SAST tools compared: rule engines, platforms and AI reviewers
SAST tools read source code for security bugs before it runs. For most teams the best start is a rules engine: Semgrep is free for up to 10 contributors, and GitHub's CodeQL is free on public repositories and $30 per committer a month on private ones. Snyk, Aikido and Checkmarx bundle SAST with dependency and secret scanning. AI scanners such as Corgea and ZeroPath, and AI pull-request reviewers such as IonWarp, read logic flaws that pattern rules miss.
The short list
- Best free start for most teams: Semgrep, free up to 10 contributors.
- Best if your code lives on GitHub: GitHub Code Security (CodeQL).
- Best if you also want code quality: SonarQube, priced by lines of code.
- Best platform for code plus dependencies: Snyk.
- Best if you're on GitLab: GitLab SAST.
- Best for an enterprise program with audit reports: Checkmarx One, or Veracode.
- Best all-in-one at a flat team price: Aikido.
- Best AI-native scanner priced per developer: Corgea.
- Best AI-native scanner with unlimited scans: ZeroPath.
- Best as a cheap AI security pass on GitHub pull requests, next to a scanner: IonWarp.
Ten SAST tools side by side
| Tool | How it finds bugs | Also in the product | Git hosts | Free tier | 5 developers | 25 developers |
|---|---|---|---|---|---|---|
| Semgrep | Rules, with cross-file analysis; AI triage | Supply Chain (SCA), Secrets | GitHub, GitLab, Bitbucket, Azure DevOps | Yes 10 contributors, 10 private repos | $0 | $750 (Code) $1,125 with Secrets |
| GitHub Code Security | CodeQL queries; AI scan for PRs on AI credits | Dependabot, dependency review; Secret Protection is $19 more | GitHub only | Public repos | $150 + GitHub Team ($20) | $750 + GitHub Team ($100) |
| SonarQube Cloud | Rules for bugs, vulnerabilities and hotspots, with code quality | Secrets; SCA only with Enterprise Advanced Security | GitHub, GitLab, Bitbucket Cloud, Azure DevOps | Yes up to 50,000 lines | $34 for up to 100,000 lines | By lines, not people |
| Snyk Code | Snyk's own static analysis engine | Open Source (SCA), IaC, Container | GitHub, GitLab, Bitbucket, Azure Repos | 100 Code tests a month | $125 (Team) | Enterprise credits; Code alone about $760 |
| GitLab SAST | Open-source analyzers; cross-file Advanced SAST in Ultimate | Secret detection on every tier; dependency scanning and DAST in Ultimate | GitLab only | Basic scans, JSON report | $0 (Free, 5 users) | Ultimate: quote |
| Checkmarx One | Rules engine; Fusion adds AI analysis on credits | SCA, API security, ASPM; DAST and more by package | GitHub, GitLab, Azure, Bitbucket | No | Quote | Quote |
| Aikido | Rules plus AI SAST | SCA, secrets, cloud, containers, DAST | GitHub, GitLab, Bitbucket, Azure DevOps | Yes 2 users, 10 repos | $350 (Basic, 10 users) | $1,750 (Pro) |
| Corgea | AI-native, with logic and auth scanning | SCA, secrets, IaC, containers | GitHub, GitLab, Azure DevOps, Bitbucket, Harness | Yes 2 people, 10 repos, 10 PR scans a month | $195 (Growth) | $975 (Growth) |
| ZeroPath | AI-native | SCA, secrets, IaC | GitHub, GitLab, Bitbucket, Azure DevOps | No | $1,300 | $2,500 |
| IonWarp | AI reviewer reading each pull request's diff | AI code review; no SCA | GitHub only | Yes 3 seats, about 25 reviews a month | $49 (Pro) | $584 (Max + 15 seats) |
What each tool is good at
Semgrep
Best free start for most teams
Semgrep's rules look like the code they match, so developers can read and write them. Free covers up to 10 contributors and 10 private repositories, with cross-file analysis, Pro rules and 60 AI credits for triage. Teams is $30 per contributor a month for Code (SAST), $30 for Supply Chain (SCA) and $15 for Secrets. Its weak spot: rules find what someone wrote a rule for, and missing authorization checks rarely have a pattern.
GitHub Code Security (CodeQL)
Best if your code lives on GitHub
CodeQL runs queries over your code that trace user input to dangerous calls across files. It is free on public repositories; for private ones, Code Security is $30 per active committer a month on top of GitHub Team ($4 a user) or Enterprise ($21). Copilot Autofix suggests fixes, and an AI scan on AI credits covers languages CodeQL doesn't. Secret Protection, with push protection, is $19 per committer more. GitHub only.
SonarQube
Best if you also want code quality
SonarQube reports bugs, vulnerabilities and security hotspots in 35 or more languages, next to code-quality issues. SonarQube Cloud's Team plan starts at $34 a month for up to 100,000 lines of code, and private projects up to 50,000 lines are free. Price follows lines, not headcount, which suits a large team with a small codebase. Dependency scanning (SCA) needs the Advanced Security add-on on Enterprise.
Snyk
Best developer platform for code plus dependencies
Snyk Code (SAST) comes with Snyk Open Source (SCA), container and infrastructure-as-code scanning, in the IDE, CLI and pull requests. Free allows 100 Snyk Code tests a month. Team is $25 per contributing developer a month, 5 developers minimum and 10 maximum. From 11 developers it's Enterprise credits: Snyk Code costs 1 credit ($1) per active contributor per day.
GitLab SAST
Best if you're on GitLab
GitLab runs SAST on every tier, Free included, with open-source analyzers and a downloadable JSON report. Findings in the merge request, the vulnerability report, cross-file Advanced SAST and ruleset customization are Ultimate only, priced by quote. Premium, $29 a user a month, adds nothing to SAST.
Checkmarx One
Best for an enterprise program with audit reports
Checkmarx sells Essentials, Professional and Enterprise packages by quote. Essentials includes SAST, SCA, API security and posture management; Fusion, on Checkmarx credits, adds AI analysis to SAST. It scans from GitHub, GitLab, Azure and Bitbucket without a build. Veracode is the usual second quote, also without a public price.
Aikido
Best all-in-one for a small team at a flat price
Aikido puts SAST and AI SAST, dependency scanning, secrets, cloud, container and DAST checks in one product. The free plan covers 2 users and 10 repos. Basic is $350 a month for 10 users and adds pull-request security review; Pro is $700 for 10 users and $1,750 for 25.
Corgea
Best AI-native scanner priced per developer
Corgea is an AI-native scanner that looks for business-logic flaws such as missing auth checks, plus the usual vulnerability classes. Free covers 2 people and 10 repositories, with 10 pull-request scans a month. Growth, $39 a developer a month ($31 yearly, 5 seats minimum), makes pull-request scans unlimited; Scale, $49 ($39 yearly, 20 seats minimum), adds custom and blocking rules.
ZeroPath
Best AI-native scanner with unlimited scans
ZeroPath's Team plan starts at $1,000 a month plus $60 a developer, with unlimited repositories and scans, plus SCA, secrets and IaC. The flat base makes it expensive for five people and fairer for fifty.
IonWarp
Best as a cheap AI security pass on GitHub pull requests, next to a scanner
IonWarp is an AI pull-request reviewer, not a SAST scanner in the usual sense. Its Security Review joins the pull requests that touch auth, input, data access or secrets, reads their changes for auth gaps, injection, over-broad data access and secrets added in the diff, and posts in the same GitHub comment as its code review, with a fix prompt for a coding agent. Starter is free for 3 seats (about 70 reviews, then about 25 a month); Pro is $49 a month for 5 seats; Max is $149 for 10, with extra seats at $29.
What it doesn't do: it has no rules engine, so results can differ between runs and can't be audited rule by rule; no dependency (CVE) scanning, so keep Dependabot; it checks secrets only in each pull request's diff, not git history; it works with GitHub only; no IDE plugin, self-hosting or OWASP and PCI reports.
What pattern rules caught on 13 real pull requests
IonWarp publishes a small security benchmark: 13 public pull requests from cal.com, Discourse, Grafana, Keycloak and Sentry, with 18 known security issues from Martian's open code-review benchmark. On November 13, 2026 Winding AI, which publishes this site and makes IonWarp, ran Semgrep Community Edition 1.185.0 with its free default rules (p/default) over the files each pull request changed and matched its findings to the 18 issues by hand.
| Reviewer | Known issues found | Findings outside the key | Cost per pull request |
|---|---|---|---|
| Semgrep CE, free default rules | 2 of 18 (one under a different name) | 4 on changed lines, 11 more on untouched lines | $0 |
| Qodo v2 | 11 of 18 | 1 | about $1.67 (list-price estimate) |
| IonWarp Security, default model | 10 of 18 | 4 | $0.06 in model cost |
| CodeRabbit | 10 of 18 | 9 | about $1.50 (list-price estimate) |
| Greptile v4.1 | 7 of 18 | 1 | about $1.50–2.00 (list-price estimate) |
| Cursor Bugbot | 6 of 18 | 0 | about $1.00–1.50 (list-price estimate) |
Semgrep's two hits were a request header written into a <script> tag in Discourse's embed layout (cross-site scripting) and a feed poller opening a URL from a setting, which it called command injection where the key says server-side request forgery. It missed SQL built by string interpolation in a migration and every logic flaw: case-sensitive email checks, a VIEW permission passing a MANAGE check, race conditions and stale permission caches.
Read this as a sketch, not a ranking: IonWarp chose the security labels, a judge model matched the AI rows, each tool ran once, and the set leans toward logic flaws, where AI does best. Semgrep's Pro rules and CodeQL were not run. Pattern rules are fast, free and repeatable, and blind to business logic. Run both.
Rules or AI: what changes when you choose
A rules engine is the better choice when
- You need the same result on every run, to block merges or pass an audit.
- You want your own rules for your framework's dangerous calls.
- You report against OWASP Top 10 or PCI DSS.
An AI scanner or reviewer helps when
- Your risks are missing auth checks, tenant isolation and business logic.
- Coding agents write many of your pull requests.
- Rule noise is the problem: AI triage (Semgrep, Aikido, GitLab Duo) cuts it.
How to choose a SAST tool
- Start from your Git host. CodeQL and IonWarp are GitHub only and GitLab SAST is GitLab only; the other seven connect to Bitbucket and Azure DevOps too.
- Price your real team. Semgrep, Snyk and GitHub count anyone who committed to a scanned private repo in the last 90 days; SonarQube counts lines of code; IonWarp and Aikido sell a workspace with seats included.
- Decide what else must be in the bill. SAST alone misses vulnerable packages. If you need SCA as well, compare the bundle price, not the SAST line.
- Test on your own code for a week and count the findings you would actually fix.
- Check where your code goes. AI features usually send code to a model provider; read each tool's data terms.
- Plan the other tests. SAST doesn't test a running app; DAST does, and leaked keys need a secret scanner that reads git history.
Questions
What is the best SAST tool?
There isn't one for every team. Semgrep is the best free start: its Free plan covers up to 10 contributors and 10 private repositories, with custom rules. If your code is on GitHub, CodeQL is free on public repositories and $30 per active committer a month on private ones. Buyers who need audit reports and a sales contract usually shortlist Checkmarx and Veracode.
What are the top 5 SAST tools?
The five that appear on most shortlists are Semgrep, GitHub CodeQL, SonarQube, Snyk Code and Checkmarx One. Veracode and OpenText Fortify are the other long-standing enterprise names, and Aikido, Corgea and ZeroPath are newer tools that add AI.
Is SonarQube a SAST or DAST tool?
SAST. SonarQube reads source code without running it and reports bugs, vulnerabilities and security hotspots alongside code-quality issues. It does not attack a running application, which is what DAST tools such as OWASP ZAP or Burp Suite do.
What is SAST vs DAST vs SCA?
SAST reads your own source code for flaws such as injection. DAST tests the running application from the outside, the way an attacker would. SCA checks the open-source packages you depend on against databases of known vulnerabilities (CVEs). Most teams need SAST and SCA early and add DAST once there is a staging environment to test.
Is Wiz SAST or DAST?
Wiz is mainly a cloud security platform. Its Wiz Code product includes SAST and AI SAST, along with SCA, infrastructure-as-code and secret scanning, and it can pull in findings from other scanners, DAST included.
Can an AI code reviewer replace a SAST tool?
Not on its own. In a 13-pull-request test, the five AI reviewers in IonWarp's table found 6 to 11 of 18 known security issues, more than Semgrep's free rules, which flagged the lines of 2. But AI results change from run to run, and tools such as IonWarp have no dependency scanning and no rules you can audit. Use one next to a rules-based scanner, not instead of it.
Guides
- SAST vs DAST: what each finds, and which a small team buys first.
- SAST vs SCA: your code or your dependencies.
- Snyk pricing: Free, Team and Enterprise credits for 5, 10 and 25 developers.
- Snyk alternatives: matched to the reason you're leaving.
- GitHub Advanced Security pricing: per committer, and when CodeQL is free.
- SonarQube vs Snyk: quality-first or security-first.
- Checkmarx alternatives: leaving an enterprise Checkmarx or Veracode contract.
- Open-source SAST tools: the free scanners still maintained, by language.
- AI SAST: what model-based scanners catch, and where they go wrong.
- Secret scanning tools: does SAST find keys, and which scanner to use.
How this page was checked
On November 13, 2026 Winding AI read each vendor's pricing page and Git host documentation, priced 5 and 25 developers at list, and ran the Semgrep test above. No tool gets a score or star rating. Corrections: support@winding.ai.
About this site
sasttools.com is published by Winding AI, Inc., the company that makes IonWarp, one of the ten tools here. IonWarp is an AI pull-request reviewer rather than a classic SAST scanner, so we list it as a partial option and say where rules-based tools are better. We earn nothing from links to other tools; links to IonWarp carry a tag so IonWarp can count visits. Visits are counted with Google Analytics; no ads, and no analytics cookies in the EU, UK or Switzerland.