> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/ai-sca/prezero/static-analysis-sast/analyzing-applications/rust.md).

# Rust (Beta)

Analyzing Rust applications with Qwiet AI by Harness

This article shows you how to analyze applications written in Rust using Qwiet AI by Harness. It assumes that you have already [set up and authenticated](/ai-sca/getting-started/quickstart/setup.md) with Qwiet.

## Requirements <a href="#requirements" id="requirements"></a>

See [Prerequisites](/ai-sca/getting-started/prerequisites.md#language-support-and-requirements) for more information.

## Analyzing your Rust application <a href="#analyzing-your-rust-application" id="analyzing-your-rust-application"></a>

To analyze your Rust application, run:

```bash
sl analyze --app <name> --rust <path>
```

| Parameter      | Description                                                                 |
| -------------- | --------------------------------------------------------------------------- |
| `--app <name>` | The name of the application to be analyzed (maximum length: 100 characters) |
| `--rust`       | The flag identifying the application's language                             |
| `<path>`       | The path to your project                                                    |

See the [CLI reference](/ai-sca/cli/reference/analyze.md) for additional `sl analyze` options.

### Additional parameters <a href="#additional-parameters" id="additional-parameters"></a>

The analysis accepts additional parameters after a double hyphen `--`.

```bash
sl analyze --app <name> --rust <path> -- ...
```

To exclude specific files or directories from the analysis:

```bash
sl analyze --app <name> --rust <path> -- --exclude <path>
```

To exclude files or directories based on a regular expression match:

```bash
sl analyze --app <name> --rust <path> -- --exclude-regex <expression>
```

| Additional parameter | Description                                                                                                                                           |
| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--exclude`          | Exclude files or folders during CPG generation (paths relative to the project directory or absolute paths). Can be specified multiple times.          |
| `--exclude-regex`    | Exclude files or folders whose paths match the given regular expression (matched against paths relative to the project directory)                     |
| `--no-sysroot`       | Skip sysroot loading. Faster, but standard library symbols are not resolved                                                                           |
| `--no-resolve-cfg`   | Do not resolve `#[cfg(...)]` attributes. Conditional compilation is not evaluated, so both enabled and disabled code paths may appear in the analysis |

### Rust toolchain support <a href="#rust-toolchain-support" id="rust-toolchain-support"></a>

The Rust analyzer requires both `rustc` and `cargo` to be installed and available on your `PATH`. Run `sl check-environment --rust` to verify your setup.

By default, the analyzer loads the Rust sysroot to resolve standard library symbols and evaluates `#[cfg(...)]` attributes (for example, feature flags). Use `--no-sysroot` or `--no-resolve-cfg` after the double hyphen when you need faster analysis and can accept reduced type information.

### Scanning for open-source vulnerabilities <a href="#scanning-for-open-source-vulnerabilities" id="scanning-for-open-source-vulnerabilities"></a>

For [SCA](/ai-sca/prezero/oss-vulnerabilities.md), Qwiet looks for `Cargo.toml` and `Cargo.lock` in the project path you provided when running `sl analyze`. If your project has a `Cargo.toml` but no `Cargo.lock`, Qwiet may attempt to generate a lockfile using `cargo generate-lockfile` so transitive dependencies can be included in the scan.

Depending on how your project repo is structured, you may also need to provide an additional configuration option so that Qwiet AI by Harness can identify where your dependencies are located (for example, if you're running `sl analyze` for a package other than `.`, use `--oss-project-dir <project-dir>` to specify the location of the directory where `Cargo.toml` or `Cargo.lock` is located).

### Sample usage <a href="#sample-usage" id="sample-usage"></a>

```bash
sl analyze --app shiftleft-rust-example --rust .
```

## Tagging results with your branch name <a href="#tagging-results-with-your-branch-name" id="tagging-results-with-your-branch-name"></a>

To include the branch name in your Qwiet AI by Harness results, allowing you to distinguish one set of results from another, add the following to your invocation of Qwiet:

```bash
sl analyze --app shiftleft-rust-example --rust --tag branch=`git symbolic-ref --short HEAD` .
```

If you're working in a GitHub environment (e.g., GitHub Actions), you can also use `--tag branch=${{ github.head_ref }}` to populate your branch name.

If you don't provide a branch name, but Qwiet detects one available in your environment, it will use that name.

## Troubleshooting <a href="#troubleshooting" id="troubleshooting"></a>

If you have any issues scanning your project, please see our [general troubleshooting page](/ai-sca/prezero/tutorials/troubleshooting.md).

{% @harness-feedback/feedback %}