libsast
A generic SAST library built on top of semgrep and regex
Decision gist · record as of 2026-08-14
Yes, if you need programmatic SAST capabilities. The library is actively maintained, has no known vulnerabilities, and supports current Python versions (3.10 through 3.14). The copyleft license is acceptable for most open-source and internal use but requires review for proprietary distribution. Install friction is low. Best suited for teams building security tooling or integrating scanning into automated workflows.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Semantic analysis support is limited to Mac and Linux; pattern matcher alone is cross-platform.
- Requires Python 3.10 or later.
- Low install friction with a pure-Python wheel distribution.
License · maintenance · safety
LGPL-3.0-or-later (copyleft) — Licensed under LGPL-3.0-or-later (copyleft). Any derivative work or modification must be distributed under compatible terms; proprietary applications linking this library must comply with copyleft obligations.
last release 2026-08-10 (4 days) · last repo commit 2026-08-10 · 139 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 383,550 downloads/mo, #7,076 on PyPI
Alternatives
Verify before relying
pip install libsast
from libsast.scanner import Scanner
scanner = Scanner(path='./code', pattern_file='rules.yaml')
results = scanner.scan()- Whether the package's API is stable or still evolving given Beta development status.
- Performance characteristics when scanning large codebases or with many custom rules.
- How rule updates are managed and whether dependency versions are pinned or auto-updated.
- Specific capabilities and output format of the Scanner class and its methods.
What it is and what it does
libsast is a Python library that brings static security analysis to your codebase through regex-based pattern matching and semantic-aware analysis. You define security patterns in YAML files and point libsast at your code; it returns a JSON report with matched findings, line numbers, and metadata like CWE and severity classifications.
The library is designed for security engineers who need programmatic access to SAST capabilities rather than a standalone tool. It depends on billiard for task distribution, pyyaml for rule parsing, and requests for network operations. The pattern matcher supports complex logical rules (AND, OR, NOT combinations). Both engines can be used independently or together, with pattern matching available cross-platform and semantic analysis available on Mac and Linux.
Use it for
- Integrate security scanning into CI/CD pipelines to catch vulnerabilities before code is merged.
- Build custom security analysis tools that apply organization-specific patterns to codebases.
- Scan mobile or web application code for known dangerous APIs and insecure patterns.
- Generate compliance reports by running predefined rule sets across multiple projects.
- Automate security code reviews by detecting common misconfigurations and hardcoded secrets.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you need programmatic SAST capabilities.
The library is actively maintained, has no known vulnerabilities, and supports current Python versions (3.10 through 3.14). The copyleft license is acceptable for most open-source and internal use but requires review for proprietary distribution. Install friction is low. Best suited for teams building security tooling or integrating scanning into automated workflows.
Install
libsast on PyPI
Before you install
Low install friction with a pure-Python wheel distribution. Actively maintained with a recent release 4 days ago and steady commit activity. Requires a separate semantic analysis tool for full functionality; pattern matching works cross-platform but semantic analysis is limited to Mac and Linux.
Semantic analysis support is limited to Mac and Linux; pattern matcher alone is cross-platform. Requires Python 3.10 or later.
License in practice
Licensed under LGPL-3.0-or-later (copyleft). Any derivative work or modification must be distributed under compatible terms; proprietary applications linking this library must comply with copyleft obligations.
Quickstart
pip install libsast
from libsast.scanner import Scanner
scanner = Scanner(path='./code', pattern_file='rules.yaml')
results = scanner.scan()Verify before relying
- Whether the package's API is stable or still evolving given Beta development status.
- Performance characteristics when scanning large codebases or with many custom rules.
- How rule updates are managed and whether dependency versions are pinned or auto-updated.
- Specific capabilities and output format of the Scanner class and its methods.
Package facts
| License | LGPL-3.0-or-later copyleft |
| Python support | Supports the current Python release <4.0,>=3.10 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 3 packagesbilliardpyyamlrequests |
| Maintenance | Actively maintained 4 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 383,550 / month, #7,076 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 4 - BetaIntended Audience :: DevelopersLicense :: OSI Approved :: GNU Lesser General Public License v3 or later (LGPLv3+)Programming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Topic :: SecurityTopic :: Software Development :: Quality Assurance |
Evidence: libsast-3.1.8-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “static application security testing”
- libsastlibsast is a static application security testing library that scans…
- flawfinderFlawfinder scans C/C++ source code to identify potential security…
- bingo-aibingo is an AI-powered red team terminal that automates security…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also njsscan · semgrep · mobsfscan · flawfinder · zaproxy · anys · secscanner2junit · kingfisher-bin · cycode · zizmor