Skip to main content
Myrqen reads Python as well as JavaScript and TypeScript. Python is newer than the JavaScript support and narrower: routes are modelled for FastAPI and Flask only. You run it the same way, and you do not need Python installed for the static pass.
A project with only requirements.txt (no pyproject.toml) is recognised as its own root, so run the command from the directory that holds the app.

​
What the static pass understands

Data flow follows calls into this project’s own functions and methods, across modules. A route that passes a query value to a helper in another file is reported at the line where the value reaches the sink, attributed to that route. Findings use the same categories, reports, SARIF export and compliance mapping as JavaScript findings. Python rule ids start with py-:
  • Injection and unsafe input: SQL injection, command injection, path traversal, server-side request forgery, template injection, unsafe deserialisation (pickle, yaml.load), open redirect, reflected cross-site scripting.
  • Configuration: hardcoded secrets, debug mode switched on unconditionally, session cookies without HttpOnly, Secure or SameSite.
  • Access control: a route with no identity check beside authenticated siblings, and a record fetched by a caller-chosen id with no ownership check.

​
Starting the app so findings can be verified

Static candidates stay needs review until your agent exercises them against the running application. Myrqen detects how to start a Node app from package.json. For a Python app it usually cannot, so the agent starts it, following the project’s own instructions first. Without instructions:
Use the project’s virtual environment, bind to 127.0.0.1, and do not switch on Flask’s debug mode. Save the command so the next run starts the same way (uvicorn binds to 127.0.0.1:8000 by default):

​
What is not covered

Each of these is also printed in the coverage notes of every report that parsed Python.

​
How well it works

On 62 held-out FastAPI and Flask cases, written by an author who never read the Python engine and scored once, recall was 0.774 and precision 0.923, and 2 of 31 deliberately correct files drew a finding. That corpus has since been read and fixed against, so this is the most recent blind Python figure, not a measurement of the current engine; the next one waits on a new held-out set. Those cases cover only the vulnerability classes the Python engine was built to find. The figure says how well that scope is covered, not how much of a Python application is, so it is not comparable with the JavaScript figure. The figures, and what was missed, are on Benchmark and myrqen.cc/benchmarks. A report with no findings is not evidence that an application is secure.