Static analysis tool for AI security

For scanning a codebase for insecure use of LLM libraries, I’d start with GitHub CodeQL or Semgrep, depending on whether you prioritize deep code-flow analysis or AI-specific security rules.

The key distinction is that traditional static application security testing (SAST) catches general coding vulnerabilities, while AI-aware scanning should also recognize risks such as prompt injection, unsafe handling of model output, excessive agent permissions, and sensitive-data leakage.

My top recommendations

1. GitHub CodeQL

(Best for code-flow analysis)

CodeQL is a strong choice if you want to trace untrusted input through application code into dangerous sinks. Its July 2026 release added a JavaScript/TypeScript query for system-prompt injection, including flows involving major LLM SDKs.github.blog+1

Best fit: GitHub repositories, security-focused CI, and teams that need explainable findings.

CodeQL documentation

2. Semgrep

(Best for customizable AI security rules)

Semgrep is a good fit for scanning common insecure coding patterns and writing organization-specific rules. Its 2026 AI-security offerings include rules for prompt injection, unrestricted tool use, and data exfiltration.github.blog+5

Best fit: fast CI scans, custom policies, and teams using multiple LLM frameworks.

Semgrep

3. Snyk

A broader application-security option if you also need vulnerable dependency detection, code scanning, and security across the software development lifecycle. Its AI-agent security offering extends into AI asset discovery and governance.snyk.io+1

Best fit: teams wanting broader application and supply-chain security alongside AI development.

Snyk

What should your scanner actually detect?

For a codebase that uses OpenAI, Anthropic, LangChain, LlamaIndex, or agent frameworks, I’d validate coverage for these patterns:

No static analyzer reliably detects every semantic AI-security flaw. Some risks depend on runtime behavior, deployment configuration, model behavior, or authorization logic.

How I’d implement this

1. Run CodeQL for interprocedural data-flow analysis and supported AI-specific queries.
2. Add Semgrep rules for your actual SDKs and frameworks, including patterns your standard ruleset misses.
3. Scan dependencies for known vulnerabilities and secrets.
4. Add targeted tests for prompt injection, tool authorization, and unsafe model-output handling.

Bottom line: If you want one tool to evaluate first, choose CodeQL for deep, traceable analysis in supported languages, or Semgrep if customizable AI-security rules are your priority. For an AI-heavy application, I would pilot both against a small set of known vulnerabilities before committing.

One question that would help narrow this down: What languages and LLM frameworks are in your codebase — for example, Python with LangChain, or TypeScript with the OpenAI SDK?

Scanning codebases for insecure LLM usage requires tools that understand data flow (taint analysis ) from user prompts to dangerous sinks (like raw SQL execution, system shells, or unescaped HTML rendering) and map against the OWASP Top 10 for LLM Applications (e.g., Improper Output Handling, Excessive Agency, and Prompt Injection risks).checkmarx.com

The best static analysis tools for this task depend on your workflow, customization needs, and team structure.

1. Semgrep (Best for Speed and Custom AI Rules)

• Why it’s great: Semgrep excels at writing lightweight, highly readable structural rules using a syntax that mirrors the source code itself. The community and official registry maintain fast-growing rule packs specifically targeting LLM integrations (detecting insecure LangChain configurations, missing output sanitization, or dangerous eval /exec patterns driven by LLM outputs).
• Pros: Extremely fast, easy to write custom rules for internal proprietary AI wrappers, and integrates into CI/CD pipelines in minutes.
• Get started: Explore rules and setup via Semgrep.appsecsanta.com+1

2. Checkmarx One (Best for Deep Enterprise & Supply Chain Coverage)

• Why it’s great: Checkmarx has heavily invested in AI-specific application security, expanding its engine to cover specialized LLM scanning, supply chain risks (LLM03), and Model Context Protocol (MCP) interactions. It uses deep cross-file taint analysis to track data from an external prompt/RAG source all the way to a system execution sink.appsecsanta.com+1
• Pros: Comprehensive coverage across a massive variety of languages, compliance mapping, and integrated software composition analysis (SCA) for AI/ML packages.appsecsanta.com
• Learn more: Check out the enterprise suite on Checkmarx.

3. Snyk Code (Best for Developer Workflow & IDE Feedback)

• Why it’s great: Powered by DeepCode AI, Snyk Code combines symbolic and machine learning-based analysis to surface real-time feedback directly in developer IDEs. It is exceptionally good at spotting when developers misuse standard AI libraries or pass unvalidated LLM responses directly into application logic.cycode.com+1
• Pros: Low friction for developers, contextual auto-fix suggestions, and strong tracking of open-source AI libraries with known vulnerabilities.appsecsanta.com
• Explore features: Visit Snyk Code.

4. CodeQL (Best for GitHub-Native & Deep Semantic Analysis)

• Why it’s great: GitHub's semantic analysis engine treats your code as a searchable database. If you want to write or use complex, logic-heavy queries that trace multi-step data flow vulnerabilities (e.g., an indirect prompt injection cascading into excessive tool agency), CodeQL offers unmatched depth.
• Pros: Free for public repositories and deeply integrated into GitHub Actions security alerts and Copilot autofix workflows.
• Documentation: Read how to configure it on GitHub Advanced Security.appsecsanta.com+2

To help narrow down the best fit, tell me:

• What languages and frameworks (e.g., Python/LangChain, TypeScript/LlamaIndex) does your stack use?
• Are you looking for a free/open-source tool or an enterprise platform?

When targeting static code analysis specifically for AI security and detecting insecure patterns in LLM library code or application integrations, industry practitioners and security engineers point to Semgrep with specialized rulesets, alongside emerging AI-native SAST configurations.semgrep.dev

An evaluation of the leading solution tailored for this use case highlights its mechanics, coverage, and practical execution:

Recommended Solution: Semgrep (with AI Best Practices Ruleset)

• What it is: A fast, open-source, customizable static analysis (SAST) engine that writes code security rules as intuitive source-code patterns.
• AI Security Focus: Semgrep features dedicated community and pro rulesets—such as p/ai-best-practices —specifically crafted to catch insecure anti-patterns across major LLM integrations (OpenAI, Anthropic, Gemini, Mistral, and Cohere).semgrep.dev
• Key Vulnerabilities Detected:
  • Hardcoded API keys and exposed secrets.
  • Missing system prompts or unsafe safety settings/guardrails configuration.
  • Insecure data handling where untrusted user input flows directly into prompt construction (Prompt Injection vectors at the code level).
  • Improper error handling or insecure deserialization routines when parsing LLM outputs.semgrep.dev
• How to Run It Locally / in CI:
  You can execute the AI security rules directly on your codebase using the Semgrep CLI:

semgrep -c p/ai-best-practices /path/to/llm-codebase

Alternative / Complementary Approaches

• Garak (Generative AI Red-teaming & Assessment Kit): While not a traditional static source-code analyzer (it is a dynamic vulnerability scanner and probe kit backed by NVIDIA), Garak probes live LLM endpoints and application layers for injection, data leakage, and jailbreaks. Many teams pair Semgrep (for library/code analysis) with Garak (for runtime/behavioral probing).github.com+1
• LLM-SAST-Scanners / AI Agent Skills: Newer developer workflows utilize agentic security skills (such as llm-sast-scanner ) that instruct AI coding assistants to perform source-to-sink taint analysis across dozens of vulnerability classes tailored for Python/TypeScript LLM wrappers.github.com

If you'd like to narrow this down, please let me know:

• What programming language is your LLM library code written in (e.g., Python, TypeScript)?
• Are you looking to run scans locally in your IDE , or integrated into a CI/CD pipeline?

For your use case, I’d prioritize a security-focused static analyzer that understands LLM-specific data flows—for example, how untrusted user input, retrieved documents, or model-generated text can reach a tool call, shell command, SQL query, or sensitive-data sink.

That is more specialized than a general-purpose SAST scanner, and it is different from red-team tools that test a running model by sending adversarial prompts.

My top recommendations

1. SecureAI-Scan

(Best starting point)

An open-source, MIT-licensed static analyzer from the OWASP GenAI Security Project. It targets Python, JavaScript, and TypeScript code that uses LLMs or exposes MCP tools.

• Detects unsafe model-output handling, prompt-injection risks, sensitive data exposure, and dangerous tool arguments.
• Covers RAG/vector-store weaknesses and agent-skill poisoning.
• Runs offline and provides source-to-sink traces with evidence-confidence tiers.genai.owasp.org+1

Best for: Scanning AI application and agent-framework repositories for insecure implementation patterns.

Project:OWASP SecureAI-Scan

2. Semgrep

Best for customizable rules and CI integration

Semgrep offers general-purpose static analysis with dedicated AI-security rules. Its published AI Security rule pack covers prompt injection, unrestricted tool use, and data exfiltration.semgrep.dev+2

• Custom AST-pattern and taint-analysis rules.
• Useful for tracing untrusted data into dangerous functions.
• A strong choice for maintaining organization-specific rules for LangChain, LlamaIndex, MCP, or internal LLM libraries.

Best for: Teams that want to define and enforce their own insecure-code patterns in pull requests.

Project:Semgrep

3. LLMSafe

Best for Python agent code and dangerous data flows

A focused scanner for Python AI applications that traces user-controlled and model-controlled data into shell execution, SQL, outbound requests, and dynamic tool dispatch. It also checks privileged prompt construction and risky MCP configurations.git.mitgai.net+1

• Local analysis without model API calls.
• Designed around agent-specific security risks.
• Supports CI integration.

Best for: Python-centric LLM and agent repositories where data-flow analysis matters more than broad language coverage.

Project:LLMSafe on PyPI

4. LLMArmor

Best for framework-specific Python checks

A Python-focused static scanner that advertises checks against the OWASP LLM Top 10 and recognizes integrations such as OpenAI, Anthropic, LangChain, CrewAI, and MCP. It supports CI exit codes and SARIF output.llmarmor.dev

Best for: Quickly auditing an existing Python LLM application for common security misconfigurations.

Project:LLMArmor

Which one should you choose?

An important distinction: scanning a library versus scanning an application

If by “LLM library code” you mean the implementation of the library itself—for example, auditing LangChain's source code for vulnerabilities rather than scanning an application built with LangChain—validate each tool against that requirement before adopting it. Most LLM security scanners focus on how an application uses a library, not on proving that the library's own implementation is secure.

For a library audit, I would combine general SAST with custom rules targeting unsafe deserialization, arbitrary code execution, shell invocation, unsafe tool dispatch, and untrusted-input propagation. Semgrep is particularly useful for writing those rules.git.mitgai.net+2

One question that would help me narrow this down: Are you primarily trying to scan (a) third-party LLM libraries such as LangChain or LlamaIndex, (b) your own applications that use LLM libraries, or (c) both?