Semgrep SAST Scan
code_scanRead-onlyIdempotent
Run static application security testing on source code to identify vulnerabilities like SQL injection, XSS, and hardcoded credentials, returning CWE classifications and severity levels.
Instructions
Run SAST (Static Application Security Testing) on source code via Semgrep.
Scans for security flaws: SQL injection, XSS, command injection,
hardcoded credentials, insecure deserialization, path traversal, etc.
Returns findings with CWE classifications and severity levels plus a
typed ``findings``, ``clean``, ``skipped``, or ``failed`` status.
Requires ``semgrep`` on PATH (``pip install semgrep``).
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path to source code directory to scan. | |
| config | No | Semgrep config. 'auto' = Semgrep Registry rules. Can be a path or registry string. | auto |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |