Skip to content
OpenTaint

Continuous, lean, and agentic application security testing

The open source taint analysis engine for the AI era

InstallStar

Discover

Learn trust boundaries and vulnerability patterns as an informal specification.

Enact

Enact the informal specification as taint rules and dependency models.

Scan

Search the whole project with formal program analysis.

Triage

Confirm findings and tune away false alarms.

Turn one-off review into unlimited scans

The flexibility of model reasoning and the consistency of formal program analysis combined

Practical balance through SOTA static analysis

Minimize missed findings and false alarms without making whole-project analysis impractical.

Open source, batteries included

Engine, rules, models, agent skills, CLI, viewer, and CI integrations — all open source and built to work together.

From install to first agentic scan

Five-minute quickstart

01

Install OpenTaint

npm install -g @seqra/opentaint
02

Install OpenTaint agent skills

npx skills add https://github.com/seqra/opentaint
03

Prompt your agent to start agentic scan with OpenTaint

Run deep security scan and static triage with OpenTaint appsec-agent skill

As AI generates more code, security risk and review cost compound

Application security is the new tech debt

01 / Generated code

Would you notice the agent slipping a vulnerability into code you never reviewed?

44% of AI-generated solutions contained a known security flaw
Veracode 2026

02 / Exploitation

How long will you keep betting nobody will bother to exploit your code?

from 5% to 31% breaches beginning with vulnerability exploitation

Vulnerability exploitation became the leading breach entry point for the first time in 19 years.

5% 2023 14% 2024 20% 2025 31% 2026
Verizon DBIR 2026

03 / Repeatability

Will tomorrow’s security review catch what today’s review found?

14% of LLM-only findings recurred in all five runs on the same code and prompt

These were reported issues outside the deterministic reference set, not independently confirmed vulnerabilities.

REVIEW 1REVIEW 2REVIEW 3REVIEW 4REVIEW 5 ALL FIVE
Snyk VulnBench

04 / Model cost

How much money will you waste on reviewing the same parts of your application?

$20K spent across 1,000 security reviews
ONE SECURITY REVIEW CRITICAL BUG FOUND
Anthropic Mythos

A real-world review

How OpenTaint found CVE-2026-58138

Read the CVE-2026-58138 reproduction post.

01 Agent reviews

WorkflowResource.java / Lambda.java request path 
    // Controller entry point.
77  @PostMapping(produces = TEXT_PLAIN_VALUE)
81  public String startWorkflow(
82      @RequestBody StartWorkflowRequest request) {
83    return workflowService.startWorkflow(request);
84  }

    // Trust boundary: request data controls the script.
68  Map<String, Object> taskInput = task.getInputData();
71  scriptExpression = (String) taskInput.get(
72      "scriptExpression");
80  Object result = ScriptEvaluator.eval(
81      scriptExpression, taskInput);
ScriptEvaluator.java evaluation path 
    // Opaque external method behavior: option() returns this builder.
116 private static Context createNewContext() {
117   return Context.newBuilder("js")
118     .allowHostAccess(HostAccess.ALL)
119     .option("engine.WarnInterpreterOnly", "false")
120     .build();
121 }

    // Vulnerability pattern: untrusted script reaches the evaluator.
202 executorService.submit(
203   () -> context.eval("js", script));

02 Agent enacts

Taint rule graalvm-polyglot-sinks.yaml 
id: graalvm-polyglot-eval
languages: [java]
mode: taint
pattern-sinks:
  - patterns:
      - pattern: (Context $CTX).eval($LANG, $SOURCE)
      - focus-metavariable: $SOURCE
      # Only a context with full host access is RCE.
      - pattern-inside: |
          Context $CTX = $B
            .allowAllAccess(true).build();
          ...

Fires only when the context was built with full host access.

Dependency model org.graalvm.polyglot.yaml 
language: java
passThrough:
  - function: Context$Builder#option
    copy:
      - from: this
        to: result


  - function: Source$Builder#cached
    copy:
      - from: this
        to: result

The builder mutates and returns itself, so taint survives the chain.

03 Formal taint analysis searches

Reported finding
Open the report

Every finding opens to the flow that produced it.

Reported taint trace

  1. Source HTTP request Unauthenticated workflow input
  2. Step Task scheduling Across the workflow executor
  3. Step Executor lambda Captured, then run on another thread
  4. Sink Context.eval Evaluated with full host access

The complete trace spans 182 steps across the codebase.

Comparative results

See what the engine catches

Five-case comparison

Detection depth, compared

Compare Semgrep, CodeQL, and OpenTaint across five increasingly difficult Java XSS cases.

Read the comparison
XSS detection depth by tool and analysis mode across five Java test cases
Analysis depth Semgrep CodeQL OpenTaint
patterntainttaintpatterntaint
Direct return Detected Detected Detected Detected Detected
Local dataflow Missed Detected Detected Detected Detected
Inter-procedural Missed Detected Detected Detected Detected
Field sensitivity Missed Partial Partial Detected Detected
Virtual dispatch Missed Missed Partial Detected Detected

Detected Partial Missed

The agent skills

An application-security workflow

Fifteen composable skills, one workflow

AppSec Agent builds and scans, writes rules and models, triages findings, and generates proof-of-concept checks.

Read the release post
buildsourcesscanapproximationsinkstriagevulnerabilities.mdtriagedependenciesdiscover attacksurfaceanalyzeexternalpass-throughtestskipped.yamlsinksdataflowanalyzefindingsgeneratepocdebug rulereport issuetestcreate rulejoinsourcesapproximationtriagedebugrule creationsaturation loop buildsourcesscanapproximationsinkstriagevulnerabilities.mdtriagedependenciesdiscover attacksurfaceanalyzeexternalpass-throughtestskipped.yamlsinksdataflowanalyzefindingsgeneratepocdebug rulereport issuetestcreate rulejoinsourcesapproximationtriagedebugrule creationsaturation loop

Analysis coverage

Supported languages and frameworks

Available now

Java + Kotlin
Spring

Roadmap

  • Go
  • Python
  • C#
  • JavaScript + TypeScript

FAQ

  • OpenTaint is an open source taint analysis engine for agentic application security testing. Agents turn review knowledge into AST-pattern taint rules and dependency models. OpenTaint applies that formal specification across the codebase with deterministic program analysis.
  • Built-in rules cover more than 20 vulnerability classes, including SQL injection, XSS, SSRF, SpEL injection, open redirects, path traversal, and command injection. Each finding includes the complete reported flow from the application entry point to the dangerous operation.
  • AST-pattern rules describe untrusted inputs, dangerous operations, and sanitizers in a format familiar from Semgrep and ast-grep. AST-pattern matchers identify matching syntax. Formal program analysis then traces tainted values through methods, fields, async code, and persistence layers. Rules remain readable and directly refinable by people and agents.
  • Agent reviews are flexible, but repeated reviews can return different findings and consume model tokens rereading known code. OpenTaint preserves what the agent learned as taint rules and dependency models, then searches the whole codebase deterministically without model inference.
  • No. OpenTaint can scan with its built-in rules and models alone. Agent skills are optional: they review application-specific context and produce or refine rules and dependency models for broader coverage.
  • OpenTaint scans agent-generated and human-written code the same way. In CI, it applies the same rules and models to the current codebase, so known vulnerability patterns remain covered regardless of who wrote the change.
  • Software changes faster than teams can fully review it. Unreviewed attack surfaces and unresolved vulnerabilities accumulate across releases, while attackers can exploit them at any time. OpenTaint turns review knowledge into coverage that can be applied repeatedly instead of rebuilding that context for every review.
  • OpenTaint supports Java and Kotlin, with deep support for Spring Boot, Spring MVC, and Spring Data. It analyzes bytecode to resolve inheritance, generics, and calls into libraries on the build classpath. Python and Go are on the roadmap.
  • OpenTaint tracks tainted values across methods, fields, async boundaries, and JPA persistence. Its dependency models cover Reactor, Spring WebFlux, Kotlin coroutines, and stored flows that enter through one request and reappear in another.
  • OpenTaint provides open source inter-procedural taint analysis, including cross-endpoint and persistence flows. Its AST-pattern rule format supports existing Semgrep syntax, which makes gradual migration possible.
  • Both tools support inter-procedural taint analysis. OpenTaint is fully open source for public and private code, and uses AST-pattern rules that developers and agents can read and refine without learning QL.
  • Yes. The core engine is Apache 2.0. The CLI, CI integrations, and rules are MIT. You can use them on public, private, and commercial codebases.
  • Yes, with some restrictions and OpenTaint-specific extensions. OpenTaint propagates metavariables as data values through inter-procedural analysis, so the same rule can produce different findings than it does in Semgrep.
  • Ask us on Discord