Best SAST Tools in 2026
Updated
In short: Snyk Open Source is ranked #1 of 26 as of 5 October 2026, ahead of Semgrep Code and Veracode DAST. The best-ranked option with a free plan is Semgrep Code. The lowest first paid tier on this page is Kiuwan Code Security at $4.08/mo.
Finding code security issues calls for attention to what a tool analyzes and where it fits into development. Compare analysis targets and supported languages, then consider IDE support, CI/CD integration and pull request scans. Automated fixes and custom security rules offer further points of comparison, while free-plan availability and paid-from pricing help frame cost. Snyk Open Source, Semgrep Code and Veracode DAST are among the options shown, alongside PVS-Studio and Kiuwan Code Security. Weigh the listed criteria against the codebases and development workflows your team needs to cover; different targets and integration needs can shape which capabilities matter most.
26 SAST tools ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
SAST Tools, ranked on how quickly a newcomer can get going. 8 of the 25 on this page can be tried for free.
- 1 Snyk Open SourcePaid from $25/mo
- Free to practise on: yes
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 2 Semgrep CodePaid from $30/mo
- Free to practise on: yes
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 3 Veracode DAST
- Free to practise on: not on record
- Free trial: yes
- Well documented: yes
- Runs where you work: yes
- 4 PVS-Studio
- Free to practise on: not on record
- Free trial: yes
- Well documented: yes
- Runs where you work: yes
- 5 Fluid Attacks
- Free to practise on: not on record
- Free trial: yes
- Well documented: yes
- Runs where you work: yes
- 6 Kiuwan Code SecurityPaid from $4.08/mo
- Free to practise on: not on record
- Free trial: yes
- Well documented: yes
- Runs where you work: yes
- 7 FlawfinderFree plan
- Free to practise on: yes
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 8 BanditFree plan
- Free to practise on: yes
- Free trial: not on record
- Well documented: yes
- Runs where you work: not on record
- 9 Black Duck Coverity
- Free to practise on: not on record
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 10 ZeroPathPaid from $1,000/mo
- Free to practise on: not on record
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 11 OpenText Fortify SAST
- Free to practise on: not on record
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 12 CodeSonar
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: yes
- 13 Klocwork
- Free to practise on: not on record
- Free trial: not on record
- Well documented: yes
- Runs where you work: yes
- 14 MobSF
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: yes
- 15 Checkmarx API Security
- Free to practise on: not on record
- Free trial: not on record
- Well documented: yes
- Runs where you work: not on record
- 16 DerScanner
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: yes
- 17 NaiveSystems Analyze
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: yes
- 18 Bearer
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
- 19 gosec
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
- 20 Joern
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: yes
- 21 NodeJsScan
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
- 22 Security Code Scan
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
- 23 Checkmarx One
- Free to practise on: not on record
- Free trial: not on record
- Well documented: yes
- Runs where you work: not on record
- 24 Brakeman
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
- 25 HCL AppScan Source
- Free to practise on: not on record
- Free trial: not on record
- Well documented: not on record
- Runs where you work: not on record
Compare all 25 in a table
| # | Platform | Score | Free plan | From | Free plan | Paid from | Analysis targets | Languages supported |
|---|---|---|---|---|---|---|---|---|
| 1 | Snyk Open Source | 7.5 | Free plan | $25/mo | Yes | — | source code | 16 |
| 2 | Semgrep Code | 7.4 | Free plan | $30/mo | Yes | — | source code | 35 |
| 3 | Veracode DAST | 7.3 | No | — | — | — | source code, bytecode, binaries | — |
| 4 | PVS-Studio | 7.2 | No | — | No | — | source code | — |
| 5 | Fluid Attacks | 7.0 | No | — | No | — | source code | 14 |
| 6 | Kiuwan Code Security | 7.0 | No | $4.08/mo | No | 49 /user/mo | source code | — |
| 7 | Flawfinder | 6.9 | Free plan | Free | Yes | — | source code | — |
| 8 | Bandit | 6.8 | Free plan | Free | Yes | — | source code | — |
| 9 | Black Duck Coverity | 6.6 | No | — | No | — | source code | — |
| 10 | ZeroPath | 6.4 | No | $1,000/mo | No | 60 /user/mo | source code | — |
| 11 | OpenText Fortify SAST | 6.2 | No | — | — | — | source code, bytecode, binaries | — |
| 12 | CodeSonar | 6.1 | No | — | — | — | source code, binaries | — |
| 13 | Klocwork | 6.1 | No | — | — | — | source code | — |
| 14 | MobSF | 6.1 | No | — | Yes | — | source code, binaries | — |
| 15 | Checkmarx API Security | 6.0 | No | — | No | — | source code | — |
| 16 | DerScanner | 6.0 | No | — | — | — | source code, bytecode, binaries | — |
| 17 | NaiveSystems Analyze | 6.0 | No | — | Yes | — | source code | — |
| 18 | Bearer | 5.9 | No | — | Yes | — | source code | — |
| 19 | gosec | 5.9 | No | — | Yes | — | source code | — |
| 20 | Joern | 5.9 | No | — | Yes | — | source code, bytecode, binaries | — |
| 21 | NodeJsScan | 5.9 | No | — | — | — | source code | — |
| 22 | Security Code Scan | 5.9 | No | — | — | — | source code | — |
| 23 | Checkmarx One | 5.7 | No | — | No | — | source code | — |
| 24 | Brakeman | 5.6 | No | — | — | — | source code | — |
| 25 | HCL AppScan Source | 5.6 | No | — | No | — | source code | — |
Is your platform on this list?
Numbered spots on this list can be sponsored, and a sponsored row is labelled as paid.
Questions about this list
Which SAST tool is ranked first on The Geeks Club?
Snyk Open Source is ranked #1 of 26 with a score of 7.5. Semgrep Code is second and Veracode DAST third.
How many of these have a free plan?
4 of the 25 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, Kiuwan Code Security has the lowest first paid tier we found: $4.08/mo.
How is this list ranked?
Ranked on how quickly a newcomer can get going: documentation depth, a free tier or trial, and the platforms it runs on.