SARIF
Also called: Static Analysis Results Interchange Format
A standard JSON format for reporting static-analysis and security-scan findings, letting different tools feed the same dashboards and workflows.
SARIF is an OASIS standard. A scanner emits results — rule id, location, severity, message — as SARIF, and any consumer that understands SARIF (code-review UIs, CI gates, aggregation platforms) can display and act on them without custom parsing.
Why it matters
As MCP and agent scanners proliferate, SARIF output is what lets their findings land in the same place as everything else in a security program, rather than living in one tool's console. When evaluating an MCP scanning tool, SARIF support is a practical sign it is built to fit existing workflows.
Exposure map
Live counts of instances showing this pattern will appear here once the exposure map is collecting data.