AI Vulnerability Scanner on Claude Code: Fork CodeCrucible LLM SAST

Search ai vulnerability scanner.

You get listicles. Vendor PDFs. Blog posts that turn LLMs into a second-pass filter on Semgrep noise.

Almost nobody hands you a running scanner seat: whole-repo AI SAST, cost gate on the dry-run, SARIF on disk, Claude Code already on the box - and you still decide what is real.

That seat is the CodeCrucible LLM SAST template on jurniti.

What buyers mean by "AI vulnerability scanner"

They are not asking for another marketing synonym for classic static application security testing.

They want:

1. Coverage when no rule exists yet
2. Cross-file reasoning without hand-written taint configs for every framework
3. Output that plugs into GitHub Code Scanning (SARIF)
4. A cost story - scans that can spend real model dollars without a surprise bill

DataForSEO (US, 2026-07-29) puts commercial heat on the category: ai vulnerability scanner ~110/mo, ai sast ~70/mo, with claude code security scan ~30/mo at LOW competition. Head term sast is ~5,400/mo - that SERP is Semgrep/Checkmarx territory. This page ranks the AI/LLM SAST cluster and CTAs into a forkable template, not a 5,400/mo head-on war.

The product: AI SAST you can fork

Block published CodeCrucible as a blueprint for LLM-driven SAST - whole-repo packing, analysis + audit, SARIF out, explicit cost controls. The essay is the design; the CLI is the reference implementation.

jurniti's template is the operator pack:

You bring the model key. You own the box. You own the merge button.

Whole-repo is the point

Most "AI SAST" products still put a traditional analyzer first. The LLM validates a snippet the engine already nominated.

CodeCrucible's blueprint flips that: the model does primary analysis over packed repository context. That is expensive in tokens. It is also how you catch classes of bugs that never fire a Semgrep rule.

If your mental model of an AI vulnerability scanner is "chat with a file," this is a different product. If your mental model is "pipeline that emits SARIF with a budget," you are in the right place.

False positives still need a human

Industry writing in 2025-2026 is blunt: raw model dumps flag half a codebase; hybrid audit passes cut noise; developers mute tools above ~10-15% false positives.

So this template is not lights-out auto-remediation.

The operator skill forces:

• --dry-run before real spend
• --max-cost on exploratory scans
• SARIF as evidence to verify in source
• No auto-merge

If you want a bot that opens "fix" PRs without reading the code, leave now. If you want AppSec-grade process on a microVM, stay.

Undeniable demo (copy-paste)

After fork and login:

export PATH="$HOME/.agents/bin:$PATH"
codecrucible scan ~/.agents/codecrucible/samples/tiny-app --dry-run
export ANTHROPIC_API_KEY=…   # or Claude Code login - never commit the value
codecrucible scan /path/to/repo --provider anthropic \
  --prompts-dir "$HOME/.agents/codecrucible/prompts/default" \
  --output "$HOME/scans/results.sarif" --max-cost 25

Open the SARIF. Jump to the top finding. Confirm or reject. Draft triage only.

That is a claude code security scan that actually produces pipeline artifacts - not a vibes review in a chat window.

Semgrep alternative? Kind of. Not really.

People search semgrep alternative (~30/mo) when rules hurt.

CodeCrucible does not replace your rule engine overnight. It answers a different question: what does the model find when the whole repo fits the context budget? Many teams will keep Semgrep/CodeQL for CI gates and use AI SAST for deep passes. This template is the deep pass, on a box you control, with BYOK spend.

Isolation is separate from scanning

We already write about Claude Code security as runtime isolation (Firecracker microVM vs shared kernel). That is a different search intent.

This post is scanning the application, not securing the agent's host. You still want both: a microVM boundary and an AI vulnerability scanner that does not pretend model output is ground truth.

Pricing honesty

• Plans start on paid jurniti seats (see pricing).
• No free trial. No free tier. First purchase: 30-day money-back.
• Model tokens are your bill (BYOK).
• Dry-run estimates input cost; real scans also bill completions and audit phases.

Who this is for

• AppSec and eng leads hunting an AI SAST path that ends in SARIF
• Teams evaluating LLM-driven whole-repo analysis after reading Block's blueprint
• Claude Code users who want a security scan workflow on a dedicated box

Who this is not for

• Auto-merge security bots
• "Zero token budget" scanners
• Anyone who treats a model finding as a CVE without reading the code

Provenance

• block/codecrucible
• CodeCrucible: A blueprint for LLM-driven SAST
• Demand signal: jack on X
• Keyword volume: DataForSEO US 2026-07-29 (docs/seo/research/2026-07-29-codecrucible-llm-sast-keywords.md)

Fork the template. Run dry-run. Bound the cost. Verify the finding. Ship the fix yourself.