Skip to content
SPECIFICTION
Get listed

Microsoft DevSkim

github.com

Free plan WindowsmacOSLinuxAPISelf-hostedBrowser extension
Visit github.com
Spec score 7.9 #12 of 25 in Static Application Security Testing Software

What it is

Microsoft DevSkim is a free, MIT-licensed toolkit for security linting and static source-code analysis. It provides IDE extensions, language analyzers, and rules to help developers identify and address security vulnerabilities early. It includes built-in rules and allows teams to write their own using JSONPath, XPath, and YmlPath. Listed language support includes C, C++, C#, Cobol, Go, Java, JavaScript/TypeScript, and Python, among others. Its cross-platform .NET CLI analyzes files and directories and can be installed as a global tool or obtained as binaries for Windows, macOS, and Linux. A C# library is also available for embedding analysis in other tools. Results can be emitted as SARIF, JSON, or text; the CLI can apply suggested fixes from SARIF results and add suppression comments. The project lists extensions for Visual Studio Code and Visual Studio, and supports CI/CD in self-hosted environments. Support is limited to GitHub issues and project wiki resources. Vulnerability reports should be sent privately to Microsoft's Security Response Center rather than posted publicly.

Spec sheet

Purpose
DevSkim provides IDE plugins, language analyzers, and rules for security linting and static source-code analysis.Read 12 Oct 2026 · github.com
Intended users
The project describes its goal as helping developers identify and fix security vulnerabilities early and build security awareness.Read 12 Oct 2026 · github.com
Free plan
YesRead 22 Sep 2026 · github.com
Support
Support is limited to GitHub issues and the project wiki resources listed in its support policy.Read 12 Oct 2026 · github.com
License
DevSkim is licensed under the MIT License.Read 12 Oct 2026 · github.com
CLI
The cross-platform .NET CLI analyzes files and directories and can be installed as a .NET global tool or downloaded as platform-specific binaries for Windows, macOS, and Linux.Read 12 Oct 2026 · github.com
Fixes and suppressions
The CLI can apply suggested fixes from SARIF results and add suppression comments for reported issues.Read 12 Oct 2026 · github.com
IDE integrations
The repository lists DevSkim extensions for Visual Studio Code and Visual Studio.Read 12 Oct 2026 · github.com
Languages
Its listed language support includes C, C++, C#, Cobol, Go, Java, JavaScript/TypeScript, and Python, among others.Read 12 Oct 2026 · github.com
Library
A C# library is available for embedding DevSkim analysis in other tools, with the package published on NuGet.Read 12 Oct 2026 · github.com
Output formats
The tool supports SARIF, JSON, and text output formats.Read 12 Oct 2026 · github.com
Rule formats
Rules can use JSONPath, XPath, and YmlPath.Read 12 Oct 2026 · github.com
Rules
It includes built-in rules and supports writing custom rules.Read 12 Oct 2026 · github.com
Security reporting
The project asks users to report vulnerabilities privately to Microsoft's Security Response Center rather than through public GitHub issues.Read 12 Oct 2026 · github.com

Plans and prices

DevSkim Free MIT-licensed open-source library, CLI, and IDE extensions Read 12 Oct 2026 · github.com

Every Microsoft DevSkim plan and price →

Strong points and limits

Strong points

  • Free and licensed under MIT.
  • Includes built-in rules and supports custom rules.
  • CLI supports SARIF, JSON, and text output.
  • Can apply suggested fixes from SARIF results.
  • Supports Windows, macOS, and Linux.

Limits

  • Support is limited to GitHub issues and project wiki resources.
  • Vulnerability reports should be sent privately, not through public issues.

Who it suits

DevSkim is for developers who want to identify and address security issues early in source code. Its CLI, IDE extensions, library, and custom rules support different development workflows.

Verdict

DevSkim offers source analysis through a CLI, IDE extensions, and an embeddable C# library, with configurable rules and several output formats. Its support options are limited, and vulnerability reports have a private reporting route.

Where Specifiction places it

Alternatives to Microsoft DevSkimAll alternatives →