DongTai IAST

7.2easy start · #5 of 15
in Interactive Application Security Testing Software

Free to practise onyes
Free trialnot on record
Well documentedyes
Runs where you worknot on record

Runs on api, Linux, self-hosted, Web.

DongTai IAST is an open-source application security testing tool that examines application traffic to identify vulnerabilities in Java applications and third-party components. Its passive IAST approach uses test traffic rather than dedicated attack tests. The analysis engine evaluates HTTP, HTTPS and RPC requests using method-call data and taint tracking. DongTai analyzes runtime data flows, ranks verified issues by risk and helps developers locate and address findings. Listed detection languages are Java, Python, PHP and Go, though the Python, PHP and Go agents are beta and community-maintained beta agents are not guaranteed to deploy successfully. The server provides vulnerability reports and notifications, project and user management, a Web API and custom vulnerability rules. Deployment options include SaaS or localized setups, with Docker Compose for standalone installation and Kubernetes for clusters. An IntelliJ IDEA plugin can run the Java probe. The self-hosted deployment is free, and the repository lists an Apache-2.0 license. The project directs questions to GitHub Discussions.

Who it is for

DongTai suits development and security teams seeking passive vulnerability analysis during development or before release. Its deployment options can fit teams using either SaaS or self-hosted installations.

What is good

Passive analysis uses application test traffic.
Detection languages include Java, Python, PHP and Go.
Server includes reports, notifications and project management.
Free open-source self-hosted deployment is available.

What to know first

Python, PHP and Go agents are beta.
Beta agents are not guaranteed to deploy successfully.
Commercial deployment requires sudo privileges for iastctl.

Verdict

DongTai combines passive traffic analysis with risk prioritization and several deployment choices. Teams considering its non-Java agents should account for their beta status and deployment caveat.

DongTai IAST plans and pricing

All plans

Open-source self-hosted deployment Free Docker Compose single-node or Kubernetes cluster deployment github.com · 4 Oct 2026

Compared on interactive application security testing software

Runtime targets: web
Deployment: hybrid
API testing: Yes
Instrumentation: agent
Language coverage: Java, Python, PHP, Go

Best DongTai IAST alternatives

See all 14

HCL AppScan 0 of 4 in the starter kit Lesson 17.9 Waratek IAST 0 of 4 in the starter kit Lesson 27.8 Aikido CSPM 0 of 4 in the starter kit Lesson 37.4 Veracode DAST 0 of 4 in the starter kit Lesson 47.3 New Relic IAST 0 of 4 in the starter kit Lesson 67.1 Acunetix 0 of 4 in the starter kit Lesson 76.9

The record

Product: DongTai IAST is an open-source interactive application security testing tool that uses passive instrumentation to detect common vulnerabilities in Java applications and third-party components in real time.
Analysis: The project describes its engine as analyzing HTTP, HTTPS, and RPC requests using method-call data and taint tracking.
Detection languages: The documentation lists Java, Python, PHP, and Go as supported detection languages.
Vulnerability workflow: The overview says DongTai analyzes runtime application data flows, prioritizes verified vulnerabilities by risk, and helps developers fix code in real time.
Server capabilities: The server provides a user management interface, vulnerability analysis and reports, vulnerability notifications, Web API, project management, and custom vulnerability rules.
IDE integration: The project describes an IntelliJ IDEA plugin that can run the Java probe and detect vulnerabilities inside the IDE.
Use cases: The project lists DevSecOps vulnerability detection, open-source vulnerability research, and security testing before release as use cases.
IAST method: The documentation identifies DongTai as passive IAST, using application test traffic to analyze vulnerabilities without running dedicated attack tests.
Agent status: The agent guide marks Python, PHP, and Go agents as beta and says community-maintained beta agents are not guaranteed to deploy successfully.
Runtime services: The project says its base image includes MySQL and Redis services.
License: The repository lists an Apache-2.0 license.
Support: The project directs users with questions to its GitHub Discussions forum.
Collection and reporting: Its agent monitors and collects web application traffic data, sends it to DongTai Server for analysis, and the server reports identified vulnerabilities with full reports available in the management server.
Supported languages: The documentation lists Java, Python, PHP, and Go as supported detection languages.
Price from: Free

Where it ranks on The Geeks Club

Best Interactive Application Security Testing Software in 2026#5 of 15

Is DongTai IAST yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote DongTai IAST

Sources

github.com/HXSecurity/DongTai· checked 3 Oct 2026
docs.dongtai.io/docs/introduction/· checked 3 Oct 2026
docs.dongtai.io/docs/introduction/architecture/· checked 3 Oct 2026
docs.dongtai.io/docs/introduction/iast/· checked 3 Oct 2026
docs.dongtai.io/docs/category/agent-%E5%AE%89%E8%A3%85%· checked 3 Oct 2026
docs.dongtai.io/docs/introduction/dongtai/· checked 4 Oct 2026
github.com/HXSecurity/DongTai/blob/develop/README.· checked 4 Oct 2026
dongtai.io· checked 4 Oct 2026
github.com/HXSecurity/DongTai/security· checked 4 Oct 2026
doc.dongtai.io/docs/getting-started/start-shangye/· checked 4 Oct 2026