nemealabs/Arbiter SAST Triage by NemeaLabs
AI-powered SAST triage with reachability analysis. Pass any SARIF file, get true/false positive verdicts on every PR.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| mode | Run mode: pr or backlog | no | pr |
| target | Path to scan (default: repo root) | no | . |
| github-token | GitHub token. PR mode needs pull-requests:write. Backlog mode needs security-events:read (add security-events:write to dismiss FPs). | yes | — |
| github-repo | Repository as owner/repo (defaults to current repo) | no | ${{ github.repository }} |
| anthropic-api-key | Anthropic API key | no | — |
| triage-provider | LLM provider: anthropic (default), azure (Azure AI Foundry), azure-openai (Azure OpenAI Service), or openai (any OpenAI-compatible endpoint e.g. GitHub Models) | no | anthropic |
| anthropic-model | Anthropic model override | no | — |
| azure-ai-endpoint | Azure AI Foundry endpoint | no | — |
| azure-ai-api-key | Azure AI API key | no | — |
| azure-ai-model | Azure AI model/deployment name | no | — |
| azure-ai-api-version | Azure AI API version | no | — |
| baseline | Base commit SHA to diff against (PR mode) | no | — |
| scanners | Comma-separated scanner integrations: github-code-scanning (alias: codeql) — fetch alerts from GitHub Code Scanning API. Omit when passing sarif-file/sarif-dir. | no | "" |
| sarif-file | Path to a SARIF output file to triage (any SAST tool: Trivy, Bandit, Snyk, Checkov, gosec, ESLint, etc.) | no | — |
| sarif-dir | Directory containing *.sarif files to triage | no | — |
| github-ref | PR head ref for CodeQL alert lookup (e.g. refs/pull/N/head) | no | — |
| fail-on | Exit nonzero to block the merge when: any-tp = any true positive found; high-tp = true positive with high/critical severity and confidence ≥ 0.8 | no | — |
| skip-alerts | Comma-separated CodeQL alert numbers to skip (already triaged) | no | "" |
| dismiss-fps | Auto-dismiss AI-confirmed false positive alerts (requires security-events:write) | no | false |
| out | Output report file prefix (produces <prefix>.md and <prefix>.json) | no | arbiter-report |
| no-reachability | Skip the Phase 3 reachability analysis pass | no | false |
| concurrency | Number of parallel LLM triage calls | no | 4 |
Outputs
| name | description |
|---|---|
| report-md | Path to the generated Markdown report |
| report-json | Path to the generated JSON report |
| exit-code | Arbiter exit code (0 = pass, 1 = fail-on gate triggered) |