---
id: libsast
version: "3.1.8"
license: LGPL-3.0-or-later
license_treatment: copyleft
maintenance: active
---

# libsast — A generic SAST library built on top of semgrep and regex

License: copyleft · Maintenance: active · Downloads: 383.6K/mo

## What it is and what it does

libsast is a Python library that brings static security analysis to your codebase through regex-based pattern matching and semantic-aware analysis. You define security patterns in YAML files and point libsast at your code; it returns a JSON report with matched findings, line numbers, and metadata like CWE and severity classifications.

The library is designed for security engineers who need programmatic access to SAST capabilities rather than a standalone tool. It depends on billiard for task distribution, pyyaml for rule parsing, and requests for network operations. The pattern matcher supports complex logical rules (AND, OR, NOT combinations). Both engines can be used independently or together, with pattern matching available cross-platform and semantic analysis available on Mac and Linux.

Use it for:

- Integrate security scanning into CI/CD pipelines to catch vulnerabilities before code is merged.
- Build custom security analysis tools that apply organization-specific patterns to codebases.
- Scan mobile or web application code for known dangerous APIs and insecure patterns.
- Generate compliance reports by running predefined rule sets across multiple projects.
- Automate security code reviews by detecting common misconfigurations and hardcoded secrets.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

libsast is a static application security testing library that scans code using regex-based pattern matching and semantic analysis to find security issues.

Yes, if you need programmatic SAST capabilities. The library is actively maintained, has no known vulnerabilities, and supports current Python versions (3.10 through 3.14). The copyleft license is acceptable for most open-source and internal use but requires review for proprietary distribution. Install friction is low. Best suited for teams building security tooling or integrating scanning into automated workflows.

## Install

pip install libsast
uv add libsast
poetry add libsast

## Installing libsast

Before you install: Low install friction with a pure-Python wheel distribution. Actively maintained with a recent release 4 days ago and steady commit activity. Requires a separate semantic analysis tool for full functionality; pattern matching works cross-platform but semantic analysis is limited to Mac and Linux.

License in practice: Licensed under LGPL-3.0-or-later (copyleft). Any derivative work or modification must be distributed under compatible terms; proprietary applications linking this library must comply with copyleft obligations.

Quickstart:

pip install libsast

from libsast.scanner import Scanner
scanner = Scanner(path='./code', pattern_file='rules.yaml')
results = scanner.scan()

Semantic analysis support is limited to Mac and Linux; pattern matcher alone is cross-platform. Requires Python 3.10 or later.

Verify before relying:

- Whether the package's API is stable or still evolving given Beta development status.
- Performance characteristics when scanning large codebases or with many custom rules.
- How rule updates are managed and whether dependency versions are pinned or auto-updated.
- Specific capabilities and output format of the Scanner class and its methods.

## Package facts

- License: LGPL-3.0-or-later (copyleft)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 383.6K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

static application security testing, code security scanning, regex pattern matching security, SAST library python, vulnerability detection code, security pattern matcher, semantic code analysis, security-scanning, code-analysis, ci-cd-integration

[View on SkillFed](https://skillfed.io/packages/libsast) · [View on PyPI](https://pypi.org/project/libsast/)