Category · 3 of 27 tools
Scanners built around vulnerability classes, dependencies, and secrets rather than general review.
Every tool here is mapped against the same 9 standards with a source and a date. Semgrep currently leads the category at 4.5/9; the weakest spot across the whole category is context, documented by only 0 of 3.
| # | Tool | Coverage | Self-hosting | Licence | Free tier | From |
|---|---|---|---|---|---|---|
| 1 | Semgrep Security | 4.5/9 Coverage score 4.5 out of 9 | Self-hostable | Open source | Limited free tier | $30/contributor/mo |
| 2 | Snyk Code Security | 3/9 Coverage score 3 out of 9 | Enterprise only | Proprietary | Limited free tier | $25/contributor/mo |
| 3 | Aikido Security Security | 2.5/9 Coverage score 2.5 out of 9 | Enterprise only | Proprietary | Limited free tier | $300/mo |
Security · LGPL-2.1
Open-source static analysis engine with a commercial AppSec Platform adding cross-file analysis and an AI assistant for triage.
Security · Proprietary
Developer-focused SAST built on Snyk's DeepCode AI engine, with PR checks and AI fix suggestions across major git platforms.
Security · Proprietary
All-in-one AppSec platform (SAST, SCA, secrets, cloud) with AI autotriage and autofix PRs, built on tuned open-source scanners.
On documented coverage of the 9 standards, Semgrep leads this category at 4.5/9 as of 2026-08-11. That is a measure of what each vendor documents, not of review quality on your codebase — re-rank the list on the pillars your team actually needs.
1 of 3: Semgrep. The rest are cloud-only or gate self-hosting behind an enterprise contract.
1: Semgrep (LGPL-2.1).
Across this category, context is the least documented standard — only 0 of 3 tools back it up publicly. It is the first thing worth asking a vendor about in a demo.
Looking wider than security?
The full directory holds 27 tools across every category, filterable in one place.