State of Open-Source SAST 2026: 755 tools, but only 42 open-source security scanners

TL;DR — We parsed every entry in the public analysis-tools.dev catalog (755 static-analysis tools, MIT-licensed data). Static analysis is overwhelmingly open source — 86.5% of catalogued tools aren't proprietary. But security analysis is a thin, lopsided slice: only 69 tools (9.1%) are security-focused (SAST), and just 42 of those are open source. Coverage clusters on a handful of mainstream languages (Python 13, Go 12, Java 10 open-source SAST tools) while 21 languages that each have 5+ general static-analysis tools have zero open-source security scanner — SQL, Shell, Groovy, R, Lua, Dart, PowerShell, Elixir, Clojure, Haskell and more. Every number below is reproducible from one public dataset.

What we counted

We took the community-maintained catalog behind analysis-tools.dev — the analysis-tools-dev/static-analysis repository — because it's the most complete public index of static-analysis tools and its data is openly (MIT) licensed. For every data/tools/*.yml entry we recorded:

• License — classified as proprietary (marked proprietary/commercial), recognized open-source (MIT, Apache, BSD, GPL/LGPL, MPL, …), or other/unspecified.
• Security scope — whether the tool carries the catalog's own security tag. That tag is our definition of "SAST" here: a tool whose purpose includes finding security issues, not just style or bugs.
• Language coverage — every language tag on the tool, using the catalog's own language taxonomy (data/tags.yml, 69 tracked languages).

No tool is named, ranked, or scored below. This is a census of the landscape, not a comparison of products.

Static analysis is open source. Security analysis, less so.

Of 755 catalogued tools:

	count	share
Not proprietary (open source)	653	86.5%
— with a recognized OSS license	516	68.3%
— "other"/unspecified license	137	18.2%
Proprietary / commercial	102	13.5%

So the general static-analysis ecosystem — linters, formatters, style and bug checkers — is open by default. But filter to tools that actually look for security problems and the picture narrows hard: only 69 (9.1%) carry the security tag, and 42 of those 69 (61%) are open source. Put plainly: the entire catalogued world of open-source SAST is about 42 tools.

The coverage map is lopsided

Those 42 open-source SAST tools don't spread evenly. Counting how many cover each language:

Language	Open-source SAST tools
Python	13
Go	12
Java	10
JavaScript	9
Ruby	8
TypeScript	8
C	8
PHP	7
C#	6
C++	6
Kotlin	5

If you write Python, Go or Java, you have real open-source options. Step outside that core and the floor drops fast.

21 languages with zero open-source SAST

Here's the finding that surprised us. Take languages that clearly have a live static-analysis community — 5 or more general analysis tools catalogued — and ask how many have an open-source security scanner:

Language	Open-source SAST	Total static-analysis tools
Rust	2	56
SQL	0	23
Objective-C	1	20
Shell	0	18
Groovy	0	17
R	0	15
Perl	1	15
Lua	0	12
Dart	0	10
PowerShell	0	6
Elixir	0	6
Haskell	0	6

In total, 21 of the 69 tracked languages have at least five general static-analysis tools but not a single open-source security scanner: SQL, Shell, Groovy, R, Lua, Dart, PowerShell, Elixir, Clojure, Haskell, Erlang, Fortran, Delphi, VBScript, Verilog/SystemVerilog, Visual Basic, JavaServer Pages, ASP, ASP.NET, CoffeeScript and Visualforce. Even Rust — 56 static-analysis tools — has only two that are open-source and security-focused.

These are not obscure ecosystems. SQL and Shell are everywhere in production; R and Elixir and Dart have large, active communities. The linters exist; the open-source security scanners largely don't.

It's a command-line world

One more shape worth noting: of 755 tools, 680 ship a CLI, 76 offer a hosted service, and 34 are IDE plugins. Static analysis — security included — is overwhelmingly something you run yourself at the command line or in CI, not a SaaS you send your code to.

Why this matters

The takeaway isn't "open-source SAST is bad" — it's that open-source SAST is real but narrow. The mainstream languages are well served; the long tail is a coverage desert. For a team whose stack includes SQL, Shell scripts, Terraform-adjacent config, or a less-common backend language, "just use an open-source scanner" may not have an answer yet. That gap — breadth of language and layer coverage in one open tool — is exactly the problem we work on at Zennoxa, and it's why we publish this as ecosystem context rather than a product claim.

Limitations

• Counts follow the catalog's own metadata. A tool without the security tag isn't counted as SAST even if it ships some security rules; a language tag missing on a tool undercounts it. We inherit the catalog's judgment calls.
• "Open source" here means not marked proprietary/commercial; that bucket includes 137 tools whose license the catalog lists as "Other"/unspecified. 516 carry a recognized OSS license.
• The catalog is community-maintained and not exhaustive. "Zero open-source SAST for language X" means none is catalogued — not proof none exists anywhere.
• Point-in-time snapshot of the dataset on 2026-07-22.

Reproduce it

git clone --depth 1 https://github.com/analysis-tools-dev/static-analysis
cd static-analysis
# For each data/tools/*.yml: read `license`, the `tags` list, and `types`.
# - proprietary  = license contains "proprietary"/"commercial"
# - SAST         = tags contains "security"
# - languages    = tags that appear as type:language in data/tags.yml
# Aggregate: count tools, license split, the security subset, and per-language coverage.

The full parser, the raw per-language counts, and the exact license buckets are in this study's data.json.

---

Data source: the analysis-tools.dev catalog (analysis-tools-dev/static-analysis), © the analysis tools developers, MIT-licensed. This study computes aggregate statistics over that dataset; it does not reproduce, rank, or score individual catalog entries. Part of Zennoxa Research — reproducible security data studies.