> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Agentic SAST

> Full repository security analysis with AI agents that understand your application context

<Note>
  Agentic SAST analyzes your entire codebase to identify logic flaws, authorization issues, and design failures that traditional security tools miss.
</Note>

## Agentic SAST vs Deterministic SAST

Agentic SAST is a separate agentic capability that runs independently from deterministic SAST. It's like PR Review Agent but for full repository analysis, with **Repository Memory** and **Vuln Context** components:

```mermaid theme={null}
graph TB
    A[Your Code] --> B[Deterministic SAST<br/>Rule Matching]
    A --> C[Agentic SAST]
    
    B --> D[Known Patterns<br/>SQL Injection, XSS]
    C --> E[Repository Memory]
    C --> F[Vuln Context]
    
    B --> G[SAST Results]
    G --> H[False Positive<br/>Elimination]
    
    style B fill:#9449FE,stroke:#6627F9,color:#fff
    style G fill:#9449FE,stroke:#6627F9,color:#fff
    style C fill:#6627F9,stroke:#9449FE,color:#fff
    style E fill:#6627F9,stroke:#9449FE,color:#fff
    style F fill:#6627F9,stroke:#9449FE,color:#fff
    style H fill:#6627F9,stroke:#9449FE,color:#fff
```

**Deterministic SAST**: Finds known vulnerability patterns quickly → **False Positive Elimination** filters results

***

## Agentic SAST Components

Agentic SAST consists of two key components:

### Repository Memory

Maintains a persistent understanding of your codebase structure, patterns, and relationships across scans. This enables the agent to:

* Remember architectural decisions and patterns
* Track how components interact over time
* Learn from previous analysis cycles
* Provide consistent analysis across scans

### Vuln Context

Analyzes vulnerability context by understanding:

* How vulnerabilities relate to your specific application architecture
* Historical context of similar issues in your codebase
* Business logic implications of security findings
* Cross-file relationships and dependencies

These components work together to provide deep, contextual security analysis that traditional tools cannot match.

***

<Steps>
  <Step title="Build Repository Map">
    Agent creates a complete map of your application structure, components, and relationships.
  </Step>

  <Step title="Construct Analysis Graphs">
    System builds dataflow and control flow graphs showing how data moves through your application and how code executes.
  </Step>

  <Step title="Analyze with Context">
    Agent reviews code file-by-file using the repository map and graphs to understand security issues in your specific application context.
  </Step>

  <Step title="Identify Vulnerabilities">
    Agent detects logic flaws, authorization issues, and design failures by understanding business logic and architectural patterns.
  </Step>
</Steps>

***

## CodeThreat-Hive Framework

CodeThreat-Hive is the AI framework that powers agentic analysis.

**Repository Mapping**: Creates a complete understanding of application structure before analyzing individual files.

**Graph-Based Analysis**: Builds dataflow and control flow graphs as the source of truth for understanding how your application executes.

**Contextual Memory**: Carries context throughout the analysis, enabling agents to understand how components interact and where security issues exist.

**Self-Reflective Agents**: AI agents evaluate their own reasoning to maintain analysis depth while optimizing efficiency.

***

## Language Support

CodeThreat uses tree-sitter to parse code and create grammars for target languages. This enables accurate syntax analysis across different programming languages.

<Note>
  Full list of supported languages will be available soon.
</Note>

***

## Next Steps

<CardGroup cols={2}>
  <Card title="AI Overview" icon="brain" href="/ai/overview">
    Learn about AI-powered analysis
  </Card>

  <Card title="False Positive Elimination" icon="filter" href="/ai/false-positive-elimination">
    Understand autonomous investigation
  </Card>

  <Card title="Running Scans" icon="play" href="/scanning/running-scans">
    Schedule and execute agentic SAST scans
  </Card>
</CardGroup>