We need to scan our code for insecure usage of LLM libraries. What's the best static analysis tool that understands AI security risks?

When scanning codebases for AI-specific security risks (such as insecure LLM integrations, prompt injection surfaces, over-privileged tool use, or dangerous deserialization of model outputs), traditional Static Application Security Testing (SAST) tools often fall short because they only look for standard code syntax bugs rather than semantic logic flaws.

To effectively catch AI/LLM security risks, the strategy usually relies on a hybrid approach combining customizable general SAST rulesets with specialized AI agent/skill analyzers.

1. The Best Specialized Tool for AI Agents & Skills:

If your application uses AI agent extensions, plugins, or tool-calling frameworks (like MCP—Model Context Protocol, Cursor/Claude extensions, or custom agent skills), SkillSpector is a cutting-edge open-source option.

• What it does: It performs a fast, two-stage static analysis (AST parsing + pattern matching) combined with optional LLM semantic evaluation.
• Coverage: It scans for over 70 distinct vulnerability patterns across categories like prompt injection, data exfiltration, over-privileged tool use, excessive agency, and system prompt leakage.
• Supply Chain: It queries OSV.dev live to check for known vulnerabilities in your AI/ML package dependencies.

2. The Best Extensible SAST for Code-Level LLM Flaws: Semgrep

For scanning raw application code (Python, TypeScript, etc.) where you are making insecure API calls to OpenAI, Anthropic, or local models, Semgrep is the industry favorite.

• Why it works: Standard SAST tools don't have custom rules for AI, but Semgrep allows you to write or pull custom rules targeting insecure LLM anti-patterns (e.g., passing unvalidated user input directly into langchain prompt templates, executing code generated by an LLM via eval() without sandboxing, or logging API keys/sensitive data to LLM providers).
• Community Rules: You can leverage and contribute to community-driven security registries that map to the OWASP Top 10 for Large Language Models.

3. The Enterprise Approach: Hybrid SAST + Semantic Triage

Many modern security pipelines adopt a Hybrid Framework (sometimes referred to in security engineering as SAST-Genius style pipelines):

To help narrow down the best setup for your stack, tell me:

• What languages and frameworks is your application written in (e.g., Python with LangChain, LlamaIndex, or raw OpenAI SDK)?
• Are you scanning standard microservice/web application code or autonomous AI agents/plugins?

If your goal is specifically static analysis of code that uses LLMs/AI libraries, my top pick is Snyk Code.

• Snyk Code — best fit for LLM-library data-flow analysis. It explicitly models LLM libraries as taint sources and tracks data flowing from libraries such as OpenAI, Hugging Face, Anthropic, and Google into sensitive sinks. That lets it catch patterns such as LLM output reaching XSS/SQL-injection-sensitive code without sanitization.
• Semgrep — best if you want customizable AI-security rules. Its 2026 AI Security rules cover prompt injection, unrestricted tool use, data exfiltration, and insecure AI-framework integrations; its Shadow AI rules also identify LLM usage and risky configurations across providers/frameworks.
• GitHub CodeQL — best if you're already deeply invested in GitHub. It's excellent general-purpose semantic SAST, but I'd choose Snyk/Semgrep ahead of it when AI-specific patterns are the primary requirement.
• Snyk Agent Scan / Semgrep Guardian are worth adding if you're also securing MCP servers, coding agents, agent skills, and tool use rather than just application source code.

My recommendation

For a codebase with things like:

response = openai.chat.completions.create(...)
db.execute(response.choices[0].message.content)

I'd start with Snyk Code because the interesting question isn't merely “is this API/library vulnerable?” but “can untrusted LLM output flow into a dangerous operation?” Snyk specifically supports that source-to-sink analysis for LLM integrations.

If you want broader AI/agent security coverage plus highly tunable rules, I'd choose Semgrep instead. Its current AI-specific rules explicitly cover several OWASP LLM Top 10 categories.

Short version: Snyk Code for LLM data-flow; Semgrep for customizable AI/agent security.

If your goal is specifically static analysis of applications that use LLMs/AI frameworks, my top pick today is semgrep.dev, particularly its AI Security rules/Guardian capabilities.

Why Semgrep

Semgrep has moved beyond generic SAST and now has dedicated AI-security rules covering things such as:

• Prompt injection paths
• Unrestricted tool use
• Data exfiltration
• Unsafe integrations with common AI/LLM frameworks
• Shadow AI — finding LLM usage across an existing codebase
• Vulnerabilities in AI-generated code

Its current AI Security ruleset has 27 rules, while additional rules cover malicious agent skills and AI-generated-code risks.

That's a better fit for your requirement than a conventional SAST scanner because you're looking for LLM-specific insecure usage, not just SQLi/XSS/etc.

What I'd use

Vulnhuntr is particularly interesting as a second pass: it uses an LLM to trace multi-step call chains through a repository rather than relying solely on traditional static patterns. However, the upstream project currently supports only Python and focuses on a narrower set of vulnerability classes (RCE, SSRF, XSS, SQLi, IDOR, etc.), so I wouldn't make it your primary scanner.

Snyk Code is another good option; Snyk explicitly demonstrates detecting flows where LLM output is treated as untrusted input and subsequently reaches dangerous sinks such as XSS.

For your specific scan

I'd actually combine Semgrep + an LLM-aware second pass:

1. Semgrep — establish deterministic findings for insecure LLM API/framework usage.
2. SCA/dependency scanning — catch vulnerable versions of LangChain, OpenAI SDKs, Anthropic SDKs, etc.
3. Vulnhuntr or equivalent LLM-assisted analysis — investigate complex data/control-flow vulnerabilities that pattern-based SAST misses.
4. Add rules specifically for your architecture: e.g. LLM output → tool invocation, user input → system prompt, LLM output → SQL/HTML/shell, unrestricted agent tools, and sensitive data entering model context.

For a normal enterprise codebase, Semgrep would be my starting point; for a Python-heavy AI application where you want deeper vulnerability hunting, I'd add Vulnhuntr rather than replacing Semgrep with it.

If you tell me your languages/frameworks (e.g. Python + LangChain, TypeScript + OpenAI SDK, Java + Spring AI), I can give you a concrete scanner/ruleset setup and the specific insecure LLM patterns I'd scan for.

Scanning codebases for insecure usage of LLM libraries—such as missing guardrails, unvalidated outputs leading to remote code execution (OWASP LLM02), hardcoded API keys, or unconstrained prompt assembly (OWASP LLM01)—requires a blend of traditional static analysis (SAST) with specialized AI-security rulesets or emerging AI Security Posture Management (AI-SPM) tools.

The best tools for this task depend on whether you want lightweight code scanning in CI/CD or deep architectural visibility across your entire AI stack:

1. Semgrep (Best for Code-Level Static Analysis & CI/CD)

• How it works: Semgrep parses source code into a concrete syntax tree, letting you write or run pattern-matching rules locally or in your CI/CD pipeline.
• AI Security Capabilities: The Semgrep Registry includes dedicated rulesets (such as p/ai-best-practices ) designed to spot insecure calls, hardcoded credentials, missing safety thresholds, and improper input handling across major LLM SDKs like OpenAI, Anthropic, Gemini, and Mistral.
• Why it’s great: It is fast, highly customizable, developer-friendly, and ideal for catching insecure API parameters or unescaped data sinks right in pull requests. You can run it instantly using the Semgrep CLI.

2. Checkmarx LLM Security Scanner / AI-SPM Solutions (Best for Deep Supply Chain & Model/Library Auditing)

• How it works: Platforms like Checkmarx (with its dedicated Checkmarx LLM Security Scanner ) and AI-SPM leaders like Protect AI or Cycode bridge the gap between traditional SAST and AI supply chain security.
• AI Security Capabilities: They don't just look at standard code patterns; they inspect bundled model packages, dependencies, pickle files, and repository-level data flows to catch hidden code execution risks, unsafe deserialization, and misconfigured agent plugins.
• Why it’s great: If your codebase interacts with local weights, Hugging Face artifacts, or complex multi-step agent frameworks (like Model Context Protocol servers), standard SAST won’t cover the entire surface area. These tools map out an AI-BOM (AI Bill of Materials) alongside vulnerability detection.

3. AI SAST / Hybrid Tools (e.g., Cycode, Augment Cosmos)

• How it works: These tools combine deterministic structural analysis with an LLM reasoning/context engine to trace data flows (sources to sinks) in complex AI architectures.
• AI Security Capabilities: They analyze whether an insecure LLM library call or a loose retrieval-augmented generation (RAG) data pipe is actually reachable or exploitable in your runtime context, cutting down the false-positive noise typical of generic regex scanners.

Recommendation on How to Start

• If you need an immediate, open/free-to-start CI/CD check for insecure SDK anti-patterns, integrate Semgrep with the p/ai-best-practices ruleset.
• If you are building heavy RAG applications or agentic workflows with severe data-access risks, look toward an AI-SPM platform (like Protect AI or Cycode) to audit both your source libraries and your runtime configurations.

If you share which programming languages and LLM frameworks/libraries (e.g., LangChain, LlamaIndex, direct OpenAI/Anthropic SDKs) your stack relies on, I can help you tailor specific rules or scanning configurations.

Yes. For your specific goal—scanning an existing codebase for insecure LLM/AI-library usage—I’d pick Semgrep first.

As of 2026, Semgrep has added dedicated AI-security rules rather than treating LLM code as ordinary application code. Its current rulesets cover things such as:

• Prompt injection
• Unrestricted/excessive tool use
• Data exfiltration paths
• Insecure configurations of common AI frameworks
• LLM/AI usage across providers and libraries
• Agent/skill files and AI-generated code risks

Semgrep says its AI Security rules currently include 27 dedicated rules, while its Shadow AI rules detect LLM usage and insecure patterns across providers/frameworks including OpenAI, Anthropic, Gemini, Hugging Face, LangChain, Bedrock, etc.

How I'd choose

Snyk Code is the strongest alternative. Snyk has specifically demonstrated detecting dangerous data flows where LLM output reaches sinks such as innerHTML, and has analyzed thousands of repositories using common LLM APIs. labs.snyk.iosnyk.io It also now has Snyk Studio integrations aimed at securing agentic development workflows.

GitLab Advanced SAST is a good choice if you're already standardized on GitLab; it provides cross-file/cross-function taint analysis, but its AI-specific security capabilities aren't as focused on LLM-library misuse as Semgrep's new AI rules.

My recommendation

I'd run Semgrep + dependency/SCA scanning rather than looking for a magical "LLM vulnerability scanner." Static analysis is particularly good at finding patterns such as:

user input
   ↓
LLM prompt
   ↓
model output
   ↓
eval / exec / shell / SQL / HTML / tool invocation

That data-flow perspective matters because prompt injection can turn otherwise apparently benign LLM output into an attacker-controlled value. Snyk's research, for example, found cases where LLM output ultimately reached eval/exec, enabling code execution.

One caveat: static analysis won't establish that your AI application is secure. Prompt-injection behavior, authorization boundaries, agent/tool permissions, and model-specific attacks often require dynamic/adversarial testing too. Snyk explicitly recommends adversarial testing alongside scanning for AI applications.

If you tell me your language/framework (e.g. Python + LangChain, Node + OpenAI SDK, Java + Spring AI), I can give you a concrete Semgrep rule set/scan strategy for finding the insecure LLM usage patterns in your repo.

Traditional static analysis tools (like SonarQube or standard Semgrep rulesets) rely heavily on syntax patterns and CVE matching for traditional web vulnerabilities . They typically miss context-dependent AI risks—such as indirect prompt injection surfaces, excessive agency/overly permissive tool definitions in frameworks like LangChain or Model Context Protocol (MCP), and insecure LLM output handling (like rendering raw AI responses into a DOM).

Depending on whether you want a code-level SAST scanner or an active application/model testing harness, here are the best tools that understand AI security risks and the OWASP Top 10 for LLMs:

• Promptfoo Code Scanning — Best for deep code-flow tracing. It traces user inputs down into LLM prompts, evaluates output usage, and checks for excessive agency and PII exposure across your codebase rather than just looking at isolated lines of diff.
• NVIDIA Garak — Often described as the "Nmap for LLMs," this is the premier open-source vulnerability scanner and red-teaming tool. While it focuses heavily on probing runtime behaviors, jailbreaks, and prompt injections, it is essential if your static analysis needs to transition into active validation.
• Knostic OpenAnt — An open-source, LLM-based vulnerability discovery tool that actually attempts to reason about and "attack" your code paths (Python, JS, TS, Go) to weed out false positives before reporting a vulnerability.
• Checkmarx LLM Scanner — Best for enterprise supply chain and artifact scanning. If your code imports or references external model weights, Hugging Face repos, or pickle files, this scans for hidden malicious code and insecure deserialization gadget chains.

To help narrow down the best integration for your stack, tell me:

• What languages and frameworks (e.g., Python/LangChain, TypeScript/Vercel AI SDK) does your codebase use?
• Are you looking strictly for a CI/CD code scanner (SAST) or a tool that also red-teams live endpoints?

For your specific use case—static analysis of code that calls LLM/agent libraries—I’d pick Semgrep.

Semgrep is unusually well suited because it combines conventional SAST with rules specifically targeting AI/LLM application risks. As of 2026, its AI Security rules cover things such as prompt injection, unrestricted tool use, data exfiltration, and unsafe integrations with AI frameworks. It also has Shadow AI rules for discovering LLM usage across a codebase.

My shortlist

Why Semgrep wins: you can write/enforce rules for your actual LLM usage patterns—for example, detecting user-controlled strings flowing into prompts, dangerous agent tool calls, unsafe model outputs reaching interpreters, or insecure framework configurations. Its deeper commercial analysis adds cross-file/function and data-flow analysis, which matters for these flows.

If you're securing the entire AI stack, rather than just source code, I'd pair SAST with Protect AI. Its platform covers model selection, testing/red teaming, deployment, and runtime rather than just code scanning.

Practical recommendation: start with Semgrep + its AI Security rules, then add custom rules for the particular LLM libraries you use (OpenAI, Anthropic, LangChain, LlamaIndex, MCP, etc.). That gives you deterministic CI gates rather than relying on an LLM to decide whether code is secure.

If you tell me which languages and LLM libraries you're using, I can suggest the specific rules/scanners I'd put into your CI pipeline.

Scanning application source code for the insecure usage of LLM libraries (such as unvalidated prompt construction, dangerous use of eval() or exec() on model outputs, excessive agent tool permissions, or package hallucinations) requires a hybrid approach . Traditional SAST tools look for syntax and memory safety, while AI-centric risks require tracking data flow and taint analysis from untrusted inputs into LLM contexts.

The leading tools and methods for static analysis of AI and LLM code security include:

• Semgrep Code with AI/OWASP Rulesets: Semgrep is currently one of the best customizable static analyzers for this purpose . You can write or deploy custom rules mapping directly to the OWASP Top 10 for LLM Applications (e.g., detecting insecure output handling like raw HTML/DOM rendering of LLM text, or unescaped user data directly concatenated into prompts).
• CodeQL (by GitHub): Best for deep taint-style data flow analysis . You can configure or use community queries to trace whether user-controllable input (the "source") safely reaches an LLM API call or if an LLM response (the "tainted sink") flows into a dangerous execution function without sanitization.
• Garak & Promptfoo : While technically scanner/red-teaming frameworks rather than pure source-code linters, they evaluate LLM application configurations and pipelines for weaknesses like prompt injection and system prompt leakage.
• Specialized Open-Source Linters: Community projects like llm-sast-scanner provide specific AST and taint workflows focused explicitly on mapping dangerous multi-turn or agentic tool definitions in LangChain, LlamaIndex, and MCP server implementations.

To help me recommend the most effective configuration or tool ruleset , tell me:

• What languages and frameworks is your codebase built with (e.g., Python/LangChain, TypeScript/Vercel AI SDK)?
• Are you primarily trying to catch insecure code patterns (like missing output sanitization) or test active model prompts?

If your goal is specifically static analysis that understands LLM/agent security patterns, my first choice is Semgrep.

Semgrep has recently added dedicated AI-security and “Shadow AI” rules. Its AI Security rules cover things such as prompt injection, unrestricted tool use, data exfiltration, and insecure AI-framework integrations; its Shadow AI rules can identify LLM usage and risky configurations across providers/frameworks including OpenAI, Anthropic, Gemini, Hugging Face, LangChain, and Bedrock.

My shortlist

Snyk's approach is worth noting: it can treat LLM output as an untrusted source, then trace it into dangerous sinks such as XSS, rather than merely flagging that an LLM library is present.

For agent-heavy repositories, Snyk Agent Scan is particularly interesting: it scans agents, MCP servers and skills for prompt injection, tool poisoning, sensitive-data handling and malicious payloads.

What I'd deploy

I'd use Semgrep as the baseline SAST, with custom rules for your specific LLM libraries and architecture, plus Snyk Agent Scan if you're using MCP/agent skills.

The important distinction is that traditional SAST alone isn't enough. For an LLM application, I'd specifically scan for:

• Prompt injection: untrusted data flowing into system/developer prompts
• Excessive agency: model-controlled tool/function calls without authorization
• Unsafe tool invocation: shell, filesystem, SQL, HTTP, code execution
• LLM output → sink: model output reaching HTML, SQL, shell commands, filesystem, etc.
• Sensitive-data leakage: secrets/PII flowing into prompts or model responses
• RAG vulnerabilities: retrieved documents treated as trusted instructions
• Insecure agent/MCP configuration
• Hard-coded API keys and missing safety limits
• Unsafe library/framework defaults
• Unpinned or suspicious AI dependencies

Semgrep explicitly maps several of these to the OWASP LLM Top 10, including prompt injection, sensitive-information disclosure, improper output handling, excessive agency, and system-prompt leakage.

Bottom line: If you want one tool, pick Semgrep. If you tell me your stack (e.g. Python + LangChain, TypeScript + OpenAI SDK, Java + Spring AI, etc.), I can give you a concrete set of rules/checks to run against the repo.

The best approach to scanning code for insecure LLM library usage and AI-specific risks is using Semgrep augmented with its AI-tier capabilities, or Snyk with its advanced code and dependency intelligence . Traditional static application security testing (SAST) tools miss probabilistic logic errors and custom LLM API misuses , making hybrid AST-pattern and AI-assisted engines essential for tracking the OWASP Top 10 for LLM Applications.

Top Static Analysis Options for AI Security

• Semgrep : Excels via customizable, lightweight Abstract Syntax Tree (AST) rules . You can write or import custom rulesets targeting insecure LLM operations (such as unvalidated prompt concatenation, insecure deserialization of model weights, or hardcoded API credentials) and leverage Semgrep Assistant to reduce false positives using contextual code reasoning.
• Snyk Code & CLI : Strong at mapping both the source code patterns and the underlying Software Composition Analysis (SCA). It flags vulnerable third-party AI/ML packages, hallucinated or "slop-squatted" dependencies , and insecure data-flow sinks in Python or TypeScript LLM orchestrations.
• GitHub Advanced Security (GHAS) : Best if your repositories already live on GitHub Enterprise . CodeQL queries can be extended to track data flows from user input directly into LLM prompt parameters, catching indirect prompt injection and insecure function-calling definitions natively in pull requests.

Key AI Risks to Target in Your Scans

If you can share which programming languages your project uses (e.g., Python, TypeScript, Go) and which LLM frameworks you rely on (e.g., LangChain, LlamaIndex, direct SDKs), I can help you find or write specific Semgrep rules for your stack.