the third group. In one, three LLMs tested against SonarQube, CodeQL and Snyk Code on ten C# projects scored F1 0.75 to 0.80 against 0.26 to 0.55 for the scanners, alongside more false positives and imprecise line numbers (arXiv 2508.04448). The second found LLMs removed about a third of real SAST false positives with no true positives lost (arXiv 2506.16899).

No neutral, like-for-like false-positive comparison across these tools was found; small academic studies report their own. Treat AI review as a layer that adds recall and costs precision.

How we benchmarked, and what the numbers say

We ran five tools three times each on the setup above, measuring recall only and no precision, since the repos may hold vulnerabilities outside the labelled set.

On Detection Rate, the right class found at the labelled file: Trent 25%, Claude Code 8.7%, CodeQL 3.7% and Semgrep 3.6%. On Category Detection Rate, the right class found anywhere in the repository: Claude Code 65%, Trent 64.3%, Semgrep 42.9% and CodeQL 11.1%. That second measure is a permissive match that credits the right bug class anywhere, not proof the specific vulnerability was found.

Trent (64.3%) and Claude Code (65%) find the right bug class at about the same rate; the gap opens on pinning it to the right file. Method and caveats are in the benchmark post; the dataset is at iris-sast/cwe-bench-java.

How to choose a SAST scanning tool by team size and stack

Pick by what you ship and who maintains the pipeline.

Solo or small team. Semgrep CE or Opengrep in CI, plus Bandit or gosec for your language, plus CodeQL if your repos are public. For PR checks today with no procurement, that stack is where to start.

Product team. A paid platform with pull-request comments and AI triage, chosen on language coverage and cross-file taint, where free engines stop. If a published price matters more to your finance team than a request-access conversation, start with ZeroPath.

Regulated enterprise. Checkmarx One or OpenText, plus a compliance mapping that names SAST as a control and names who owns it.

Any team shipping agents or AI-generated code. Add an AI-native review layer on top of the scanner, not instead of it. A scanner checks the code itself, not what your agents can reach.

Best open-source SAST tools

Four picks genuinely free to run. Free tools move maintenance and tuning cost onto your team.

• Semgrep Community Edition or Opengrep: good enough for broad, customizable PR checks across 30+ languages. Engine LGPL 2.1 in both, and Opengrep exists because the rules license changed.
• CodeQL: deep semantic analysis on public repositories, with cross-file taint the pattern matchers do not attempt. Private code needs a paid license.
• Bandit: Apache 2.0, Python only. A solid baseline in CI, with SARIF output and a pre-commit hook.
• gosec: Apache 2.0, Go only. Good enough for Go-specific checks, with SSA-based taint analyzers in the current release.

The part listicles skip: several tools people call open source are not. Semgrep’s maintained registry rules sit under the Semgrep Rules License v1.0, SonarQube Community Build ships SSALv1 analyzers, Bearer CLI is Elastic License 2.0, and Brakeman is free to use but requires a paid license for “Commercial Uses” as its license defines them, so it is not OSI open source. All four are worth running. Just do not assume the 2023 license still holds.

Where to start

Your stack, your budget, and the share of AI-written code you ship decide the next step. Start free with Semgrep or Opengrep, add a paid platform when cross-file taint or PR triage is the bottleneck, and add an AI-native layer like Trent when you need security review that goes past what a scanner can see, across your code, cloud and agents.

Reviewed by Brammert Ottens, MTS @ Trent AI