Semgrep SAST Scan
code_scanRead-onlyIdempotent
Run static analysis on source code to identify security flaws like SQL injection, XSS, and hardcoded credentials. Provides CWE classifications, severity, and scan status.
Instructions
Run SAST (Static Application Security Testing) on source code via Semgrep.
Scans for security flaws: SQL injection, XSS, command injection,
hardcoded credentials, insecure deserialization, path traversal, etc.
Returns findings with CWE classifications and severity levels plus a
typed ``findings``, ``clean``, ``skipped``, or ``failed`` status.
Requires ``semgrep`` on PATH (``pip install semgrep``).
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path to source code directory to scan. | |
| config | No | Semgrep config. 'auto' = Semgrep Registry rules. Can be a path or registry string. | auto |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |