Can I add custom scanner parsers?

AppGuard uses a registry-based parser architecture. While adding new parsers requires Go development, the generic SARIF parser accepts output from any SARIF-compliant tool, covering many additional scanners out of the box.

Which output formats are accepted?

AppGuard accepts JSON, SARIF, and CSV formats. Most scanners produce one of these formats natively. The auto-detection system identifies the scanner type from file content without manual configuration.

How does auto-detection work?

When you push scan results, AppGuard analyzes the JSON structure and field patterns to automatically identify which scanner produced the output. No manual configuration is needed - just push the results and AppGuard handles the rest.

AppGuard Supported Scanners

Name: AppGuard
Brand: servasec

Supported scanners

AppGuard ingests results from the most popular open source and commercial security scanners. Push findings via API or CI/CD pipeline.

Supported scanners

Semgrep
Trivy
Gitleaks
Grype
Snyk
Checkov
TruffleHog
Nuclei
Bandit
Gosec
Kube-bench
Kubescape
npm audit
OSV-Scanner
Tfsec
SARIF

SAST

Semgrep

Lightweight static analysis for finding bugs and enforcing coding standards. Supports 30+ languages.

SARIFJSON

Container / SCA

Trivy

Comprehensive vulnerability scanner for containers, filesystems, and Git repositories.

SARIFJSON

Secrets

Gitleaks

Detect hardcoded secrets like passwords, API keys, and tokens in Git repositories.

JSONCSV

SCA

Grype

Fast vulnerability scanner for container images and filesystems with CVE matching.

SARIFJSON

SCA

Snyk

Developer security platform for finding and fixing vulnerabilities in dependencies.

SARIFJSON

IaC

Checkov

Static analysis for infrastructure as code. Scans Terraform, CloudFormation, Kubernetes, and more.

SARIFJSON

Secrets

TruffleHog

Scan Git repositories for credentials, secrets, and sensitive information with deep content analysis.

JSON

DAST

Nuclei

Fast, template-based vulnerability scanner with 8000+ community-contributed templates.

JSONSARIF

SAST

Bandit

Python-specific static analysis tool that finds common security issues in Python code.

JSONSARIF

SAST

Gosec

Go static analysis tool that inspects source code for security problems.

JSONSARIF

Kubernetes

Kube-bench

Checks Kubernetes clusters against CIS Kubernetes Benchmark security recommendations.

JSON

Kubernetes

Kubescape

Kubernetes security scanner for clusters, YAML files, and Helm charts.

JSONSARIF

SCA

npm audit

Built-in npm dependency vulnerability scanner for Node.js projects.

JSON

SCA

OSV-Scanner

Vulnerability scanner using Google's OSV database for comprehensive dependency coverage.

JSON

IaC

Tfsec

Static analysis for Terraform code to detect potential security issues.

JSONSARIF

Generic

SARIF

Generic SARIF format parser for any SARIF-compliant security tool output.

SARIF

How ingestion works

01
Push results
Send scan results to AppGuard via a simple curl command from your CI/CD pipeline.
02
Auto-detect scanner
AppGuard automatically detects the scanner type from file content. No manual configuration needed.
03
Centralize and track
Findings appear in the dashboard with severity, metadata, and version context.

Compatible formats

SARIFJSONCSV

Scanner categories

SASTSCASecretsContainerIaCKubernetesDAST

Start ingesting today

Self-host AppGuard and connect your scanners in minutes. AGPLv3 licensed, full data ownership.

Supported scanners

Semgrep

Trivy

Gitleaks

Grype

Snyk

Checkov

TruffleHog

Nuclei

Bandit

Gosec

Kube-bench

Kubescape

npm audit

OSV-Scanner

Tfsec

SARIF

How ingestion works

Push results

Auto-detect scanner

Centralize and track

Compatible formats

Scanner categories

Start ingesting today

Frequently Asked Questions