Shield AST - Application Security Testing CLI

Shield AST is a powerful command-line tool for Application Security Testing, combining multiple open-source scanners into a single workflow. With ast, you can run SAST (Static Application Security Testing), SCA (Software Composition Analysis), and IaC (Infrastructure as Code) analysis quickly and automatically, helping you identify and fix vulnerabilities early in the development lifecycle.

• Ruby (version 3.0 or later) must be installed on your system.
  You can check your Ruby version with:

ruby -v

If you don't have Ruby installed, follow the instructions at: https://www.ruby-lang.org/en/documentation/installation/

# Install the gem
gem install ast

ast [command] [options]

• scan [path] – Scans a directory for vulnerabilities. Defaults to the current directory.
• report – Generates a detailed report from the last scan.
• help – Displays this help message.

• -s, --sast – Run SAST using Semgrep.
• -c, --sca – Run SCA using OSV Scanner.
• -i, --iac – Run IaC analysis using Semgrep with infrastructure rules.
• -o, --output – Specify the output format (json, sarif, console).
• -h, --help – Show this help message.
• --version – Show the AST version.

Shield AST can use the Google Gemini API to automatically analyze findings and flag potential false positives, helping you focus on what matters most.

To activate this feature, you need a Google AI API key.

First, you'll need a Google Gemini API key to enable AI analysis.

1. Navigate to Google AI Studio.
2. Click "Create API key" (you may need to sign in with your Google account).
3. Copy the key once it's generated.

Next, export the API key as an environment variable in your terminal.

# Replace with your actual API key
export GEMINI_API_KEY="YOUR_API_KEY_HERE"

📌 Tip: This command is temporary and only lasts for the current terminal session. To make it permanent, add the line above to your shell's configuration file (e.g., ~/.zshrc or ~/.bash_profile).

The tool defaults to the free gemini-2.5-flash model. If you have access to a more powerful model, you can specify it by setting the optional GEMINI_MODEL variable:

export GEMINI_MODEL="gemini-2.5-pro"

# Scan the current directory for all types of vulnerabilities
ast scan

# Run only SAST and SCA on a specific project folder
ast scan /path/to/project --sast --sca

# Generate a report in SARIF format
ast report --output sarif

AST integrates well-known open-source scanners into a single CLI tool:

• SAST – Semgrep for static code analysis
• SCA – OSV Scanner for dependency vulnerability scanning
• IaC – Semgrep rules for Infrastructure as Code

This unified approach streamlines security testing, enabling developers to catch security issues earlier in the development process.

Distributed under the MIT License. See the LICENSE file for details.