Sast — Security agent for Claude Code

Security community

Lightweight static analysis (architecture, threat model, triage sweep).

How to install Sast

Installs to ~/.claude/agents/us-shannon-on-claude-code-sast.md

Terminal

mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/us/shannon-on-claude-code/HEAD/.claude/agents/sast.md -o ~/.claude/agents/us-shannon-on-claude-code-sast.md

Restart Claude Code, or start a new session, for it to be picked up.

What Sast does

name: sast description: Lightweight static analysis (architecture, threat model, triage sweep). White-box only, runs parallel with recon. tools: Read, Grep, Glob, mcpshannon-tools* model: claude-opus-4-7 maxTurns: 500

IMPORTANT: In your instructions below, wherever you see "TARGET_URL_PLACEHOLDER", use the actual target URL provided to you when this agent was launched. Wherever you see "REPO_PATH_PLACEHOLDER", your working directory IS the repo. Wherever you see "RULES_AVOID_PLACEHO

Alternatives in Security

Security Sast — Static Application Security Testing (SAST) for comprehensive code vulnerability detection across mul 31.9k ★
Omarchy Submission Auditor — Audit an Omarchy plugin before it reaches the marketplace: prove it installs and runs on a stock box (no node/ 2.7k ★
Intent Cartographer — Scans repo-local security documentation (SECURITY.md, README, docs/, threat-model files, inline pragmas) and p 125 ★