Overview

Atmos is an application security scanner for code written by people and by coding agents. One command checks your code and your dependencies.

What Atmos does#

Code analysis (SAST). Untrusted input enters in one file and the dangerous call may sit in another. Atmos follows the input across every file and reports each step of the path with file and line, so a finding tells you where to fix it. See how Atmos works.

Dependencies (SCA). A version match against the advisory database only says a vulnerable package is installed, but Atmos also checks whether your code imports the package and, when the advisory names the function, whether your code calls it. See the reachability ladder.

Rules you control. The Managed Ruleset arrives with every scan, and your own YAML rules in .atmos/rules/ load with it. See custom rules and language support.

Fast enough for every save. A rescan after an edit rechecks only what changed and finishes in under a second, so the same scan runs on save in the editor, after every agent turn and on every push. See warm scans.

Start here#

Go deeper#