Datadog SAIST CLI
A Datadog CLI that hunts for vulnerabilities in source code with Claude, GPT or Gemini and saves the result as SARIF
- 108 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- Reads source files of a directory and sends them in full to the chosen model provider
- Spends paid requests on the provider key and downloads rules from the Datadog API
Install
Manual install
git clone https://github.com/DataDog/datadog-saist
cd datadog-saist
make buildBuild from source. After that `./bin/datadog-saist` runs with the `--directory`, `--output`, `--detection-model` and `--validation-model` flags.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Reads source files of a directory and sends them in full to the chosen model provider
- Spends paid requests on the provider key and downloads rules from the Datadog API
This is third-party code. Review the repository files before installing.
What it does
SAIST parses a source directory with Tree-sitter, builds project context and hands files to a model to find vulnerabilities. A second model validates each finding and drops the noise. Go, Java, Python, C#, C++, JavaScript, TypeScript, Kotlin, PHP, Ruby, Rust, Elixir and Swift are supported. The result is written to a SARIF file that IDEs and CI systems read. Models are picked with the `--detection-model` and `--validation-model` flags, and the key comes from `ANTHROPIC_API_KEY`, `OPENAI_API_KEY` or `GOOGLE_API_KEY`. A Datadog account is not needed: the tool fetches detection rules from a public Datadog API, and the `--local-prompts` flag switches to the rules embedded in the binary. The project is in preview and is built from source with `make build`.
Who it is for. For security engineers and developers who want to run their code through a language model and get a report in a standard format.
Good fit when
- Classic static analysis is silent, and you want a second opinion from a model on a Go or Java project.
- A SARIF report has to be loaded into an IDE or a repository code scanning panel.
- You need a run on a large repository: file parallelism is set with the `--file-concurrency` flag.
- Rules and prompts must stay local, which the `--local-prompts` flag switches on.
- A Kotlin, Elixir or Swift project is checked with the same command as a Python one.
Not a fit when
- The code cannot be sent to an external model provider: files go to the chosen model in full.
- You need a deterministic result without probabilistic findings: model answers differ from run to run.
- You want a ready binary without a build: the README describes only building from source.
Example request
Build datadog-saist, run the services/ directory through Gemini and show which SARIF findings to look at firstLimitations
The project is in preview and changes actively. A key from one of the model providers is required: Anthropic, OpenAI or Google Gemini, and request costs fall on the key owner. Sources are passed to the model, so for closed code this is a decision to give a third party access to the project. Without the `--local-prompts` flag the rules are downloaded from the Datadog API. For an OpenAI-compatible address the base URL is given without `/v1`. The build goes from Go sources with Tree-sitter, and ready binaries are not mentioned in the README. Licensed under Apache-2.0.
How to disable. The tool is one-off and installs nothing into the system. Delete the built `bin/datadog-saist` binary and the repository clone.
FAQ
Do I need a Datadog account for SAIST?
No. The tool takes detection rules from a public Datadog API without Datadog keys, and only a model provider key is needed.
Which models work?
Models from Anthropic, OpenAI and Google Gemini. For OpenAI your own address works through `--openai-base-url`, and `./bin/datadog-saist --help` prints the exact model names.
What is inside the report?
A SARIF file with the vulnerabilities found, read by IDEs and code scanning systems. Each finding is first checked by a second model.
How do I lower memory use on a large repository?
The `--skip-indexing` flag turns off cross-file context indexing. Memory is saved, but findings that need context from neighboring files will be missed.
Can I keep the rules locally?
Yes, the `--local-prompts` flag uses the detection rules embedded in the binary, and no request to the Datadog API is made.
Discussion
No questions or reviews yet.
Related
CLI toolsA Go CLI that hunts for vulnerabilities in a Git repository with LLMs and saves findings as SARIF for GitHub Code Scanning.
A CLI that reads a project's code and builds a STRIDE threat model, with a report in Markdown, JSON, SARIF or HTML
A taint analysis engine for Java and Kotlin with agent skills: scans code, triages findings and writes rules.
19 Google skills to find, reproduce and patch vulnerabilities: from a threat model to a patch and a report, plus an ADK reference harness
A SAST scanner with cross-file dataflow analysis and an MCP server: the agent sees call graphs, taint sources and sinks
An AI security verification CLI: scans models and code, probes live endpoints and MCP servers, and analyzes recorded agent runs
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Datadog SAIST (this card) | no | 108 | ||
| Semgrep | yes | not required | 17,635 | searches by pre-written rules, while SAIST asks a model to find a vulnerability and validates it with a second model |
| Snyk CLI | yes | OAuth | 5,709 | scans dependencies and code through the Snyk service, while SAIST runs on a model provider key and needs no account |
README in short
Datadog calls SAIST a static security analyzer built on models that works standalone on a laptop and is part of Datadog Code Security. The README lists features, key requirements, build and run commands with Gemini and OpenAI examples, and a gateway variant of Datadog for customers of the service.