Semgrep

VS Code and IntelliJ extensions ship with CE; inline markers, hover guidance, Quick Fix button.

Guardian MCP scans inside Claude Code, Codex, Cursor, Copilot, VS Code, Devin/Windsurf, Kiro.

`semgrep scan`/`semgrep ci` CLI plus a pre-commit framework hook; org-wide hook settings need Platform.

Inline PR/MR comments with dataflow traces and reply triage; requires AppSec Platform, CE has none.

Block mode fails CI (exit code 1); remediation policies block merge; developer exception approval flow.

Full scans cover the entire codebase and are recommended on a schedule against the default branch.

Scheduled full scans in CI; Managed Scans default to weekly full scans plus diff-aware scans per PR.

Runtime/exposure context only through Wiz, Sysdig and Cortex integrations; Wiz/Cortex listed as Teams features.

Pattern plus taint rules; intraprocedural in CE, cross-function default, cross-file needs Pro Engine (Teams).

Taint tracking with constant/symbolic propagation; cross-file interfile taint requires Pro Engine and full scans only.

Semgrep Secrets is a separately licensed product ($15/contributor); regex, semantic and entropy analysis; excluded from Free.

Local live API validation classifies valid/invalid across 630+ credential types; part of paid Secrets product.

Semgrep Supply Chain parses lockfiles/manifests for 13 languages; Dynamic Dependency Resolution beta scans without lockfiles.

Five reachability states plus transitivity for 10 languages; Rust version-comparison only; Dart and Elixir unsupported.

Typosquatting and dependency-confusion detection with Malware Firewall blocking; only C#, Go, JavaScript/TypeScript, Python, Ruby, Rust.

License detection with policies to flag or block disallowed licenses; all SCA languages except Dart and Elixir.

Per-repository CycloneDX 1.4, 1.5, 1.6, 1.7 SBOMs in JSON and XML via UI or API.

Dockerfile and YAML appear only as experimental-maturity community-rule languages; no IaC product or Terraform support documented.

Not offered in vendor documentation reviewed as of 2026-09-05.

Not offered in vendor documentation reviewed as of 2026-09-05.

Not offered in vendor documentation reviewed as of 2026-09-05.

File positions Semgrep as an AppSec platform, explicitly "not a general code-quality/code-review tool".

Not documented anywhere across product pages, docs, dashboard, or reports API as of 2026-08-25.

Not documented anywhere across product pages, docs, dashboard, or reports API as of 2026-08-25.

Not documented anywhere across product pages, docs, dashboard, or reports API as of 2026-08-25.

Reports API and Dashboard cover only security findings/backlog metrics; no coverage tracking documented.

Reports API and Dashboard cover only security findings/backlog metrics; no coverage tracking documented.

Unified Policies only govern rule selection and finding remediation, not module/dependency boundaries.

Dashboard and Reports API quantify only security-finding backlog/age, not remediation cost or effort.

Dashboard tracks guardrail adoption, median open age and production-backlog trends; CE has no reporting.

AI detection of IDOR, authorization gaps, workflow abuse; full scans only, all High severity, needs credits.

PR/MR comments summarize findings; Autofix draft PRs carry an AI-written description.

YAML pattern rules in web Editor or locally, tested with ruleid:/ok: annotations; CE includes custom rules.

Rule-defined deterministic fixes commit from the PR; AI remediation guidance and prose fixes need credits.

Autofix opens a draft PR/MR with AI description; requires Multimodal, AI credits and SCM write access.

Autotriage recommends safe-to-ignore with explanation; noise filtering (beta) suppresses likely false positives; consumes credits.

Dashboard project filters can target a monorepo subfolder; no wider monorepo handling documented.

Semgrep Multimodal AI layer for detection, guidance, autotriage, tagging; unavailable on Free (no AI credits).

BYO key for OpenAI, Bedrock, Azure OpenAI, Gemini, xAI; Enterprise; forfeits fine-tuned models and ZDR.

Guardian MCP server; Claude Code uses Semgrep's hosted remote server via OAuth with a fixed ruleset.

Not offered in vendor documentation reviewed as of 2026-09-05.

Reply commands /ignore, /fp, /ar in PR threads and Slack Agree/Disagree buttons; not conversational.

Memories auto-generated from admin triage feedback; autotriage uses the org's triage history; requires Multimodal.

Zero Data Retention agreement with default OpenAI provider; CI/CLI scans upload no code; BYOK loses ZDR.

Timestamped audit logs exportable in JSON covering scans, findings, policy violations and remediation with user attribution.

SAML SSO (Google Workspace, Microsoft Entra ID) plus OIDC and managed GitHub/GitLab auth; listed under Teams.

Admin, Manager, Member roles with team management API and per-user/per-project access; listed under Teams.

Dashboard PDF export plus API reports (backlog, funnel, guardrails, Malware Firewall); CE has no reporting.