User-friendly documentation for the SARIF file format.

⚙️ Scan your Go, Java, Kotlin, PHP, Python, JavaScript, TypeScript, .NET projects at GitHub with Qodana. This repository contains Qodana for Azure, GitHub, CircleCI and Gradle

Corax for Java: A general static analysis framework for java code checking.

Lint, format and auto-fix your Groovy / Jenkinsfile / Gradle files using command line

🔧 JetBrains Qodana’s official command line tool

Fully open-source SAST scanner supporting a range of languages and frameworks. Integrates with major CI pipelines and IDE such as Azure DevOps, Google CloudBuild, VS Code and Visual Studio. No server required!

♿ Suite of open and standards-based tools for performing reliable accessibility conformance testing at scale

A group of Rust projects for interacting with the SARIF format

A React-based component for viewing SARIF files.

Go library for SARIF - Static Analysis Results Interchange Format

🐚 GitHub Action for running ShellCheck differentially

vexctl is a tool to attest VEX impact statements

SARIF Explorer: A VSCode extension that helps you visualize and triage static analysis results

GitHub Action for filtering Code Scanning alerts by path and id

GitHub issue manager from vulnerability scan results for private repositories

Detect npm packages compromised in the Shai-Hulud 2.0 supply chain attack (Nov 2025). Scans for 790+ malicious packages, suspicious scripts, TruffleHog activity, SHA1HULUD runners, and secrets exfiltration. GitHub Action with SARIF support.

Automate vulnerability triage which prioritizes remediation over discovery

JS/TS library to easily build valid SARIF output from your javascript based SAST tools

Machine output for Mix tasks

☕️ Java library for working with SARIF files by Qodana team