Skip to content
← Tools / Skills
ToolSemgrep/10 trustVerified
Semgrep logo

Semgrep

Developer-friendly SAST — open-source engine with AI triage.

Visit official site →

About

Semgrep (semgrep.dev) is the developer-friendly static analysis platform: an open-source engine (LGPL) with custom rules, plus a commercial cloud with AI-assisted triage.

The pick when you want SAST developers will actually use — fast, precise, and rule-customizable. The OSS engine keeps it honest.

What it can do

  • SAST scanning
  • Custom rules
  • AI triage
  • OSS engine (LGPL)
  • CI integration

Setup

  1. pip install semgrep for the OSS engine.
  2. semgrep ci in your pipeline.
  3. Sign up for the cloud for AI triage and management.

Prerequisites

None for OSS; account for cloud.

Use cases

codeautomation

Works with

Generic APIAny agent (.md)

Trust score — 8/10

/10 trustVerified

Scored 8/10 (verified tier). Developer-loved SAST with a genuine open-source engine and AI triage. Docked for the commercial cloud being the full product. Adoption is a provider-tier estimate (thinner evidence). Verified tier.

How the trust score is built

Full methodology →
Adoption · stars/downloads, log-scaled vs peers
8.0/10
Maintenance · recency, releases, issue load
7.0/10
Openness · license + docs
8.3/10
Manual review · sanity read + red-flag check
8.0/10
  • · provider-tier estimate — thinner evidence (no public adoption metric)
  • · code security; OSS engine + cloud; adoption estimated
  • · released 285 days ago
  • · manual review: Semgrep — SAST with AI triage; OSS engine; the developer-friendly scanner; license: open-source engine (LGPL) + commercial cloud

Sources

Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.