Tools · SPBoucher
Menu

Semgrep

by Semgrep, Inc. · CLI tool · also known as Semgrep Community Edition, Semgrep CE, Semgrep AppSec Platform

Static analysis engine that matches code patterns written in the target language's own syntax, with an LGPL community edition and a commercial AppSec platform

LGPL-2.1-only licenseOpen sourceFreemiumPaidEnterpriseLocalCloudSelf-hostable
Visit official site Compare

Link verified Nov 2, 2026

Overview

Semgrep is a static analysis tool from Semgrep, Inc. Its engine, released as Semgrep Community Edition under LGPL-2.1, lets users write rules as code snippets with metavariables and ellipses in the syntax of the language being analyzed, rather than in an abstract query language, and supports dozens of languages including Python, JavaScript and TypeScript, Go, Java, Rust, Swift and infrastructure formats. A public registry supplies thousands of rules for security, correctness and style, runnable locally with semgrep --config.

The commercial Semgrep AppSec Platform builds on the engine with cross-file and cross-function dataflow analysis, proprietary Pro rules, software composition analysis of dependencies, secrets detection, and a hosted dashboard that tracks findings across repositories and posts them into pull requests. A free tier of the platform exists for small teams.

In the community edition analysis is largely intra-file, so some taint-tracking findings are only available in the paid product. The rule-writing model is easy to start with but false positives require tuning, and a 2024 licensing change to the rules registry led to a community fork, Opengrep.

Capabilities

  • Pattern-based rules written in the target language with metavariables
  • Support for many programming languages and configuration formats
  • Public rule registry and custom rule authoring
  • CI integration and SARIF output
  • Pro engine with interfile dataflow, SCA and secrets detection (commercial)
  • Hosted dashboard and pull-request comments (commercial)

Typical workflows

  1. Run security rules in CI on every pull request
  2. Write a custom rule to ban a deprecated API in a codebase
  3. Scan dependencies and secrets from the AppSec Platform

Strengths

  • Rules read like the code they match
  • Fast local scans without building the project
  • Large public rule registry

Limitations

  • Deeper interfile analysis reserved for the paid engine
  • False positives require rule tuning
  • Rules registry licensing has shifted; verify terms before redistribution

Prerequisites

  • Python or a standalone binary; optional Semgrep account for the platform

Who it is for

  • Application security engineers
  • Developers adding static checks to CI

Alternatives & comparison

Trivy focuses on vulnerabilities in dependencies, container images and infrastructure configuration rather than on patterns in first-party source code; the two are complementary in a CI pipeline.

  • Trivy

    Open-source scanner that finds known vulnerabilities, misconfigurations, exposed secrets and license issues in container images, file systems, git repositories, IaC and Kubernetes clusters

    Open sourceOpen source

Sources & verification

Primary sources consulted for this record. Claims are tied to the fields each source supports; the automated link checker re-verifies every URL on a schedule.

  • License
    Semgrep LICENSE (LGPL-2.1)

    https://github.com/semgrep/semgrep/blob/develop/LICENSE

    Supports: license_spdx, source_model

    checked Nov 1, 2026
  • Official documentation
    Semgrep Documentation

    https://docs.semgrep.dev/

    Supports: capabilities, languages, workflows

    checked Nov 1, 2026
  • Official site
    Semgrep AppSec Platform

    https://semgrep.dev/

    Supports: name, summary, capabilities

    checked Nov 1, 2026
  • Pricing page
    Semgrep Pricing

    https://semgrep.dev/pricing

    Supports: pricing_model

    checked Nov 1, 2026
Confidence
High
Reviewed
Nov 1, 2026
Links
Verified · Nov 2, 2026

Spotted an error?

Broken link, outdated license, wrong category, or a tool that no longer exists? Tell us; reports are reviewed by the editor.

Cloudflare

Cloudflare, Inc. · DNS & domains

Global network offering authoritative DNS, CDN and reverse-proxy security, a domain registrar, Zero Trust access and the Workers serverless platform

ProprietaryFreemiumPaidNov 2, 2026

Fail2Ban

Fail2Ban project · Security tools

Log-scanning intrusion-prevention daemon that temporarily bans IP addresses showing repeated authentication failures by updating firewall rules

GPL-2.0-or-laterOpen sourceFreeSelf-hostedNov 2, 2026

CrowdSec

CrowdSec · Security tools

Open-source behavior-based intrusion prevention engine whose detections feed a crowd-sourced IP reputation network, with remediation components for firewalls, proxies and CDNs

MITOpen sourceFreemiumSelf-hostedNov 2, 2026

promptfoo

Promptfoo, Inc. · Prompting, evaluation & observability

Open-source, local-first CLI and library for evaluating prompts, models, RAG pipelines and agents, with automated red teaming and CI integration

MITOpen sourceFreeLocalSelf-hostedBroken