Static Analysis Results
Interchange Format

SARIF — the Static Analysis Results Interchange Format — is a JSON format for the output of static analysis tools. It exists so that a linter, a compiler, a SAST scanner and a dependency auditor can all emit their findings in one shape, and so that a single viewer, dashboard or CI gate can read all of them without knowing which tool produced the file.

SARIF is an OASIS Open standard. Version 2.1.0 was approved as an OASIS Standard on 27 March 2020, and the current published text is SARIF Version 2.1.0 plus Errata 01, dated 28 August 2023. Everything on this site refers to that version.

{
  "version": "2.1.0",
  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "ExampleScanner",
          "informationUri": "https://example.com/scanner",
          "rules": [
            {
              "id": "EX1001",
              "shortDescription": { "text": "Unused local variable." }
            }
          ]
        }
      },
      "results": [
        {
          "ruleId": "EX1001",
          "level": "warning",
          "message": { "text": "The local variable 'count' is never read." },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": { "uri": "src/parser.c" },
                "region": { "startLine": 42, "startColumn": 7 }
              }
            }
          ]
        }
      ]
    }
  ]
}

That is a complete, valid SARIF log. The only property the specification requires on a result is message; everything else — rule identity, severity, location, fingerprints, fix suggestions — is optional and additive. See the result object for the full property set.

Specification and documentation

The normative text is published by OASIS and is free to read.

Tools and libraries

Libraries for producing, consuming and checking SARIF files. These are third-party projects; this site does not maintain any of them.

Viewers

SARIF is JSON, so any text editor will open it. These render it as findings instead.