OpenTaint CLI
A taint analysis engine for Java and Kotlin with agent skills: scans code, triages findings and writes rules.
- 175 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- The skills build and run the project and may execute application code during dynamic checks.
- The agent gets access to sources and scan results containing details of project vulnerabilities.
Install
- Works in
Manual install
curl -fsSL https://opentaint.org/install.sh | bashFor Linux and macOS. For Windows PowerShell `irm https://opentaint.org/install.ps1 | iex`, and Homebrew, npm and Docker are available too.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The skills build and run the project and may execute application code during dynamic checks.
- The agent gets access to sources and scan results containing details of project vulnerabilities.
This is third-party code. Review the repository files before installing.
What it does
OpenTaint is an open inter-procedural taint analysis engine for application security. It tracks untrusted data across function boundaries, persistence layers, aliases and async code and finds what syntax-matching tools miss. The idea is that an agent distills a found vulnerability into a rule once and the deterministic engine replays it across the whole codebase and every later commit in minutes of CPU at zero token cost. Java, Kotlin and Spring are supported, with Python, Go, C#, JavaScript and TypeScript on the roadmap. The `appsec-workflow` skills guide an agent through the full cycle: building the project, running `opentaint scan`, triaging findings, discovering attack surface, creating and debugging rules and modeling data flows through libraries. The `appsec-agent` skill runs a whole-project assessment, optionally with dynamic checks to confirm findings. Results come as SARIF and there are GitHub Action and GitLab CI templates.
Who it is for. Application security engineers and Spring teams who want deep data flow analysis at minimal token cost.
Good fit when
- Pattern scanners miss untrusted input that passes through a storage layer and several calls.
- A found vulnerability must become a rule and run across the whole monorepo and every commit.
- An agent must run a whole-project assessment: build, scan, triage findings and attack surface.
- CI needs SARIF output from an open analyzer you can self-host.
Not a fit when
- The project is in Python, Go or JavaScript: those languages are still planned and support covers Java and Kotlin.
- You need a single quick pattern linter with no rule setup.
- Only testing of third-party systems without source access is allowed: the engine works on project code.
Example request
Build the project, run `opentaint scan`, triage the findings and turn the most serious one into a rule to run across the whole repository.Limitations
The engine analyzes Java and Kotlin sources and other languages are named as plans. The agent skills build and run the project and with dynamic checks enabled may execute application code, so use an isolated environment and your own projects. The skills need the `opentaint` CLI installed. Rules must be written and debugged and result quality depends on library models. Licenses split: the core is Apache 2.0 and the CLI, rules and CI templates are MIT.
How to disable. Remove the CLI with the manager you used, for example `npm uninstall -g @seqra/opentaint`, and the plugin with `claude plugin uninstall appsec-workflow@opentaint`. Scan results remain in your output directory.
FAQ
How do I install OpenTaint?
Run `curl -fsSL https://opentaint.org/install.sh | bash` on Linux and macOS, `irm https://opentaint.org/install.ps1 | iex` on Windows or `npm install -g @seqra/opentaint`. Homebrew, Docker and a no-install run through `npx @seqra/opentaint scan` also exist.
How do I connect the skills to an agent?
For Claude Code: `claude plugin marketplace add seqra/opentaint` and `claude plugin install appsec-workflow@opentaint`. For Codex: `codex plugin marketplace add seqra/opentaint` and `codex plugin add appsec-workflow@opentaint`. Universal: `npx skills add https://github.com/seqra/opentaint`.
Which languages are supported?
Java and Kotlin with Spring today. Python, Go, C#, JavaScript and TypeScript are on the roadmap.
What is in the skill set?
Build and run: `build-project`, `run-scan`, `analyze-findings`, `generate-poc`. Coverage expansion: `triage-dependencies`, `discover-attack-surface`, `create-rule`. Data flow modeling: `create-dataflow-model`, `debug-rule` and more. `appsec-agent` ties them together.
Can I run a scan in Docker?
Yes: `docker run --rm -v $(pwd):/project -v $(pwd):/output ghcr.io/seqra/opentaint:latest opentaint scan --output /output/results.sarif /project`. The result is saved as SARIF.
Discussion
No questions or reviews yet.
Related
CLI toolsA set of skills that turns the agent into a static code analyzer: finds vulnerabilities and builds a prioritized report
A local MCP server and CLI find vulnerabilities in AI-generated code and drive a scan, fix and rescan loop, no account needed
An AI security verification CLI: scans models and code, probes live endpoints and MCP servers, and analyzes recorded agent runs
A guide skill for OpenART, an executable benchmark that tests the safety of coding agents in long-running, changing environments
A skill for reviewing code for vulnerabilities against OWASP Top 10:2025, ASVS 5.0 and the 2026 lists for LLM and AI agent security
A security audit skill built on OWASP Top 10, CWE and CVSS, with deep PHP and TYPO3 scanning across 80-plus checkpoints.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| OpenTaint (this card) | no | 175 | ||
| Semgrep | yes | not required | 17,635 | syntax pattern matching; OpenTaint tracks the flow of untrusted data across functions and layers |
| LLM SAST Skills | no | 1,371 | model-driven skills re-read code on every run; OpenTaint replays ready rules with a deterministic engine |
README in short
The repository combines the engine, rules and CI integrations into one stack under open licenses and ships agent skills as the `appsec-workflow` plugin and through the Skills CLI.