Tree-sitter

Last updated: Oct 28, 2026

Rationale

Tree-sitter is the core library of the Fluid Attacks SAST scanner. It is very important to report to clients the vulnerabilities that static application security testing (SAST) finds.

These are the primary reasons why Fluid Attacks selected it and not other alternatives:

It is open source.
It gives a low-level, grammar-based approach to parsing. This approach gives Fluid Attacks direct access to the concrete syntax tree of each language. Thus, it is very flexible, and it can parse each deterministic language.
Many teams use it to build SAST scanners. Its community confirms it as the foundation for production static analysis tools.
Its community maintains parsers for many programming languages. Thus, it is much less work to add support for a new language.
It has a Python binding that integrates cleanly with the current analysis codebase of Fluid Attacks.
Fluid Attacks can implement custom parsers for languages or grammars that the community does not include at this time. This makes it more flexible.
Performance is a core design goal. Tree-sitter grammars compile to efficient C parsers. Thus, they are as fast as vulnerability scans must be, because scans must end as quickly as possible.
It is the foundation of the internal analysis layer of Fluid Attacks. This layer adds data-flow tracking and cross-file symbol resolution to the raw syntax tree access. Tools that are only syntactic cannot give these functions.

Alternatives

Fluid Attacks examined these alternatives:

Some of these alternatives make pattern authoring faster or give higher-level abstractions. But none of them has the combination of tree-sitter: low-level grammar access, analysis extensibility, and a wide language ecosystem. (a) To change to one of these alternatives, Fluid Attacks would have to replace the current analysis infrastructure that it built on tree-sitter. (b) Each alternative has important trade-offs against the highest-priority evaluation criteria of Fluid Attacks, primarily the data-flow and cross-file analysis. (c) The evaluation of Fluid Attacks confirmed that tree-sitter is the strongest foundation for static analysis components.

Pyparsing

It gives a high-level approach to define syntaxes, but it is less flexible, and flexibility was much more important for Fluid Attacks.
It did not support as many built-in parsers.
Its community was smaller.

ast-grep

It is open source.
It is a Rust-native tool that builds a high-level structural pattern language on tree-sitter. It uses metavariables (for example, $MODEL, and $$$ for variadic arguments) to write call-site patterns directly on the syntax tree.
With it, you can quickly write known structural shapes, for example, client.chat.completions.create(model=$MODEL, $$$), without full grammar rules.
It operates only at the syntactic match level. It cannot find the value of a variable at the point of use, it does not support cross-file symbol resolution, and it does not give access to data-flow or type information.
When a variable keeps a model identifier, ast-grep can find the call site, but it cannot get the value of that variable.
The team does not maintain it. Thus, it adds an external dependency without internal ownership.

ast-grep is good for quick structural searches of known call-site shapes, but it cannot do the analysis depth that the Fluid Attacks SAST scanner must have. The current library of Fluid Attacks, which uses tree-sitter, solves these problems with a better analysis layer, for example, data-flow tracking and cross-file symbol resolution. This layer uses the same underlying grammar, and the team already maintains it.

Usage

Fluid Attacks uses Tree-sitter as a syntax parser for most of its supported languages.