正式的过程间污点分析引擎，用于应用程序安全。跨函数边界、持久层和异步代码追踪不可信数据。支持AI智能体，具备确定性规则重放。开源替代 Semgrep Pro 和 CodeQL。
<p align="center">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="../../logos/opentaint-logo-dark.svg">
<source media="(prefers-color-scheme: light)" srcset="../../logos/opentaint-logo-light.svg">
<img src="https://raw.githubusercontent.com/seqra/opentaint/HEAD/logos/opentaint-logo-light.svg" alt="OpenTaint" height="100">
</picture>
</p>
<h3 align="center">AI 时代的开源污点分析引擎</h3>
<p align="center">
面向应用安全的形式化污点分析——发现 AST 模式匹配引擎遗漏的问题，让 LLM 代理将漏洞转化为规则，在两者都无法单独胜任的场景中实现规模化。
</p>
<p align="center">
<a href="https://github.com/seqra/opentaint/releases"><img src="https://img.shields.io/github/release/seqra/opentaint.svg" alt="GitHub 发布版本"></a>
<a href="https://goreportcard.com/report/github.com/seqra/opentaint/cli"><img src="https://goreportcard.com/badge/github.com/seqra/opentaint/cli" alt="Go Report Card"></a>
<a href="https://github.com/seqra/opentaint/blob/main/LICENSE.md"><img src="https://img.shields.io/badge/License-Apache%202.0-blue.svg" alt="许可证: Apache 2.0"></a>
<a href="https://golang.org/"><img src="https://img.shields.io/badge/Go-1.25+-00ADD8?logo=go" alt="Go 版本"></a>
<a href="https://discord.gg/6BXDfbP4p9"><img src="https://img.shields.io/discord/1403357427176575036?logo=discord&label=Discord" alt="Discord"></a>
</p>
<p align="center">
<a href="https://github.com/seqra/opentaint/blob/main/README.md">English</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.zh.md">简体中文</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.zht.md">繁體中文</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.ko.md">한국어</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.de.md">Deutsch</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.es.md">Español</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.fr.md">Français</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.it.md">Italiano</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.da.md">Dansk</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.ja.md">日本語</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.pl.md">Polski</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.ru.md">Русский</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.bs.md">Bosanski</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.ar.md">العربية</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.no.md">Norsk</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.sv.md">Svenska</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.br.md">Português (Brasil)</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.th.md">ไทย</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.tr.md">Türkçe</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.ua.md">Українська</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.bn.md">বাংলা</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.hi.md">हिन्दी</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.gr.md">Ελληνικά</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.vi.md">Tiếng Việt</a> | <a href="https://github.com/seqra/opentaint/blob/main/docs/translations/README.id.md">Bahasa Indonesia</a>
</p>
<p align="center">
<a href="http://opentaint.org/">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="../../public/opentaint-demo-dark.gif">
<source media="(prefers-color-scheme: light)" srcset="../../public/opentaint-demo-light.gif">
<img src="https://assets.kitploit.com/production/public/readmes/13793/562b0290a09060eff941363dd673b805d145664f68b1074b35b7b670ede8cd66.gif" alt="OpenTaint 汇总输出">
</picture>
</a>
</p>
<p align="center"><b>支持的技术和集成</b></p>
<p align="center">
<img src="https://raw.githubusercontent.com/seqra/opentaint/HEAD/logos/java-logo.svg" alt="Java" height="60">
<img src="https://raw.githubusercontent.com/seqra/opentaint/HEAD/logos/kotlin-logo.svg" alt="Kotlin" height="60">
<img src="https://raw.githubusercontent.com/seqra/opentaint/HEAD/logos/spring-boot-logo.svg" alt="Spring" height="60">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="../../logos/github-logo-dark.svg">
<source media="(prefers-color-scheme: light)" srcset="../../logos/github-logo-light.svg">
<img src="https://raw.githubusercontent.com/seqra/opentaint/HEAD/logos/github-logo-light.svg" alt="GitHub" height="60">
</picture>
<img src="https://raw.githubusercontent.com/seqra/opentaint/HEAD/logos/gitlab-logo.svg" alt="GitLab" height="60">
</p>
<p align="center"><i>最全面的 Spring 应用 taint 分析引擎</i></p>
<p align="center"><b>路线图</b></p>
<p align="center">
<img src="https://raw.githubusercontent.com/seqra/opentaint/HEAD/logos/python-logo.svg" alt="Python" height="60">
<img src="https://raw.githubusercontent.com/seqra/opentaint/HEAD/logos/go-logo.svg" alt="Go" height="60">
<img src="https://raw.githubusercontent.com/seqra/opentaint/HEAD/logos/csharp-logo.svg" alt="C#" height="60">
<img src="https://raw.githubusercontent.com/seqra/opentaint/HEAD/logos/javascript-logo.svg" alt="JavaScript" height="60">
<img src="https://raw.githubusercontent.com/seqra/opentaint/HEAD/logos/typescript-logo.svg" alt="TypeScript" height="60">
</p>
<div align="center">
<details>
<summary><b>更多截图</b></summary>
<p align="center">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="../../public/opentaint-frame-dark-1.png">
<source media="(prefers-color-scheme: light)" srcset="../../public/opentaint-frame-light-1.png">
<img src="https://assets.kitploit.com/production/public/readmes/13793/8d9998e1918080fb841ec0ad473f51269941b9b5536ff7ac24480a600ad2f648.png" alt="OpenTaint 扫描输出">
</picture>
</p>
<p align="center">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="../../public/opentaint-frame-dark-2.png">
<source media="(prefers-color-scheme: light)" srcset="../../public/opentaint-frame-light-2.png">
<img src="https://assets.kitploit.com/production/public/readmes/13793/3f916c30b3f3b64064e428101084005a58f4ae3d988703946a899f6fb5f6f22a.png" alt="OpenTaint 汇总输出">
</picture>
</p>
<p align="center">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="../../public/opentaint-frame-dark-3.png">
<source media="(prefers-color-scheme: light)" srcset="../../public/opentaint-frame-light-3.png">
<img src="https://assets.kitploit.com/production/public/readmes/13793/a9f747d50d24686930d7fb97c3539bb8f34c42f3c24a79c7f21b8e1d55a7ba43.png" alt="OpenTaint 汇总输出">
</picture>
</p>
<p align="center">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="../../public/opentaint-frame-dark-4.png">
<source media="(prefers-color-scheme: light)" srcset="../../public/opentaint-frame-light-4.png">
<img src="https://assets.kitploit.com/production/public/readmes/13793/6f527df53125d8b57390c691e3ab37080b3ed7c6c0f9614af7dbbe4e7883c046.png" alt="OpenTaint 汇总输出">
</picture>
</p>
<p align="center">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="../../public/opentaint-frame-dark-5.png">
<source media="(prefers-color-scheme: light)" srcset="../../public/opentaint-frame-light-5.png">
<img src="https://assets.kitploit.com/production/public/readmes/13793/063464f019e0d1ec835eedd8e14fb1553c50030d193a8dc6739c079bce648126.png" alt="OpenTaint 汇总输出">
</picture>
</p>
</details>
</div>
---
## 为什么选择 OpenTaint？
> OpenTaint 是 *Semgrep Pro* 和 *CodeQL* 的开源替代方案——一个可自定义、可自托管的形式化过程间污点分析引擎，专为让 AI 代理驱动你的安全分析而打造，无需在每次扫描时消耗 token。
AI 生成生产代码的速度已经超过了安全团队能够跟上的节奏，而为捕获其错误而生的两类工具，各自都带来了糟糕的取舍：
- **AST 模式匹配器**（Semgrep OSS、ast-grep、各类 linter）免费且快速，但它们匹配的是语法，而非数据流——跨越函数边界或持久层的不可信输入会直接溜过去。真正能捕获这类问题的、更深入的过程间分析，长期以来一直被锁在专有工具之中。
- **LLM 安全代理**能发现模式匹配器遗漏的问题，但每次运行都要重新读取你的代码。token 会随着每个文件、每次提交、每次 CI 构建不断累积——而概率模型仍然无法保证它捕获了一切。
OpenTaint 以静态分析器的成本，为你提供 LLM 代理的深度：
- **发现 AST 模式匹配器遗漏的问题。** 形式化的过程间数据流引擎能够跨函数边界、持久层、别名和异步代码追踪不可信数据。
- **只为模型付费一次，而非每次扫描。** 让代理将单个发现提炼为一条污点规则。确定性引擎随后会在整个代码库——以及之后的每一次提交——中重放该规则，仅需数分钟的 CPU 时间，且零 token 成本。
- **开源，开箱即用。** 引擎、规则和 CI 集成作为一个整体技术栈，基于 Apache 2.0 和 MIT 许可发布。
## 快速开始
**安装脚本 (Linux/macOS)**
```
curl -fsSL https://opentaint.org/install.sh | bash
```
**通过 Homebrew 安装 (Linux/macOS)：**
```bash
brew install --cask seqra/tap/opentaint
```
**安装脚本 (Windows PowerShell)**
```
irm https://opentaint.org/install.ps1 | iex
```
**通过 npm 安装 (Linux/macOS/Windows)：**
```bash
npm install -g @seqra/opentaint
```
**或使用 npx 即时运行——无需安装（需要 Node.js）：**
```bash
npx @seqra/opentaint scan
```
**扫描你的项目：**
```bash
opentaint scan
```
**或使用 Docker：**
```bash
docker run --rm -v $(pwd):/project -v $(pwd):/output \
ghcr.io/seqra/opentaint:latest \
opentaint scan --output /output/results.sarif /project
```
更多选项请参阅[安装指南](https://github.com/seqra/opentaint/blob/main/docs/README.md#installation)和[使用方法](https://github.com/seqra/opentaint/blob/main/docs/README.md#usage)。
---
## AI 代理工作流
OpenTaint 包含代理技能（agent skills），可将静态分析转变为端到端的应用安全工作流。使用以下命令安装：
```bash
npx skills add https://github.com/seqra/opentaint
```
`appsec-agent` 技能可编排完整的项目评估：构建项目、运行 OpenTaint、发现攻击面、添加针对性规则、为缺失的库数据流建模、对发现结果进行分诊，并可选地为已确认的漏洞生成动态概念验证检查。
内置技能覆盖了常见的安全分析循环：
- **扫描与分诊：** `build-project`、`run-scan`、`analyze-findings`、`generate-poc`
- **覆盖范围扩展：** `triage-dependencies`、`discover-attack-surface`、`create-test-project`、`create-rule`、`assemble-lib-rules`
- **数据流建模：** `analyze-external-methods`、`create-pass-through-approximation`、`create-dataflow-approximation`、`debug-rule`、`report-analyzer-issue`
---
## 文档
完整指南——安装、使用、配置、CI/CD 集成：**[文档](https://github.com/seqra/opentaint/blob/main/docs/README.md)**。
## 支持
- **问题反馈：** [GitHub Issues](https://github.com/seqra/opentaint/issues)
- **社区：** [Discord](https://discord.gg/6BXDfbP4p9)
- **邮箱：** [[email protected]](mailto:[email protected])
## Star 历史
<a href="https://www.star-history.com/?repos=seqra%2Fopentaint&type=date&legend=top-left">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=seqra/opentaint&type=date&theme=dark&legend=top-left&sealed_token=cNibcudvsLJKQVlqN0qt2kK3b3-5zBDkzDzTamAWPRP6ny8KmCeZIooBYT7NBhjkd-T6OiiW7Iu9b1FSgL6n9IHMTPuoqKahF1NtidSTKkDXcbw8bY6k57DDstncYkKHJieEn9sJQ8oKJIYyBtYuQfk19qu5Kb1kvzCMT_dqOXXv3LM7EKZlljFcXAUh" />
<source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=seqra/opentaint&type=date&legend=top-left&sealed_token=cNibcudvsLJKQVlqN0qt2kK3b3-5zBDkzDzTamAWPRP6ny8KmCeZIooBYT7NBhjkd-T6OiiW7Iu9b1FSgL6n9IHMTPuoqKahF1NtidSTKkDXcbw8bY6k57DDstncYkKHJieEn9sJQ8oKJIYyBtYuQfk19qu5Kb1kvzCMT_dqOXXv3LM7EKZlljFcXAUh" />
<img alt="Star History Chart" src="https://assets.kitploit.com/production/public/readmes/placeholders/f0fc86cfe65f76d40e15aaec61704ec8220a56dc89d4be03c46f67cb31b9fa8c.svg" />
</picture>
</a>
## 许可证
[核心分析引擎](https://github.com/seqra/opentaint/blob/main/core)基于 [Apache 2.0 许可证](https://github.com/seqra/opentaint/blob/main/LICENSE.md)发布。[CLI](https://github.com/seqra/opentaint/blob/main/cli)、[GitHub Action](https://github.com/seqra/opentaint/blob/main/github)、[GitLab CI 模板](https://github.com/seqra/opentaint/blob/main/gitlab)和[规则](https://github.com/seqra/opentaint/blob/main/rules)基于 [MIT 许可证](https://github.com/seqra/opentaint/blob/main/cli/LICENSE)发布。