Semgrep

deepsec is an open-source, agent-powered vulnerability scanner and security harness from Vercel Labs for on-demand review of large codebases within the user's own infrastructure. It identifies candidate vulnerabilities, uses AI models to investigate them, supports triage and optional revalidation to reduce false positives, and can run work across parallel worker machines. The CLI initializes a repository with `npx deepsec init`, stores state and findings in a `.deepsec/` directory, and resumes interrupted runs while skipping files already analyzed. Subsequent commands separate fast pattern scanning from AI processing and revalidation, and findings can be exported as Markdown directories or JSON. Model access can use Vercel AI Gateway, direct OpenAI or Anthropic credentials, or a custom HTTPS provider; scan cost and duration can be capped with command-line options.

Evo by Snyk is a security and governance platform for AI-native applications, agentic development, and AI systems. It provides continuous visibility, governance, testing, and real-time control across the AI software lifecycle. Its Agentic Development Security capability discovers models, agents, MCP servers, datasets, plugins, tools, and services used by agents across repositories; generates an AI bill of materials; applies policy and guardrails to agent actions; and validates AI-generated code before it reaches repositories, pipelines, or production. Its Continuous Offensive Security capability autonomously stress-tests applications and AI systems like an adversary, with agents coordinating reconnaissance, vulnerability hunting, exploit validation, remediation, and reporting, and an independent validation model intended to confirm exploitability before reporting findings. Testing is intended to run on code changes and pull requests.

Sonar is a software code-quality and code-security company whose products provide automated code review and verification from the IDE through CI/CD pipelines. Its platform uses a Guide–Verify–Solve model: teams set coding context and constraints, review code for reliability, security, quality, and compliance through algorithmic and agentic verification, and generate fixes for detected issues and technical debt. It also provides agentic CI verification and background code-maintenance loops intended to validate AI-generated code and improve the operating practices, tooling, and roles used by engineering teams adopting AI agents.

Codex Security is an OpenAI CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in authorized code repositories. It scans directories and codebases, including repository changes, uses AI-assisted analysis to trace attack paths and apply custom threat models, validates findings, and can generate reviewable patches and exports in SARIF, JSON, and CSV formats. The CLI supports CI use with an API key and can stop builds at a selected severity threshold. The package also supports configurable deep scans, worker and subagent counts, time limits, containerized bulk scans, and a preview findings service. The service stores findings and embeddings in SQLite, provides paginated listings and a read-only dashboard, identifies potential duplicates through embedding similarity, and allows completed findings to be published and deduplicated through the CLI or SDK. It requires Node.js 22.13.0 or later and Python 3.10 or later, and can use OpenAI or other documented inference providers.

SkillSpector is an open-source security scanner for AI agent skills, developed by NVIDIA. It scans Git repositories, URLs, ZIP archives, directories, and individual skill files before installation, looking for prompt injection, data exfiltration, privilege escalation, supply-chain issues, dangerous code, MCP permission problems, tool poisoning, and other malicious patterns. Its two-stage pipeline combines static analysis—including regex, Python AST, taint tracking, YARA signatures, and OSV.dev dependency lookups—with optional LLM-based semantic evaluation. It produces terminal, JSON, Markdown, or SARIF reports containing findings, severity labels, a 0–100 risk score, and installation recommendations. Baselines can suppress accepted findings, and the CLI can be used in CI or install gates through exit codes and machine-readable output. SkillSpector can also run as an MCP server callable by compatible agents. It does not execute scanned skills or sandbox them; optional LLM analysis sends eligible file contents to the configured provider, while dependency checks query OSV.dev. The project is distributed under the Apache License 2.0 and is part of NVIDIA's Verified Skills pipeline.