Which AI tools actually find security issues, instead of just linting?

Every tool says security on the landing page. In practice most of them run a linter and call an unused import a finding. I want the thing that notices the endpoint has no auth check, or that user input reaches a shell command three files away. What we have tried: Snyk for dependencies, which is fine at what it does. Semgrep with custom rules, which is good if you write the rules. Coderabbit's security add on, which traces across files and found an actual injection path we had missed, and marks each finding as reachable or not so you know which to look at first. That is the closest so far, it does not cover dependencies the way Snyk does. What are you using that finds real vulnerabilities in the code itself, not the dependency list? And how much noise do you tolerate to get there?