What is ai-deep-sast?

AI Deep SAST is a security scanning tool from Cisco's open-source team that checks code for vulnerabilities. SAST stands for Static Application Security Testing, meaning it analyzes code without running it. This tool combines a rule-based scanner called Semgrep with AI language models to go beyond what pattern matching alone can catch. It offers two scan modes. The fast scan runs Semgrep to find potential issues, then uses a smaller local AI model (an 8-billion-parameter model called Foundation-Sec-8B that runs on your machine) to evaluate each finding and decide whether it is a real problem. This takes about five minutes. The deep scan indexes the entire codebase using a code-parsing library called tree-sitter, then sends the results to a larger cloud AI model such as GPT-4o or Claude for a whole-codebase analysis. That process can take anywhere from 30 minutes to 14 hours depending on codebase size and configuration. For each vulnerability it finds, the tool produces a structured report covering the type of vulnerability, how severe it is, what an attacker could do with it, how it affects the business, and how to fix it with corrected example code. It also scans configuration files for hardcoded passwords and API keys. Reports can be saved as Markdown, JSON, or JUnit XML (a format compatible with CI/CD tools like Jenkins). The tool is designed to plug into a continuous integration pipeline. The fast Semgrep pass runs on every code push, the AI analysis runs only on pull requests or when manually triggered, keeping routine commits fast. It is written in Python and supports Docker for reproducible environments. Local fast scans are optimized for Apple Silicon Macs but also support NVIDIA GPUs. A full test suite of over 240 tests is included.