Semgrep

Visit Website

Introduction

Semgrep scans source code for patterns you can write down. A rule is YAML: a pattern, a language, and a message. The open-source engine matches that pattern inside a file or function and prints findings as text, JSON, or SARIF. It is LGPL-2.1, developed at semgrep/semgrep. The usual install is the CLI, run locally or in CI, with rules from the Semgrep Registry.

Semgrep Inc. also sells a platform. The free platform tier adds cross-file analysis, Pro rules, and hosted findings, with limits on contributors and repositories. Paid modules split Code (SAST), Supply Chain (SCA), and Secrets. The CLI without an account does not include those Pro rules or cross-file dataflow. Semgrep is a scanner, not a test runner. It does not execute the program.

Features

1. Pattern rules: pattern, pattern-either, pattern-not, and metavariables express a bug without a full compiler plugin. Ellipsis matches a sequence of statements.
2. Languages: The community engine covers the common set: Python, JavaScript, TypeScript, Java, Go, Ruby, C and C++, C#, PHP, Kotlin, Rust, and several others, plus Terraform and Dockerfiles for config rules.
3. Registry: Thousands of community rules install with --config auto or a registry path. Pro rules, maintained by Semgrep, require the platform login.
4. Outputs: Human text, JSON, and SARIF. SARIF is what GitHub code scanning ingests.
5. CI: semgrep ci uploads findings when you are logged into the platform. A plain semgrep scan stays local and returns non-zero when blocking findings exist, if you configure it that way.
6. Pro engine: Cross-file and cross-function dataflow, which catches issues the community single-file match misses. This engine is not the LGPL CLI alone.
7. Supply Chain and Secrets: Dependency reachability and credential detection are platform modules with their own prices.
8. Assistant: AI triage and remediation are part of the platform, metered in AI credits. They are not in the community CLI.

Pros

1. A custom rule is a short YAML file: Teams can encode “we do not call this API” without waiting for a vendor rule.
2. Fast enough for a pull request: Single-file scans on a diff finish in CI seconds for many repos. Full-repo Pro scans cost more.
3. Local and offline: The community CLI scans without an account. That suits air-gapped CI if you vendor the rules.
4. SARIF and GitHub: Findings land on the pull request as code-scanning alerts when you wire the output.
5. A free platform tier exists: Semgrep’s pricing page includes a $0 edition for up to 10 contributors and 10 repositories, with Pro rules and supply chain at $0 inside those limits.

Cons

1. Community rules are single-file: Inter-procedural bugs need the Pro engine. A green community scan is not a full SAST pass.
2. Pro rules are not open source: You cannot mirror the paid rule pack into a private registry and drop the subscription.
3. Noise: Pattern rules fire on lookalike code. Someone has to triage or write pattern-not exclusions. AI triage is a paid credit, not a default.
4. Module pricing stacks: Code, Supply Chain, and Secrets are separate per-contributor prices. Buying “Semgrep” without naming the module is how quotes go wrong.
5. Not dynamic testing: Semgrep never runs the app. Injection that only appears at runtime still needs DAST or tests.

Usage and Links (Example)

pip install semgrep
# or: brew install semgrep
semgrep scan --config auto

A local rule, rules/no-eval.yaml:

rules:
  - id: no-eval
    languages: [python]
    message: Do not call eval
    severity: ERROR
    pattern: eval(...)

semgrep scan --config rules/no-eval.yaml --sarif --output semgrep.sarif

--config auto selects registry rules from the languages it finds in the repo. The CLI sends usage metrics unless you pass --metrics=off. Read the current privacy note before you scan sensitive source. For the platform, semgrep login and semgrep ci are the documented CI path.

Resources:

• Semgrep website
• Documentation
• Pricing
• GitHub: semgrep/semgrep

Pricing

From semgrep.dev/pricing:

1. Community CLI: Free, LGPL-2.1. Local scans, community registry rules, single-file analysis, SARIF and JSON. No account.
2. Free platform edition: $0. Up to 10 contributors and 10 repositories. Includes cross-file Pro rules, a limited AI-credit allowance (the page lists 60), and Code plus Supply Chain at $0 inside that cap.
3. Teams: Code (SAST) at $30 per contributor per month, Supply Chain at $30 per contributor per month, Secrets at $15 per contributor per month. SSO, more AI credits (20 per developer per month on the published card), and Semgrep-hosted CI scans.
4. Enterprise: Custom. Unlimited contributors and repositories, dedicated support, on-prem source control, and optional dedicated infrastructure.

Contributors are the billing unit on Teams, not seats in the UI and not lines of code. Confirm the current AI-credit numbers on the pricing page; they are the sort of meter that moves.

Recommended for?

1. Pull-request scanning with a handful of custom rules and the community registry, at no license cost.
2. Security teams that want cross-file SAST and are within 10 contributors, on the free platform tier, before paying $30 per contributor.
3. GitHub code scanning via SARIF, whether or not you buy the platform.
4. Not as the only security test. Pair it with dependency review, tests, and a runtime scanner where the risk is in behaviour rather than syntax.

Conclusion

Semgrep’s CLI is the lightweight SAST tool to put in CI first: YAML rules, fast scans, SARIF, no account. Pay for the platform when you need cross-file analysis or the Pro rule set, and name the module, because Code, Supply Chain, and Secrets are priced apart. A clean scan means the enabled rules did not match. It does not mean the application is safe, and it does not execute tests.