CheckOps home

Tools directory

O

CheckOps

Opengrep

Opengrep is an LGPL-2.1 open-source SAST engine, a fork of Semgrep backed by a consortium of AppSec companies including Aikido, Endor Labs and others.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

Opengrep describes itself as the most advanced open-source SAST engine, aiming to make secure software development a shared standard. It is a fork of Semgrep’s open-source engine and is backed by a consortium of AppSec organisations, including Aikido, Amplify and Endor Labs, among others listed in the README.

The source code is at opengrep/opengrep on GitHub under the LGPL-2.1 licence, with about 3,300 stars; the most recent commit was on 10 November 2026.

Features

  1. Semgrep-compatible rules: Pattern rules that look like the code you search.
  2. Multi-language: Many languages supported.
  3. Open governance: Consortium-backed.
  4. CLI: Run locally and in CI.
  5. SARIF output: For code scanning dashboards.

Pros

  1. Free to use: Open source under LGPL-2.1.
  2. Maintained: Commits as recent as 10 November 2026.
  3. Community: About 3,300 GitHub stars.

Cons

  1. Young fork: Roadmap and compatibility may evolve.
  2. Rule sourcing: You need rule sets; check licensing of any rules you import.
opengrep scan --config ./rules .

See the README for install options.

Resources:

Pricing

Opengrep is free and open source under the LGPL-2.1 licence.

  1. Teams wanting an open Semgrep-style engine.
  2. Vendors and communities building on open SAST.
  3. Not a fit if you want a managed SAST product.

Conclusion

Opengrep keeps a Semgrep-style SAST engine open under consortium governance.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with Opengrep side by side.