DongTai IAST

DongTai IAST is an open-source application security tool that analyzes application traffic at runtime. It is best suited to teams building security checks into development and release workflows, especially Java teams able to operate their own service. Its main appeal is a free self-hosted option; its non-Java agents are beta.

Overview

DongTai uses application test traffic instead of running dedicated attack tests. An agent collects web application traffic and sends it to the server, whose engine analyzes HTTP, HTTPS, and RPC requests using method-call data and taint tracking. This can fold security analysis into testing already in progress, but findings depend on the application being exercised by traffic.

The workflow aims to make results actionable through automated vulnerability verification, risk prioritization, tracing to code locations, and detailed reports. Detection includes application vulnerabilities, open-source component vulnerabilities, sensitive information, and hardcoded information. API support is intended to connect findings with DevSecOps workflows.

Key features

• Passive IAST: Analysis of test traffic avoids a separate attack-testing run, which suits teams wanting runtime feedback during development or before release. It is not a substitute for exercising application paths that need coverage.
• Language coverage: Documentation names Java, Python, PHP, and Go. Java is the safer target: Python, PHP, and Go agents are beta, and community-maintained beta agents are not guaranteed to deploy successfully.
• Server and reporting: The server includes user management, project management, vulnerability analysis and reports, notifications, a Web API, and custom vulnerability rules. Full reports are available through the management server, making this a better fit for teams prepared to run and manage the service.
• IDE and deployment: An IntelliJ IDEA plugin can run the Java probe and detect vulnerabilities in the IDE. DongTai supports SaaS and localized deployment, with Docker Compose for standalone installation and Kubernetes for cluster deployment.

Pricing

The Open-source self-hosted deployment plan costs free. It supports Docker Compose single-node installation or Kubernetes cluster deployment, so teams can choose a deployment scale without a license charge. The tradeoff is operating the service themselves; the base image includes MySQL and Redis.

DongTai is open source under Apache-2.0. For commercial deployment, the user running iastctl needs sudo privileges, and versions below 1.13.0 are incompatible unless upgraded manually. The project supports security updates for versions 1.8.5 and later.

Platforms

DongTai supports API, Linux, self-hosted, and web environments. Its runtime target is web, with API testing and agent-based instrumentation. Teams should account for the self-hosting and deployment requirements when deciding whether it fits their environment.

Who it's for

DongTai fits development and security teams that want to analyze application behavior during testing, integrate findings into DevSecOps, or investigate vulnerabilities in open-source software. Java teams have the strongest basis for adoption. Teams targeting Python, PHP, or Go should treat agent deployment as a beta-level commitment, while organizations wanting dedicated attack tests should look elsewhere.

Pros and cons

• Pro: The self-hosted plan is free and supports both single-node Docker Compose and Kubernetes cluster deployment, giving teams deployment choices without a license fee.
• Pro: Risk prioritization, verification, tracing, reports, and API support give teams ways to move from runtime findings toward remediation and pipeline integration.
• Con: Python, PHP, and Go agents are beta, with no guarantee of successful deployment for community-maintained agents.
• Con: Passive analysis relies on application test traffic, so unexercised behavior will not be covered by that traffic.
• Con: Self-hosting entails operating the server and its included MySQL and Redis services; commercial iastctl deployment also requires sudo privileges.

Alternatives

For a free developer-oriented option with a defined small-team allowance, consider Aikido CSPM: its free Developer plan lasts forever, includes two users, and caps repositories, container images, domains, cloud accounts, and monthly AI AutoFixes.

HCL AppScan is worth considering for a downloadable on-prem GitHub extension with a SAST scanner and support for more than 35 languages; its CodeSweep plan is free, and a free trial is also offered.

Choose Waratek IAST if a trial of full IAST runtime analysis for one application per organization better suits your evaluation, with the option to convert it to a purchase order.

New Relic IAST may suit teams looking for a free plan with 100 GB of monthly data ingest, one full platform user, and unlimited basic users.

Contrast Assess is another paid alternative for teams comparing application security testing tools.

Veracode DAST is a paid option for web applications and APIs, with a free trial and live-demo route.

NowSecure Platform is a paid alternative with pricing by demo or order form.

Acunetix may fit buyers looking for a paid pentest option: its Agentic Pentest is priced at $500, paid once for a single application and its API suite, with audit-ready PDF reports and delivery within 24 hours.

Browse the Interactive Application Security Testing Software category to compare more options.

Verdict

Choose DongTai if you want a free, open-source way to analyze runtime test traffic and can manage a self-hosted service, particularly for Java applications. Its reporting, API, and deployment choices support development and release workflows; look elsewhere if you need dedicated attack testing or dependable non-Java agents today.