Semgrep
Fast static analysis tool with rules written to look like the code they match.
- Verified facts
- 4 of 4
- Alternatives ranked
- 3
- Approved reviews
- 0
- Visits sent from here
- 0
About Semgrep
Semgrep is a static analysis tool for finding bugs and security issues in source code. Its main selling point is the rule syntax: you write patterns that look like ordinary code, which makes custom checks much quicker to create than in query-language engines. The open-source Community Edition runs locally or in CI from a single command and supports dozens of languages. On top of it, Semgrep's hosted platform adds cross-file analysis with its Pro rules, dependency scanning (supply chain), secrets detection and AI-assisted triage and fixes. The platform has a free edition for small teams with a cap on contributors and repositories, then paid plans charged per contributor for Code, Supply Chain and Secrets separately, with enterprise pricing on request. It suits teams that want quick, tunable scans in pull requests without being tied to one code host. Deeper inter-file analysis and the larger rulesets are reserved for the paid engine.
Best for: Teams that want fast CI scans and easy-to-write custom rules.
Pros and cons
What works
- Rules are written in code-like patterns that are easy to read
- Open-source CLI runs anywhere, including locally
- Free edition covers small teams on the hosted platform
- SAST, dependency and secrets scanning in one product
Why people leave
- Cross-file analysis and Pro rules need the commercial engine
- Free edition is capped at 10 contributors
- Paid products are billed separately per contributor
Top Semgrep alternatives
See all 3
Why people left Semgrep
In reviewers' own words, from reviews of the apps they moved to. These are their opinions, not ours.
No switching stories yet. If you moved away from Semgrep, review the app you switched to and tell us why.
Reviews
No approved reviews yet. How we verify reviewers
Write a review of Semgrep
Semgrep: common questions
Is Semgrep free?
Semgrep has a free plan and paid plans. Free plan: Up to 10 contributors (checked on Semgrep's own site).
Is Semgrep open source?
Yes.
What platforms does Semgrep run on?
Semgrep is available for Web, Windows, macOS and Linux.
What are the best alternatives to Semgrep?
The highest-ranked Semgrep alternatives right now are CodeQL, SonarQube and Snyk. See the full ranked list for pricing, platforms and verified facts.