Skip to main content
Agentic SAST analyzes your entire codebase to identify logic flaws, authorization issues, and design failures that traditional security tools miss.

​
Agentic SAST vs Deterministic SAST

Agentic SAST is a separate agentic capability that runs independently from deterministic SAST. It’s like PR Review Agent but for full repository analysis, with Repository Memory and Vuln Context components: Deterministic SAST: Finds known vulnerability patterns quickly → False Positive Elimination filters results

​
Agentic SAST Components

Agentic SAST consists of two key components:

​
Repository Memory

Maintains a persistent understanding of your codebase structure, patterns, and relationships across scans. This enables the agent to:
  • Remember architectural decisions and patterns
  • Track how components interact over time
  • Learn from previous analysis cycles
  • Provide consistent analysis across scans

​
Vuln Context

Analyzes vulnerability context by understanding:
  • How vulnerabilities relate to your specific application architecture
  • Historical context of similar issues in your codebase
  • Business logic implications of security findings
  • Cross-file relationships and dependencies
These components work together to provide deep, contextual security analysis that traditional tools cannot match.
1

Build Repository Map

Agent creates a complete map of your application structure, components, and relationships.
2

Construct Analysis Graphs

System builds dataflow and control flow graphs showing how data moves through your application and how code executes.
3

Analyze with Context

Agent reviews code file-by-file using the repository map and graphs to understand security issues in your specific application context.
4

Identify Vulnerabilities

Agent detects logic flaws, authorization issues, and design failures by understanding business logic and architectural patterns.

​
CodeThreat-Hive Framework

CodeThreat-Hive is the AI framework that powers agentic analysis. Repository Mapping: Creates a complete understanding of application structure before analyzing individual files. Graph-Based Analysis: Builds dataflow and control flow graphs as the source of truth for understanding how your application executes. Contextual Memory: Carries context throughout the analysis, enabling agents to understand how components interact and where security issues exist. Self-Reflective Agents: AI agents evaluate their own reasoning to maintain analysis depth while optimizing efficiency.

​
Language Support

CodeThreat uses tree-sitter to parse code and create grammars for target languages. This enables accurate syntax analysis across different programming languages.
Full list of supported languages will be available soon.

​
Next Steps

AI Overview

Learn about AI-powered analysis

False Positive Elimination

Understand autonomous investigation

Running Scans

Schedule and execute agentic SAST scans