Use with Semgrep

OAuthLint ships as plain Semgrep rules. If you already have Semgrep installed, you can run the entire pack against your code with a single command. No install, no config file, no account:

semgrep --config https://oauthlint.dev/r/oauthlint.yaml ./src

That URL serves the complete OAuthLint ruleset: every OAuth / OIDC / JWT / session / cookie / CORS / TLS / secrets / MCP server auth anti-pattern we detect, across all ten supported languages, merged into one Semgrep config. Point it at any path (./src, ., a single file) and Semgrep does the rest.

Don’t have Semgrep? pip install semgrep (or brew install semgrep). Prefer zero setup? Use the oauthlint CLI: npx oauthlint scan ./src bundles the pinned rule pack and, on first run, downloads and checksum-verifies its own small pinned scan engine (nothing else to install), reusing an installed opengrep/semgrep if one is on your PATH.

Per-language bundles

If you only care about one language, use the matching subset so Semgrep loads fewer rules:

# Python-only example
semgrep --config https://oauthlint.dev/r/oauthlint-python.yaml ./app

The combined oauthlint.yaml already contains every rule across all languages. Semgrep automatically skips rules whose languages don’t match the files it scans, so the combined config is a safe default for polyglot repos.

Findings link back to the docs

Every rule carries its full metadata (the oauthlint-doc-url, cwe, and owasp tags), so each finding tells you exactly what’s wrong and where to read more. Browse the catalogue at oauthlint.dev/rules, or open the oauthlint-doc-url printed alongside any finding.

Always the latest pack

The hosted configs are regenerated from the current rule pack on every site build, so https://oauthlint.dev/r/oauthlint.yaml always reflects the latest rules. That’s ideal for staying current, but it means the ruleset can change without warning.

If you need a pinned, reproducible ruleset (recommended for CI gates), don’t fetch the URL. Vendor a specific version instead:

• Use the oauthlint CLI: npx oauthlint@<version> scan ./src, which bundles a fixed rule pack.
• Or install the rules package from npm, oauthlint-rules, and point Semgrep at the vendored YAML.

Use it in CI

The one-liner drops straight into any pipeline that has Semgrep available:

# .github/workflows/oauthlint.yml
name: oauthlint
on: [push, pull_request]
jobs:
  semgrep:
    runs-on: ubuntu-latest
    container: semgrep/semgrep
    steps:
      - uses: actions/checkout@v4
      - run: semgrep --config https://oauthlint.dev/r/oauthlint.yaml --error .

For a turnkey CI integration with SARIF upload and severity gating, see the GitHub Action instead.