Semgrep
Open-source pattern-matching SAST engine plus a commercial AppSec Platform adding SCA, secrets detection, policy governance and AI triage.
Deployment
Cloud · Self-Hosted (partial) · Air-Gapped (partial)
Languages
34+
Pricing model
Per contributing developer, Usage-based credits, Quote-based
Free plan
Yes
Partial means the documentation covers only part of a capability, a related capability, or a beta. The description next to it says what is covered.
Workflow coverage
Where in the development lifecycle Semgrep operates.
7 yes 1 no
| Feature | Availability | Description |
|---|---|---|
| Real-Time IDE Feedback | Yes | VS Code and IntelliJ extensions ship with CE; inline markers, hover guidance, Quick Fix button. |
| AI Agent Guardrails | Yes | Guardian MCP scans inside Claude Code, Codex, Cursor, Copilot, VS Code, Devin/Windsurf, Kiro. |
| Local Analysis (Pre-Commit) | Yes | `semgrep scan`/`semgrep ci` CLI plus a pre-commit framework hook; org-wide hook settings need Platform. |
| Inline PR Comments | Yes | Inline PR/MR comments with dataflow traces and reply triage; requires AppSec Platform, CE has none. |
| Quality Gates (Merge Blocking) | Yes | Block mode fails CI (exit code 1); remediation policies block merge; developer exception approval flow. |
| Full Repo Scan | Yes | Full scans cover the entire codebase and are recommended on a schedule against the default branch. |
| Scheduled Rescans | Yes | Scheduled full scans in CI; Managed Scans default to weekly full scans plus diff-aware scans per PR. |
| Runtime Monitoring | No | Runtime/exposure context only through Wiz, Sysdig and Cortex integrations; Wiz/Cortex listed as Teams features. |
Security scanning
9 yes 1 partial 3 no
| Feature | Availability | Description |
|---|---|---|
| SAST | Yes | Pattern plus taint rules; intraprocedural in CE, cross-function default, cross-file needs Pro Engine (Teams). |
| Taint Analysis (Data-Flow) | Yes | Taint tracking with constant/symbolic propagation; cross-file interfile taint requires Pro Engine and full scans only. |
| Secrets Detection | Yes | Semgrep Secrets is a separately licensed product ($15/contributor); regex, semantic and entropy analysis; excluded from Free. |
| Secrets Validation | Yes | Local live API validation classifies valid/invalid across 630+ credential types; part of paid Secrets product. |
| SCA | Yes | Semgrep Supply Chain parses lockfiles/manifests for 13 languages; Dynamic Dependency Resolution beta scans without lockfiles. |
| Reachability Analysis | Yes | Five reachability states plus transitivity for 10 languages; Rust version-comparison only; Dart and Elixir unsupported. |
| Malicious Package Detection | Yes | Typosquatting and dependency-confusion detection with Malware Firewall blocking; only C#, Go, JavaScript/TypeScript, Python, Ruby, Rust. |
| License Compliance | Yes | License detection with policies to flag or block disallowed licenses; all SCA languages except Dart and Elixir. |
| SBOM Generation | Yes | Per-repository CycloneDX 1.4, 1.5, 1.6, 1.7 SBOMs in JSON and XML via UI or API. |
| IaC Scanning | Partial | Dockerfile and YAML appear only as experimental-maturity community-rule languages; no IaC product or Terraform support documented. |
| Container Scanning | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| CSPM | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| DAST | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
Code quality
1 partial 8 no
| Feature | Availability | Description |
|---|---|---|
| Code Smell Detection | No | File positions Semgrep as an AppSec platform, explicitly "not a general code-quality/code-review tool". |
| Complexity Metrics | No | Not documented anywhere across product pages, docs, dashboard, or reports API as of 2026-08-25. |
| Duplication Detection | No | Not documented anywhere across product pages, docs, dashboard, or reports API as of 2026-08-25. |
| Dead Code Detection | No | Not documented anywhere across product pages, docs, dashboard, or reports API as of 2026-08-25. |
| Test Coverage Tracking | No | Reports API and Dashboard cover only security findings/backlog metrics; no coverage tracking documented. |
| Diff Coverage (New Code) | No | Reports API and Dashboard cover only security findings/backlog metrics; no coverage tracking documented. |
| Architecture Governance | No | Unified Policies only govern rule selection and finding remediation, not module/dependency boundaries. |
| Technical Debt Quantification | No | Dashboard and Reports API quantify only security-finding backlog/age, not remediation cost or effort. |
| Behavioral Code Analysis | Partial | Dashboard tracks guardrail adoption, median open age and production-backlog trends; CE has no reporting. |
AI review & fixes
4 yes 1 partial
| Feature | Availability | Description |
|---|---|---|
| AI Logic Bug Detection | Yes | AI detection of IDOR, authorization gaps, workflow abuse; full scans only, all High severity, needs credits. |
| PR Summaries & Walkthroughs | Partial | PR/MR comments summarize findings; Autofix draft PRs carry an AI-written description. |
| Autofix Suggestions | Yes | Rule-defined deterministic fixes commit from the PR; AI remediation guidance and prose fixes need credits. |
| Autofix Pull Requests | Yes | Autofix opens a draft PR/MR with AI description; requires Multimodal, AI credits and SCM write access. |
| AI Triage (False-Positive Filtering) | Yes | Autotriage recommends safe-to-ignore with explanation; noise filtering (beta) suppresses likely false positives; consumes credits. |
Rules & repo support
1 yes 1 partial
| Feature | Availability | Description |
|---|---|---|
| Custom Rule Authoring | Yes | YAML pattern rules in web Editor or locally, tested with ruleid:/ok: annotations; CE includes custom rules. |
| Monorepo Support | Partial | Dashboard project filters can target a monorepo subfolder; no wider monorepo handling documented. |
AI capabilities
5 yes 1 partial 1 no
| Feature | Availability | Description |
|---|---|---|
| AI Code Review | Yes | Semgrep Multimodal AI layer for detection, guidance, autotriage, tagging; unavailable on Free (no AI credits). |
| Bring Your Own Model | Yes | BYO key for OpenAI, Bedrock, Azure OpenAI, Gemini, xAI; Enterprise; forfeits fine-tuned models and ZDR. |
| MCP Server | Yes | Guardian MCP server; Claude Code uses Semgrep's hosted remote server via OAuth with a fixed ruleset. |
| AI Code Governance | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Conversational Review | Partial | Reply commands /ignore, /fp, /ar in PR threads and Slack Agree/Disagree buttons; not conversational. |
| Learning From Feedback | Yes | Memories auto-generated from admin triage feedback; autotriage uses the org's triage history; requires Multimodal. |
| Code Excluded From Training | Yes | Zero Data Retention agreement with default OpenAI provider; CI/CLI scans upload no code; BYOK loses ZDR. |
Models used
OpenAI (default provider, Semgrep-held keys, Zero Data Retention agreement)Amazon Bedrock (default provider)Anthropic Claude models via Amazon Bedrock (Autofix)Azure OpenAI (BYOK only)Google Gemini (BYOK only)xAI (BYOK only)
Compliance & governance
4 yes
| Feature | Availability | Description |
|---|---|---|
| Audit Logs | Yes | Timestamped audit logs exportable in JSON covering scans, findings, policy violations and remediation with user attribution. |
| SSO (SAML) | Yes | SAML SSO (Google Workspace, Microsoft Entra ID) plus OIDC and managed GitHub/GitLab auth; listed under Teams. |
| Role-Based Access Control | Yes | Admin, Manager, Member roles with team management API and per-user/per-project access; listed under Teams. |
| Compliance Reporting & Exports | Yes | Dashboard PDF export plus API reports (backlog, funnel, guardrails, Malware Firewall); CE has no reporting. |
Standards mapping
FedRAMP (NIST SP 800-53 Rev 5: RA-5, IA-5, SA-11, AU-2/AU-3, SI-2, SI-3, SA-15/SR-3)NIST 800-171 (3.14.1, 3.5.10, 3.3.1, 3.4.7)HIPAA Technical/Administrative SafeguardsHITRUST CSF v11GDPRPCI DSS (Requirements 6.2, 6.3.1, 6.3.2)ISO 27001 Annex A (A.8.8, A.8.9, A.8.25-A.8.32, A.5.19-A.5.23)ISO 27017SOC 2 Type II Trust Services Criteria (CC6.1, CC6.6, CC7.2, CC7.3, CC8.1, CC9.1)OWASP (rule registry categories and cheat sheets)Executive Order 14028 / OMB M-22-18 (SBOM)CycloneDX 1.4-1.7
Integrations
9 yes 1 partial
| Git provider | Availability |
|---|---|
| GitHub | Yes |
| GitHub Enterprise Server | Yes |
| GitLab | Yes |
| GitLab Self-Managed | Yes |
| Bitbucket | Yes |
| Bitbucket Data Center | Yes |
| Azure DevOps | Yes |
| API & CLI | Availability |
|---|---|
| REST API | Partial |
| CLI | Yes |
| Webhooks | Yes |
CI/CD systems
GitHub ActionsGitLab CI/CDJenkinsBitbucket PipelinesCircleCIBuildkiteAzure PipelinesSemaphoreAppVeyorBambooBitriseBuildbotCodeshipCodefreshDrone CINomadTeamCity CITravis CIself-hosted CI runners
IDEs
Visual Studio CodeIntelliJ / JetBrains IDEsCursor (via Guardian MCP)Windsurf (via Guardian MCP)Kiro (via Guardian MCP)
Issue trackers
Jira Cloud (Jira Data Center explicitly not supported)
Chat & notifications
Slack (channel-mapped, with Agree/Disagree buttons on Multimodal recommendations)Email (per-rule-mode subscriptions, deduplicated)Webhooks (generic outbound)Weekly Multimodal priority emails to org admins
Languages
Languages and frameworks named in Semgrep's documentation.
ApexBashC#CairoCircomClojureDartDockerfileElixirGoHackHTMLJavaJavaScriptJsonnetJuliaKotlinLispLuaMove on AptosMove on SuiOCamlPHPPythonRRubyRustScalaSchemeSoliditySwiftTypeScriptXMLYAML
Need a higher plan: Apex (requires Semgrep Pro Engine), C# cross-file/Pro analysis (Pro Engine), Elixir Pro analysis (Pro Engine)
Pricing & plans
$15/month per contributor for Semgrep Secrets, the cheapest Teams module (no annual discount published); Code and Supply Chain are $30/month per contributor each
Minimum seats: Teams row states 10+ contributors (Free covers up to 10 monthly contributors)
Trial: No time-limited trial; the Free (AppSec Platform) tier is perpetual
Semgrep Community Edition (CE)Free (open source, LGPL 2.1)Individuals and small teams scanning locally
- Local/CLI SAST scanning
- VS Code and IntelliJ extensions
- Community rules
- Custom rule writing
- Single-function (intraprocedural) analysis
- No dashboard, triage, notifications or reporting
- No PR/MR comments
- No cross-function or cross-file analysis (Pro Engine)
- No Supply Chain or Secrets products
Free (AppSec Platform)FreeSmall orgs with 10 or fewer monthly contributors
- Full Semgrep Code
- Full Semgrep Supply Chain
- Core scans and basic triage
- 10 private repositories
- Up to 10 monthly contributors
- No AI credits, so all Multimodal features are unavailable
- Semgrep Secrets not included
- Exceeding contributor limits stops scanning entirely
TeamsStarting at $30/month per contributorAppSec teams needing Pro Engine, governance and API access
- One product of choice: Code ($30), Supply Chain ($30) or Secrets ($15) per contributor
- Pro Engine (cross-file analysis)
- Custom rules
- SSO (OIDC + SAML) and RBAC
- REST API and distributed scans
- Wiz and Cortex integrations; 20 AI credits per developer monthly
- 500 private repositories
- Only one product included; others cost extra
- 20 AI credits per developer per month; overruns stop AI detection, Autofix and Agentic Workflows
- No BYO AI model provider
- No on-premise repository support
EnterpriseCustom pricingLarge or regulated organizations needing on-premise repos and BYO AI
- All Teams features
- On-premise repository support
- Custom CI/CD integration
- Custom AI model provider (BYOK)
- 50 AI credits per developer monthly
- Dedicated account manager and tailored onboarding
- Quote-only pricing
- BYOK forfeits Semgrep's fine-tuned models and Zero Data Retention guarantee
- Agentic Workflows remains Semgrep-hosted beta with no BYOK or minimal data retention
Who it's for
Best for security teams that want to write their own rules, and teams that want reachability-based dependency scanning.
Semgrep positions CE for individuals and small teams; the Free platform tier covers organizations with 10 or fewer monthly contributors.
A good fit if
- You want an open-source engine that scans without a build step
- You want to write rules in YAML that look like the code they match
- You want secrets validated against 630+ credential types without sending tokens to the vendor
Consider alternatives if
- You need container scanning, CSPM or DAST
- You want code, dependency and secrets scanning under a single Teams license
- You need code quality checks
Similar tools
Other Code Security Platform tools in the directory.
AikidoApplication security platform spanning code, cloud, container and runtime scanning with AI triage, autofix and automated pentesting.Checkmarx OneApplication Security Posture Management platform bundling SAST, SCA, IaC, container, API, secret, and DAST scanners under one risk model.CorgeaAI-native AppSec platform (BLAST SAST) that finds business-logic vulnerabilities across code, dependencies, containers and IaC, and ships AI-generated pull-request fixes.GitHub Advanced SecurityGitHub-native AppSec sold as two add-on SKUs — Secret Protection and Code Security — with CodeQL SAST, Dependabot SCA, secret scanning.SnykDeveloper security platform covering SAST, SCA, container, IaC, secrets and DAST scanning with risk scoring and automated fix PRs.VeracodeEnterprise AppSec platform spanning SAST, SCA, DAST, container/IaC scanning, AI auto-remediation, ASPM risk management, and developer training.
FAQ
When should you choose Semgrep?
Semgrep is best for security teams that want to write their own rules, and teams that want reachability-based dependency scanning. It's a good fit if:
- You want an open-source engine that scans without a build step
- You want to write rules in YAML that look like the code they match
- You want secrets validated against 630+ credential types without sending tokens to the vendor
Consider alternatives if:
- You need container scanning, CSPM or DAST
- You want code, dependency and secrets scanning under a single Teams license
- You need code quality checks
What languages does Semgrep support?
Semgrep supports 34+ languages and frameworks, including Apex, Bash, C#, Cairo, Circom, Clojure, Dart, Dockerfile, Elixir, Go, and 24 more.
What does Semgrep integrate with?
Semgrep integrates with:
- Source control: GitHub, GitHub Enterprise Server, GitLab, GitLab Self-Managed, Bitbucket, Bitbucket Data Center and Azure DevOps
- CI systems: GitHub Actions, GitLab CI/CD, Jenkins, Bitbucket Pipelines, CircleCI and 14 more
- IDEs: VS Code, IntelliJ / JetBrains IDEs, Cursor, Windsurf and Kiro
What tools are similar to Semgrep?
Other code security platforms tracked here:
What are Semgrep's plans and pricing?
Semgrep has a free plan, and paid plans start at $15/contributor/mo. Enterprise pricing is by quote.
Opens semgrep.dev in a new tab. Review Radar is not affiliated with Semgrep.