> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/supported-languages-and-frameworks.md).
# Supported Languages and Frameworks
The following is the overview of supported languages across different OX Security categories:
* [Code security](#code-security-support)
* [Open Source Security & SBOM](#sca-and-sbom-support)
* [API BOM](#api-bom-support)
* [Infrastructure](#infrastructure-as-code-support)
## Code Security Support
OX supports static code analysis for the following programming languages.
| Language | Code Scanning | AI Fix Support |
| --------------------------- | ------------- | -------------- |
| **Python** | Yes | Yes |
| **JavaScript / TypeScript** | Yes | Yes |
| **Java** | Yes | Yes |
| **C#** | Yes | Yes |
| **PHP** | Yes | No |
| **Swift** | Yes | No |
| **Go** | Yes | No |
| **Rust** | Yes | No |
| **Dart** | Yes | No |
| **Ruby** | Yes | No |
| **C / C++** | Yes | No |
| **Scala** | Yes | No |
| **Kotlin** | Yes | No |
| **COBOL** | Yes | No |
| **Visual Basic .NET** | Yes | No |
| **Clojure** | Yes | No |
| **R** | Yes | No |
| **Apex** | Yes | No |
## SCA & SBOM Support
OX supports Software Composition Analysis (SCA) and Software Bill of Materials (SBOM) generation for the following package manager files.
| Language | Package
Manager
| License
Scanning
| Vulnerability
Scan
| Dependency
Graph
| Reachability
Analysis
| Pull Request
Fix
| Private Dependency
Scanning
| Dependency
Confusion
| Deprecated
Dependencies
| Malicious
Dependencies
|
| ----------------------- | ------------------------- | -------------------------- | ---------------------------- | -------------------------- | ------------------------------- | -------------------------- | ------------------------------------- | ------------------------------ | --------------------------------- | -------------------------------- |
| **JavaScript** | `npm` | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| | `yarn` | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| | `pnpm` | Yes | Yes | Yes | Yes | Yes | Yes | No | Yes | Yes |
| | `bun` | Yes | Yes | Yes | Yes | | | | | |
| **Python** | `pip` | Yes | Yes | Yes | Yes | Yes | No | Yes | No | Yes |
| | `Poetry` | Yes | Yes | Yes | Yes | Yes | No | No | No | Yes |
| | `Pipenv` | Yes | Yes | Yes | Yes | Yes | No | No | No | Yes |
| | `uv` | Yes | Yes | Yes | Yes | Yes | No | No | No | Yes |
| | `PDM` | Yes | Yes | Yes | Yes | | | | | |
| **Java** | `Maven` | Yes | Yes | Yes | Yes | Yes | Yes | No | No | Yes |
| | `Gradle` | Yes | Yes | Yes | Yes | Yes | Yes | No | No | Yes |
| **Scala** | `SBT` | Yes | Yes | Yes | Yes | No | No | No | No | Yes |
| | `Maven` | Yes | Yes | Yes | Yes | Yes | Yes | No | No | Yes |
| | `Gradle` | Yes | Yes | Yes | Yes | Yes | Yes | No | No | Yes |
| **Kotlin** | `Maven` | Yes | Yes | Yes | Yes | Yes | Yes | No | No | Yes |
| | `Gradle` | Yes | Yes | Yes | Yes | Yes | Yes | No | No | Yes |
| **Objective-C / Swift** | `CocoaPods` | Yes | Yes | Yes | Yes | No | No | No | No | No |
| | `SwiftPM` | Yes | Yes | Yes | Yes | Yes | No | No | No | No |
| | `XcodeGen` | Yes | Yes | Yes | Yes | Yes | No | No | No | No |
| **Go** | `Go Modules` | Yes | Yes | Yes | Yes | Yes | No | No | No | Yes |
| **Dart** | `Dart` | Yes | Yes | Yes | Yes | | | | | |
| **Rust** | `Rust` | Yes | Yes | Yes | Yes | | | | | |
| **Ruby** | `RubyGems` | Yes | Yes | Yes | Yes | No | No | No | No | Yes |
| **C#** | `NuGet` | Yes | Yes | Yes | Yes | Yes | Yes | No | No | Yes |
| **Visual Basic .NET** | `NuGet` | Yes | Yes | Yes | Yes | | | | | |
| **PHP** | `Cpmposer` | No | Yes | Yes | Yes | Yes | No | No | No | Yes |
| **C/C++** | `Conan` | Yes | Yes | Yes | Yes | Yes | No | No | No | No |
{% hint style="info" %}
**C/C++ note:** Conan dependencies are automatically detected in repositories using `conanfile.txt`, `conanfile.py`, `conan.lock`, `Makefile`, or `build.sh`. Supports Conan v1 and v2 lock file formats.
{% endhint %}
## API BOM Support
OX supports API analysis and detection for specific specifications and frameworks.
| Language | Web framework | API detection | API/Issue correlation¹ |
| ------------------------------ | ------------------------------------ | :-----------: | :--------------------: |
| **OpenAPI specification file** | – | Yes | – |
| **Python** | Flask | Yes | Yes |
| | FastAPI | Yes | Yes |
| | Django | Yes | Yes |
| | Connexion | Yes | Yes |
| | Graphene | Yes | Yes |
| | Tornado | Yes | Yes |
| | Aiohttp | Yes | Yes |
| | Sanic | Yes | Yes |
| | Falcon | Yes | Yes |
| **JavaScript & TypeScript** | Express.js | Yes | Yes |
| | NestJS | Yes | Yes |
| | Koa | Yes | Yes |
| | Apollo GraphQL | Yes | Yes |
| | Fastify | Yes | Yes |
| | Hapi | Yes | Yes |
| **Go** | Gin | Yes | Yes |
| | Echo | Yes | Yes |
| | Chi | Yes | Yes |
| | Fiber | Yes | Yes |
| | Gorilla Mux | Yes | Yes |
| | gqlgen | Yes | Yes |
| | graphql-go | Yes | Yes |
| **Java** | Spring Boot | Yes | Yes |
| | JAX-RS (Quarkus, Jersey, Dropwizard) | Yes | Yes |
| | Micronaut | Yes | Yes |
| **Kotlin** | Spring Boot | Yes | Yes |
| | Ktor | Yes | Yes |
| **Scala** | Spring Boot | Yes | Yes |
| | Play | Yes | Yes |
| **C#** | Microsoft ASP.NET Core MVC | Yes | Yes |
| | ASP.NET Core Minimal APIs | Yes | Yes |
| **Ruby** | Sinatra | Yes | Yes |
| | Rails | Yes | Yes |
| | Grape | Yes | Yes |
| **PHP** | Slim | Yes | Yes |
| | Laravel | Yes | Yes |
| **Rust** | Axum | Yes | Yes |
| | Actix Web | Yes | Yes |
| **Elixir** | Phoenix | Yes | Yes |
## Infrastructure as Code Support
OX detects and supports IaC tools and deployment configurations for the following platforms.
| Tool | Supported Deployments |
| --------------------- | ------------------------------------------- |
| Terraform, Terragrunt | Alibaba, AWS, GCP, Azure, Yandex, OpenStack |
| Helm Chart | Kubernetes |
| Argo Workflows | Kubernetes |
| Bicep | Azure |
| CloudFormation | AWS |
| Dockerfile | Any |
| Kubernetes | Any |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.ox.security/supported-languages-and-frameworks.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.