Semgrep is a SAST tool that finds bugs and security vulnerabilities using pattern-matching rules that look like the code you’re scanning. The open-source CLI supports 30+ languages and has over 13,400 GitHub stars. The company (formerly Return to Corp) also runs a commercial AppSec platform with SAST, SCA, and secrets detection.
The rule syntax is the main differentiator. Instead of writing abstract regex or custom DSLs, you write rules that resemble the source code you want to match. Custom rule creation takes minutes, not hours. The community registry has 2,000+ rules, and the commercial platform adds 20,000+ proprietary ones.
What is Semgrep?
Semgrep started as an open-source pattern-matching engine and grew into a full AppSec platform. The OSS CLI is licensed under LGPL-2.1 and does single-file static analysis. The commercial platform adds cross-file dataflow analysis, SCA, secrets detection, and AI-powered triage on top.
Key features
Semgrep Code (SAST)
The open-source engine does single-file analysis. The Pro Engine adds cross-file and cross-function dataflow, which cuts false positives significantly. According to Semgrep’s published benchmarks, the Pro Engine reduces false positives in high/critical findings by up to 98%. NIST’s Software Assurance Metrics and Tool Evaluation (SAMATE) project has recognized the value of tools that combine pattern matching with dataflow analysis for reducing false positive rates.
# Install
brew install semgrep
# Run with auto config (uses recommended rules)
semgrep --config=auto .
# Run with a specific rule from the registry
semgrep --config=p/ci .
yaml.load(...) rather than a regex. Developers can write and review security rules without learning a separate language.
Semgrep Supply Chain (SCA)
Checks open-source dependencies for known vulnerabilities, then uses reachability analysis to determine whether your code actually calls the vulnerable function. CVEs in dependencies you import but never invoke get filtered out.
Semgrep Secrets
Scans source code for hardcoded credentials, API keys, and tokens. Goes beyond regex pattern matching by using semantic analysis to reduce false positives from test fixtures and example strings.
Semgrep Assistant
An AI layer that triages findings and suggests fixes. It adds context to each finding, explaining what the vulnerability is and how to remediate it, so developers don’t have to research every rule ID themselves.
Installation
| Method | Command |
|---|---|
| Homebrew | brew install semgrep |
| pip | python3 -m pip install semgrep |
| Docker | docker run --rm -v "${PWD}:/src" semgrep/semgrep semgrep --config=auto |
Getting started
brew install semgrep, pip install semgrep, or Docker. The CLI is a single binary with no dependencies.semgrep --config=auto . in your project directory. This pulls the recommended ruleset and finishes in seconds.semgrep ci in your pipeline. Official configs exist for GitHub Actions, GitLab CI, Jenkins, Buildkite, and CircleCI.When to use Semgrep
The open-source CLI is a good fit for individual developers and small teams that want fast SAST they can extend with custom rules. The commercial platform adds dashboards, team management, the Pro Engine for cross-file dataflow, and SCA for organizations that need more coverage.
Used by Lyft, Dropbox, Snowflake, HashiCorp, Trail of Bits, GitLab, and Figma. For a detailed comparison with other tools, see our guides on Semgrep alternatives and Semgrep vs CodeQL.
