---
id: sarif-tools
version: "3.0.5"
license: unclear
license_treatment: permissive
maintenance: active
---

# sarif-tools — SARIF tools

License: permissive · Maintenance: active · Downloads: 558.0K/mo

## What it is and what it does

SARIF Tools is a command-line utility and Python library for working with SARIF files—the standard interchange format for static analysis tool output. It reads SARIF files produced by security scanners, linters, and code analysis tools, then transforms them into human-readable formats (HTML, CSV, Word documents, Code Climate JSON) or processes them programmatically. The package includes commands to summarize issues, compare results across builds, generate trend reports from timestamped scans, and enhance results with git blame information.

The library depends on jinja2 for templating, jsonpath-ng for navigating SARIF JSON structures, matplotlib for visualization, python-docx for Word document generation, and pyyaml for configuration. It's designed to handle real-world SARIF output from tools that may diverge from the standard—applying minor normalization to severity levels, message formats, and location representations so that results are usable even when tool authors haven't perfectly aligned their output to the spec.

Use it for:

- Convert SARIF output from security scanners into HTML reports for stakeholder review
- Generate CSV exports of all issues found across multiple static analysis tool runs
- Compare SARIF results between two builds to identify newly introduced or resolved issues
- Create Word document summaries of code quality findings for compliance or audit documentation
- Track trends in issue counts over time using timestamped SARIF filenames

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Parses, analyzes, and transforms SARIF (Static Analysis Results Interchange Format) files through command-line tools and a Python library, supporting multiple output formats and comparisons.

Yes. The package is actively maintained, has low install friction, carries a permissive MIT license, and fills a clear need for teams working with SARIF output from multiple static analysis tools. No known vulnerabilities. Install it if you need to process, report on, or compare results from security or code-quality scanning tools.

## Install

pip install sarif-tools
uv add sarif-tools
poetry add sarif-tools

## Installing sarif-tools

Before you install: Low friction install with a pure Python wheel. Actively maintained as of April 2026 with recent releases. Requires Python 3.8 or later and five runtime dependencies (jinja2, jsonpath-ng, matplotlib, python-docx, pyyaml) that are all standard ecosystem packages.

License in practice: MIT license (permissive) means you can use, modify, and distribute this package freely in commercial and private projects with minimal restrictions.

Quickstart:

pip install sarif-tools

# Command-line usage
sarif summary path/to/results.sarif

# Or via Python
from sarif_tools import loader
run = loader.loader_from_file_path('results.sarif')
for result in run.results:
    print(result.message.text)

Requires Python 3.8 or later. The `sarif` command-line tool may need PATH configuration after installation on Windows, Linux, or macOS; alternatively use `python -m sarif`.

Verify before relying:

- Whether the package handles all SARIF specification edge cases or only common tool outputs
- Performance characteristics when processing very large SARIF files
- Whether git blame integration (blame command) works across all repository types

## Package facts

- License: not declared (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 558.0K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

SARIF file processing, static analysis results tools, SARIF to HTML conversion, code quality report generation, security scan result analysis, static-analysis, security-scanning, report-generation

[View on SkillFed](https://skillfed.io/packages/sarif-tools) · [View on PyPI](https://pypi.org/project/sarif-tools/)