datadog-saist

Datadog Static AI Security Testing (SAIST) tool

This project is an AI-Native SAST tool. Unlike traditional SAST tools that rely solely on parsing and analysis rules, this project uses LLM (e.g. Claude from Anthropic, GPT from OpenAI or Gemini from Google) to find vulnerabilities.

This project can be used standalone on your laptop. It is available as part of the Datadog Code Security offering.

Project Status

This project is under development and is in preview stage.

Features

• AI-Powered Analysis: Uses advanced AI models to detect security vulnerabilities
• Multiple Language Support: Analyzes code in various programming languages. Java, Python and Go are currently supported. C# support coming soon.
• SARIF Output: Generates industry-standard SARIF reports
• Context-Aware: Builds project context for more accurate analysis

Requirements & Limitations

SAIST can be run standalone, but has the following dependencies:

• LLM API key: You must provide your own API key for one of the supported LLM providers (Anthropic, OpenAI, or Google Gemini). See LLM key below.
• Datadog API & App key: SAIST fetches its AI analysis prompts (detection rules) from a Datadog-hosted API. This requires a valid Datadog API key and App key. Without these, the tool cannot function. Set them via the DD_API_KEY and DD_APP_KEY environment variables.
• Datadog site (optional): Defaults to datadoghq.com. If your Datadog account is on a different site (e.g. EU), set DD_SITE accordingly.

Note for open source users: Due to the Datadog API dependency, SAIST cannot currently be used without a Datadog account. If you'd like to see a mode that works fully without a Datadog subscription, please open an issue.

Dependencies

• Go Tree-sitter: Go bindings for Tree-sitter parsing library
• Standard Go text/template: Built-in Go templating for prompt generation
• Go-SARIF: SARIF (Static Analysis Results Interchange Format) library

Usage

LLM key

Set the following environment variables to specify the API key to your LLM provider

• Anthropic: ANTHROPIC_API_KEY
• OpenAI: OPENAI_API_KEY
• Google Gemini: GOOGLE_API_KEY

Command Line Interface

Build and run the binary:

make build
./bin/datadog-saist --directory <path> --output <output-file> --detection-model <model> --validation-model <model> [options]

Example to run with Gemini

make build
GOOGLE_API_KEY=<...> ./bin/datadog-saist --directory <path> --output <output-file> --detection-model gemini-3-flash --validation-model gemini-3-flash

Required Arguments

• --directory: Directory to analyze (required)
• --output: Output file path for SARIF report (required)
• --model: Model to use for analysis (required)

Available Models

• openai-gpt5.2: OpenAI GPT-5.2
• openai-gpt5.2-codex: OpenAI GPT-5.2 codex
• claude-4.5-haiku: Claude 4.5 Haiku
• claude-4.5-opus: Claude 4.5 Haiku
• gemini-2.5-pro: Gemini 2.5 Pro
• gemini-2.5-flash: Gemini 2.5 Flash
• gemini-3-flash: Gemini 3 Flash

Optional Arguments

• --debug: Enable debug mode for verbose output
• --request-timeout-sec: Request timeout in seconds (default: 30)
• --file-concurrency: Number of concurrent files to analyze (default: 20)
• --write-prompts: Write prompts to files during analysis
• --skip-indexing: Disable cross-file context indexing. When set, related files are not collected and included in prompts. Reduces memory usage on large repositories at the cost of cross-file vulnerability detection.