# Install rats with Homebrew, dnf, MacPorts Rough auditing tool for security. Version 2.4 via Homebrew; verified from local package data. Also installable with dnf: sudo dnf install rats. ## Install ```sh sudo av install brew:rats ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install rats ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install rats ``` Evidence: MacPorts ports tree: security/rats/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - dnf (92%): ```sh sudo dnf install rats ``` Evidence: Fedora Rawhide package metadata: rats from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst ## Package facts - **Package key:** brew:rats - **Package manager:** Homebrew - **Package manager page:** - **Version:** 2.4 - **Source summary:** Rough auditing tool for security - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** GPL-2.0-or-later - **Source archive:** - **Generated:** 2026-07-25T07:20:51+00:00 ## Executables - rats (cli) - rats (alias) ## Uses from macOS - expat ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_big_sur, arm64_linux, arm64_monterey, arm64_sequoia, arm64_sonoma, arm64_tahoe, arm64_ventura, big_sur, catalina, monterey, sonoma, ventura ## Freshness - Page generated: 2026-07-25 - Package-manager version: 2.4 - Local data: ok - Upstream repository: https://security.web.cern.ch/security/recommendations/en/codetools/rats.shtml - info: No package-manager update timestamp was available. - info: Release/tag comparison is only available for GitHub repositories. ## Project history and usage RATS, the Rough Auditing Tool for Security, is a command-line static analysis scanner for finding common security-sensitive programming patterns in source code. ### Project history The official README says RATS was developed, maintained, and distributed by Secure Software, Inc. The 2.4 source archive describes it as a scanner for C, C++, Perl, PHP, Python, and Ruby source that flags issues such as buffer overflows and TOCTOU race conditions. ### Adoption history RATS circulated as a small Unix security-auditing utility through source archives and package managers. Homebrew, Debian-derived manpage packaging, Fedora, MacPorts, and other Unix package collections carried it as a lightweight source-code auditing tool. ### How it is used Users run rats against files or directories and can select vulnerability databases with -d, force a language with -l, choose warning levels, recurse through directories, and emit text, XML, or HTML reports. ### Why package nerds care Package maintainers care about RATS because it is an old-style security CLI: small C code, autoconf build, XML vulnerability databases, and a package surface that exposes static-analysis behavior without a large framework. ### Timeline - 2001: The bundled manpage date records RATS documentation in September 2001. - 2.4: Homebrew packages the Google Code archive release as the stable version. ### Related projects - The README notes Expat as a build/runtime requirement and credits Ben Laurie for OpenSSL-specific database contributions. ### Sources - Google Code Archive: official rough-auditing-tool-for-security project and source download. - Homebrew formula metadata for rats stable 2.4. - RATS 2.4 README and rats.1 from the official Google Code archive tarball. ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** rats - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Other Package-Manager Records - dnf - rats - 2.4-31.fc44: normalized package name match | Fedora Rawhide package metadata: rats from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Rough Auditing Tool for Security | https://code.google.com/p/rough-auditing-tool-for-security/ - MacPorts - rats: normalized package name match | MacPorts ports tree: security/rats/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ## Related links - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Developer build packages](https://www.automicvault.com/pkg/developer-build-tools/) - Matched build, compiler, generator, or developer workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://www.automicvault.com/pkg/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [caracal](https://www.automicvault.com/pkg/brew/caracal/) - Shares av.db curated category or tags: cli, security, static-analysis. - [cargo-geiger](https://www.automicvault.com/pkg/brew/cargo-geiger/) - Shares av.db curated category or tags: cli, security, static-analysis. - [slither-analyzer](https://www.automicvault.com/pkg/brew/slither-analyzer/) - Shares av.db curated category or tags: cli, security, static-analysis. - [gixy](https://www.automicvault.com/pkg/brew/gixy/) - Shares av.db curated category or tags: cli, security, security-scanner, static-analysis. - [noir](https://www.automicvault.com/pkg/brew/noir/) - Shares av.db curated category or tags: cli, security, static-analysis. - [apkleaks](https://www.automicvault.com/pkg/brew/apkleaks/) - Shares av.db curated category or tags: cli, security, static-analysis. - [authz0](https://www.automicvault.com/pkg/brew/authz0/) - Shares av.db curated category or tags: cli, security, security-scanner. - [bandit](https://www.automicvault.com/pkg/brew/bandit/) - Shares av.db curated category or tags: cli, security, static-analysis. - [cifer](https://www.automicvault.com/pkg/brew/cifer/) - Security-sensitive metadata or terminology overlaps. Shared terms: cli, code, security. ## Combined YAML source View the package source record on GitHub. [combined/rats.yml](https://github.com/automic-vault/db/blob/main/combined/rats.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph