Skip to content
THREATWIRE

Semgrep

Lightweight, pattern-based static analysis

Fast static analysis engine where rules look like the code they match, supporting many languages; the open-source Community Edition runs locally and in CI.

Open sourceLGPL-2.1-only
Alternative toVeracodeCheckmarx OneSnyk
Visit website View repository Docs
Homepage of Semgrep
Official website (semgrep.dev), captured by ThreatWire.

What Semgrep does

Semgrep searches code with patterns written in a syntax close to the target language, which makes custom rules quick to write. It supports a long list of languages and is used both to find security bugs and to enforce coding standards.

The engine in this repository is Semgrep Community Edition. Semgrep, Inc. also runs a commercial platform with cross-file analysis, managed rules and supply-chain scanning; community rules from the semgrep-rules registry can be used with the open-source engine.

Key features

  • Rules written as code-like patterns
  • Support for many programming languages
  • Autofix suggestions in rules
  • Runs locally, in pre-commit and in CI
  • SARIF and JSON output

Licence

LGPL-2.1-only · GNU LGPL v2.1 · Open source

The open-source engine is Semgrep Community Edition; Semgrep's cloud platform, Pro engine and some rules are commercial.

Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: LGPL-2.1.

Security of Semgrep itself

No published advisory found for Semgrep in GitHub repository advisories and OSV.dev. That does not mean the tool has no vulnerabilities.

Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.

Categories and tags

Static code analysis (SAST)#static-analysis#rules#ci#multi-language#static-code-analysis#java#go#sast#semgrep

Related tools

  • gosec

    Security checker for Go source code

    Inspects Go source code through its AST and SSA representation to find security problems such as injection, weak crypto and unsafe file handling.

    Stars
    9k
    Forks
    722
    Last commit
    today
    Apache-2.0Open sourceStatic code analysis (SAST)
    Alternative toVeracodeCheckmarx One

  • Bandit

    Security linter for Python code

    Static analyser from the PyCQA that builds an AST of each Python file and runs plugins to flag common security issues.

    Stars
    8.3k
    Forks
    862
    Last commit
    28 days ago
    Apache-2.0Open sourceStatic code analysis (SAST)
    Alternative toVeracodeCheckmarx One

  • Trivy

    All-in-one scanner for images, code, IaC and clusters

    Scanner from Aqua Security that finds vulnerabilities, misconfigurations, secrets and licences in container images, file systems, repositories and Kubernetes.

    Stars
    39k
    Forks
    776
    Last commit
    today
    Apache-2.0Open sourceContainer and Kubernetes security
    Alternative toSnykPrisma Cloud+1

  • Grype

    Vulnerability scanner for images, file systems and SBOMs

    Anchore's vulnerability scanner for container images, file systems and SBOMs, matching packages against a regularly updated vulnerability database.

    Stars
    13k
    Forks
    920
    Last commit
    today
    Apache-2.0Open sourceDependencies and SBOM (SCA)
    Alternative toSnykSonatype Lifecycle

  • OSV-Scanner

    Dependency scanner backed by the OSV database

    Google's vulnerability scanner that reads lockfiles, SBOMs and container images and checks the packages against the open OSV.dev database.

    Stars
    11k
    Forks
    816
    Last commit
    7 days ago
    Apache-2.0Open sourceDependencies and SBOM (SCA)
    Alternative toSnykSonatype Lifecycle

  • Syft

    SBOM generator for images and file systems

    CLI tool and Go library from Anchore that generates a software bill of materials from container images and file systems in SPDX and CycloneDX formats.

    Stars
    9.7k
    Forks
    1k
    Last commit
    today
    Apache-2.0Open sourceDependencies and SBOM (SCA)
    Alternative toSonatype LifecycleSnyk
Share on X@threatwire_https://www.threatwire.tech/tools/semgrep