SAST without the query language.
Configure it. Don't program it.
Your agents write code. This engine scans it — taint tracking across 5 languages, defined in YAML.
The open-source core behind the Cognium Trust Engine. Zero native deps.
What is Semantic SAST?
Traditional SAST tools match patterns — regex against known bad strings. Semantic SAST understands data flow. It tracks how user input moves through your code, across function calls, through collections, past sanitizers, all the way to dangerous sinks. If tainted data reaches a sink unsanitized, it's a real finding — not a guess.
Five-stage taint analysis.
Configuration-driven, not query-driven.
Define patterns in YAML — not a query language. Add a framework with a config edit, not a compiler pass.
Real benchmarks. Reproducible methodology.
| Benchmark | Score | Detail |
|---|---|---|
| OWASP Benchmark v1.2 (Java) | >90% ★ | 0 FN, 0 FP |
| Juliet Test Suite (Java) | >90% | 9 CWE families |
| SecuriBench Micro (Java) | 97.7% TPR / 6.7% FPR | High precision |
| CWE-Bench-Java (120 real CVEs) | 42.5% | 51/120 — beats CodeQL 22.5% |
| OWASP NodeGoat (Node.js) | >90% | Real-world vulnerabilities, 0 FP |
| Node.js Synthetic | >90% TPR / 94.1% Precision | 6 CWE families |
| OWASP BenchmarkPython | 56.7% | Flask/Django frameworks |
| CWE-Bench-Rust | 77.8% TPR / 0% FPR | 0 false positives |
| Bash Synthetic | 68.2% TPR / 0% FPR | 5 CWE types |
COGNIUM + LLM
What happens when you add an LLM? Enable discovery mode to see AI-augmented results →
| Rank | Model | Detected | Score |
|---|---|---|---|
| 🥇 | Claude Opus | 94 / 120 | 78.3% |
| 🥈 | Grok Code | 90 / 120 | 75.0% |
| 🥉 | DeepSeek V3 | 86 / 120 | 71.7% |
| 4 | Claude Haiku | 80 / 120 | 66.7% |
| 5 | GPT-4o | 78 / 120 | 65.0% |
| — | Static only (no LLM) | 51 / 120 | 42.5% |
| — | CodeQL (reference) | 27 / 120 | 22.5% |
Other model scores reflect preliminary runs — re-verification in progress.
DISCOVERY MODE
LLM reads source code and locates vulnerable methods from scratch — no prior static signal required. Drives the 78.3% score.
VERIFICATION MODE
Confirms whether a static finding is exploitable. High-precision output.
SEMANTIC EXTRACTION
Extracts design intent to Specifica format — automated gap analysis between spec and implementation.
$ export LLM_ENRICHMENT_MODEL=claude-opus
Swap the model via env var. No vendor lock-in. The static engine runs without any LLM.
5 languages. 14 CWE families. Growing.
| Language | Frameworks | Status |
|---|---|---|
| Java | Spring MVC, Spring Boot, JAX-RS, Servlet API, Struts, Hibernate, Apache Camel, MINA SSHD, WildFly, Vert.x | Production |
| JavaScript / TypeScript | Express, Fastify, Node.js core, browser DOM | Production |
| Python | Flask, Django, FastAPI, Starlette | Beta |
| Rust | Actix-web, Rocket, Axum, Tokio | Beta |
| Bash / Shell | POSIX sh, bash scripts | Beta |
CWE COVERAGE
Install in seconds. No account required.
CI/CD
- uses: cogniumhq/scan@v1
with:
path: ./src
Open source. Read every line.
No telemetry. No phone-home. No usage limits. Fork it, extend it, deploy it.
# Add a new source pattern in YAML
sources:
- framework: my-framework
type: http-param
methods:
- class: MyController
method: getInput
param: 0
taint: FULL