sarif-tools

What it is and what it does

SARIF Tools is a command-line utility and Python library for working with SARIF files—the standard interchange format for static analysis tool output. It reads SARIF files produced by security scanners, linters, and code analysis tools, then transforms them into human-readable formats (HTML, CSV, Word documents, Code Climate JSON) or processes them programmatically. The package includes commands to summarize issues, compare results across builds, generate trend reports from timestamped scans, and enhance results with git blame information.

The library depends on jinja2 for templating, jsonpath-ng for navigating SARIF JSON structures, matplotlib for visualization, python-docx for Word document generation, and pyyaml for configuration. It's designed to handle real-world SARIF output from tools that may diverge from the standard—applying minor normalization to severity levels, message formats, and location representations so that results are usable even when tool authors haven't perfectly aligned their output to the spec.

Use it for:

• Convert SARIF output from security scanners into HTML reports for stakeholder review
• Generate CSV exports of all issues found across multiple static analysis tool runs
• Compare SARIF results between two builds to identify newly introduced or resolved issues
• Create Word document summaries of code quality findings for compliance or audit documentation
• Track trends in issue counts over time using timestamped SARIF filenames

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Parses, analyzes, and transforms SARIF (Static Analysis Results Interchange Format) files through command-line tools and a Python library, supporting multiple output formats and comparisons.

Yes. The package is actively maintained, has low install friction, carries a permissive MIT license, and fills a clear need for teams working with SARIF output from multiple static analysis tools. No known vulnerabilities. Install it if you need to process, report on, or compare results from security or code-quality scanning tools.

Install

sarif-tools on PyPI

pip install sarif-tools

uv add sarif-tools

poetry add sarif-tools

Installing sarif-tools

Before you install

Low friction install with a pure Python wheel. Actively maintained as of April 2026 with recent releases. Requires Python 3.8 or later and five runtime dependencies (jinja2, jsonpath-ng, matplotlib, python-docx, pyyaml) that are all standard ecosystem packages.

License in practice

MIT license (permissive) means you can use, modify, and distribute this package freely in commercial and private projects with minimal restrictions.

Quickstart

pip install sarif-tools

# Command-line usage
sarif summary path/to/results.sarif

# Or via Python
from sarif_tools import loader
run = loader.loader_from_file_path('results.sarif')
for result in run.results:
    print(result.message.text)

Requires Python 3.8 or later. The `sarif` command-line tool may need PATH configuration after installation on Windows, Linux, or macOS; alternatively use `python -m sarif`.

Verify before relying

• Whether the package handles all SARIF specification edge cases or only common tool outputs
• Performance characteristics when processing very large SARIF files
• Whether git blame integration (blame command) works across all repository types

Package facts

Evidence: sarif_tools-3.0.5-py3-none-any.whl

Tags

More Quality Assurance packages