Local SAST for Developers and CI

Developer-first static application security testing that scans source locally, emits SARIF for GitHub code scanning, and gives coding agents deterministic fix context.

Run this check locally Inspect sample finding

radar scan . --quick

SAST without another source upload

Run security checks in the developer workspace or GitHub Actions runner. Radar focuses on merge-blocking findings such as injection, unsafe auth, path traversal, secrets, and risky APIs.

Local scan engine
No hosted project setup
Severity thresholds
File-level evidence

Local SAST

Evidence to inspect

Use “Local SAST for Developers and CI” as the scope for this decision: verify the input, finding detail, workflow handoff, and product boundary before you install or buy.

CriterionEvidence to inspectBoundary

Input scopeSelected files, configuration, scan mode, and enabled rules.Only included paths and configured checks are evaluated.

Finding detailFile, line, rule ID, severity, explanation, and repair direction.Illustrative output is not a result from your repository.

Workflow handoffLocal result, report format, agent context, and optional CI signal.Enable exports or CI only when the workflow needs them.

Decision fitUse the same criteria on a real repository before choosing a plan or tool.No universal winner or guaranteed outcome is claimed.

Local SAST

Run this check locally

Built for the review loop

The same scanner supports local CLI review, agent repair prompts, and CI gates, so findings keep the same shape before and after a pull request exists.

radar scan . --quick
radar prompt . --diff --copy
radar scan . --format sarif --fail-on high

Official source

Primary sources

NISTSecure Software Development Framework (SSDF) 1.1
GitHub DocsUploading a SARIF file to GitHub

Validate the workflow on your own code.

Apply this page’s evidence to one real repository. For “Local SAST for Developers and CI”, confirm which finding is produced, whether the proposed next step is reproducible, and where local scanning, reports, agents, or CI should stop or expand.