Sarif Parsing
Sarif Parsing analyzes codebases using SARIF format for detailed diagnostics and vulnerability identification – crucial for secure development workflows.
Install on your platform
We auto-selected Claude Code based on this skill’s supported platforms.
Run in terminal (recommended)
claude mcp add sarif-parsing npx -- -y @trustedskills/sarif-parsing
Or manually add to ~/.claude/settings.json
{
"mcpServers": {
"sarif-parsing": {
"command": "npx",
"args": [
"-y",
"@trustedskills/sarif-parsing"
]
}
}
}Requires Claude Code (claude CLI). Run claude --version to verify your install.
About This Skill
What it does
This skill enables AI agents to parse and understand SARIF (Static Analysis Results Interchange Format) files. SARIF is a standardized format for communicating results of static analysis, often used in security scanning and code quality tools. The agent can extract key information like vulnerabilities, warnings, and associated code locations from these files. This allows for automated reporting and integration with other workflows.
When to use it
- Security vulnerability triage: Automatically analyze SARIF reports generated by security scanners (e.g., Semgrep, SonarQube) to identify and prioritize critical issues.
- Code quality assessment: Parse SARIF files from code linters or static analysis tools to track trends in code quality over time.
- Compliance reporting: Generate compliance reports based on findings documented in SARIF format.
- Automated remediation suggestions: Extract information about affected code lines and suggest potential fixes based on the analysis results.
Key capabilities
- SARIF file parsing
- Extraction of vulnerability details (severity, description)
- Identification of affected files and line numbers
- Data extraction from SARIF runs
Example prompts
- "Parse this SARIF file and summarize the critical vulnerabilities."
- "Extract all warnings related to SQL injection from this SARIF report."
- "What are the top 5 most frequently reported issues in this SARIF file?"
Tips & gotchas
- Ensure the AI agent has access to valid SARIF files. Incorrectly formatted or corrupted files will lead to parsing errors.
- The level of detail extracted depends on the structure and content within the SARIF file itself.
Tags
TrustedSkills Verification
Unlike other registries that point to live repositories, TrustedSkills pins every skill to a verified commit hash. This protects you from malicious updates — what you install today is exactly what was reviewed and verified.
Security Audits
| Gen Agent Trust Hub | Pass |
| Socket | Pass |
| Snyk | Pass |
🌐 Community
Passed automated security scans.