Skip to content

Add kusari inspector to SAST tools #1113

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kingthorin merged 1 commit into from
Jul 29, 2025
Merged

Add kusari inspector to SAST tools #1113

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions _data/tools.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2168,5 +2168,14 @@
"platforms": "Windows, Linux, MacOS",
"note": "Open-source CLI security scanner for agentic AI workflows. Scans your workflow’s source code, detects vulnerabilities, and generates an interactive visualization along with a detailed security report. Supports popular agentic frameworks like LangGraph, CrewAI, n8n, OpenAI Agents, and more.",
"type": "SAST"
},
{
"title": "Kusari Inspector",
"url": "https://kusari.dev",
"owner": "Kusari",
"license": "Commercial or Free",
"platforms": "SaaS",
"note": "Kusari Inspector seamlessly integrates software supply chain security analysis into your pull requests.",
"type": "SAST"
Comment on lines +2178 to +2179
Copy link
Contributor

@kingthorin kingthorin Jul 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds like SCA not SAST

Copy link
Contributor Author

@trmiller trmiller Jul 29, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(Editing as I misread the comment initially)
We work similarly to others on the list, and so this could really be in both categories. There are SCA aspects for sure, but also SAST. The functionality, at least for the inspector here, is similar to Snyk, Aikdido, etc.

So while I did add also add it to the component analysis page, this felt appropriate as well.

If it would be helpful, also happy to help add some color to this on the page in general.

}
]
2 changes: 2 additions & 0 deletions pages/Component_Analysis.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -316,6 +316,7 @@ and legal teams an opportunity to create solutions for healthy open source usage
| [Grafeas] | Grafeas | Open Source | Cross Platform |
| [Greenkeeper] | Greenkeeper | Open Source | SaaS |
| [Ion Channel SA] | Ion Channel | Commercial | SaaS |
| [Kusari] | Kusari | Freemium | SaaS |
| [Libraries.io] | Tidelift | Open Source | SaaS |
| [MergeBase] | MergeBase | Commercial | SaaS |
| [Nexus IQ] | Sonatype | Commercial | Cross Platform |
Expand Down Expand Up @@ -371,6 +372,7 @@ and legal teams an opportunity to create solutions for healthy open source usage
[Greenkeeper]: https://greenkeeper.io/
[OSS Review Toolkit]: https://github.com/heremaps/oss-review-toolkit
[Ion Channel SA]: https://ionchannel.io/
[Kusari]: https://kusari.dev
[Libraries.io]: https://libraries.io/
[MergeBase]: http://mergebase.com/
[Nexus IQ]: https://www.sonatype.com/
Expand Down
1 change: 1 addition & 0 deletions pages/Free_for_Open_Source_Application_Security_Tools.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,7 @@ In addition, we are aware of the following commercial SAST tools that are free f
- [CodeSweep - GitHub Action](https://hclsw.co/codesweepgithub) - Scan the new code on a push/pull request using a GitHub action. Findings are highlighted in the `Files Changed` view and details about the issue and mitigation steps can be found in the `Actions` page. Unrestricted usage allowed with a free trial account.
- [Aikido](https://www.aikido.dev/product) - Combines open source software with custom rules & features into a single dashboard with all your security findings. Includes both SAST and Library Analysis tools. [Free for small teams](https://www.aikido.dev/pricing).
- [Arnica](https://www.arnica.io/solution/code-security) - Scans all source code repositories for code risks (SAST, SCA, IaC, license violations, and low 3rd party reputation) and hardcoded secrets. The platform comes with a [freemium plan](https://www.arnica.io/pricing) for unlimited time and users count. The [pipelineless security approach](https://www.arnica.io/blog/ci-cd-pipeline-security-vs-ide-plugins-vs-pipelineless-security) is the value the company charges for, so the visibility remains always free.
- [Kusari](https://kusari.dev/inspector) - Kusari Inspector seamlessly integrates software supply chain security analysis into your pull requests. This checks for bad dependencies, licenses, quality data. [Free for individual use](https://www.kusari.dev/pricing).

### DAST Tools

Expand Down