Semgrep — a lightweight static-analysis (SAST) tool that finds security bugs in source code using rules written as patterns that look like the code you are looking for — is developed by Semgrep, Inc. and published as the free, open-source Semgrep Community Edition (CE) engine under the LGPL 2.1. Rather than learning a bespoke query language or a proprietary rule format, you write a YAML rule containing the syntactic shape of the bug — eval($X), subprocess.$FUNC(..., shell=True, ...), requests.$METHOD(..., verify=False, ...) — and semgrep matches that shape across your codebase, with metavariables standing in for the parts that vary and ellipses for the parts that do not matter. A rule can also carry a suggested replacement, which semgrep scan --autofix applies for you. It installs as an ordinary CLI (pipx, uv, Homebrew or the semgrep/semgrep Docker image; Python 3.10 or later) and scans locally with no account required. The current release is v1.181.0 (14 October 2026), and the engine has roughly 17,000 stars on GitHub.

Key Features

• Rules that read like code — a rule is a readable YAML file whose patterns use real syntax with metavariables ($X) and ellipsis operators (..., $...ARGS). Composition operators cover the awkward cases: pattern-not, pattern-either, pattern-inside, pattern-not-inside, metavariable-regex, metavariable-comparison and focus-metavariable, so a finding can be narrowed to the exact argument that is dangerous instead of the whole call.
• Three analysis modes — search for structural patterns, taint for dataflow rules that declare pattern-sources, pattern-sinks, pattern-sanitizers and pattern-propagators, and generic for ellipsis-based matching over plain text when a file has no parser (configs, templates, documentation).
• Registry rule packs, or your own directory — --config p/ci, p/default, p/security-audit, p/owasp-top-ten, p/secrets and hundreds of community packs are pulled from the Semgrep Registry; pointing --config at a local file or directory (--config rules/) gives a completely offline, air-gapped run with no telemetry and no code leaving the machine.
• Autofix — a rule may include a fix: block with the corrected code; semgrep scan --config rules --autofix rewrites the offending line in place, and --dryrun shows the diff without touching files. This turns a rule into a bulk-remediation tool rather than only a report.
• Machine-readable output — text, JSON, SARIF, GitLab SAST, GitLab Secrets, JUnit XML, Emacs and Vim formats, with --output, --json-output and --sarif-output able to emit several streams at once, so the same scan can print to the console and upload SARIF to a code-scanning dashboard in a single pass.
• Two entry-point commands — semgrep scan is the account-free command for scanning local code and for developing and testing rules; semgrep ci fetches an organisation’s scan configuration from Semgrep AppSec Platform. semgrep ci --dry-run runs that configuration without sending findings anywhere, and semgrep ci --oss-only restricts the run to the open-source engine even when proprietary cross-file analysis is enabled on the account.
• Precision and performance controls — suppression with // nosemgrep comments, --exclude/--include, .semgrepignore, severity filtering (--severity ERROR), size caps (--max-target-bytes), per-rule timeouts (--timeout, --timeout-threshold) and parallelism (-j), plus three log levels (default, -v, --debug).
• Rule development workflow — semgrep scan --test runs a rule against annotated test cases (lines marked ruleid: or ok:), the browser-based Semgrep Playground lets you iterate on a pattern against a pasted snippet before it reaches your repository, and semgrep publish adds a private or public rule to the Registry.
• Exit codes that work in CI — semgrep scan exits non-zero on findings with --error, so a rule automatically becomes a build gate without extra glue.

Why Use Semgrep?

The reason Semgrep spreads through a team quickly is that the rule is the artifact. Because a rule is a short YAML file containing a recognizable code pattern, it can be reviewed in a pull request, versioned next to the code it protects, and adjusted the moment a new bug class appears inside an internal library — no vendor feature request, no waiting for signature updates. Developers who have never written a query language can write their first useful rule in minutes, and because scans execute locally, a run with a local rule directory sends nothing anywhere, which makes the tool easy to justify for closed or regulated codebases. A rule written once also keeps paying: run the pack in CI and the same check catches the regression six months later. Two caveats are worth stating plainly. First, the Community Edition engine performs single-file analysis; the interprocedural cross-file dataflow engine, Semgrep Secrets, Semgrep Supply Chain and the Semgrep AppSec Platform are separate proprietary products, and semgrep ci requires logging in and uploads findings to the platform. Second, the maintained rules in the semgrep-rules repository are licensed under the Semgrep Rules License v1.0, which permits internal business use but not repackaging the rules into a competing product — rules you write yourself are yours.

Use Cases

• Catch an injection or misuse pattern in your own codebase with a five-line rule, before it ever reaches review.
• Gate a pipeline: run semgrep ci or semgrep scan --config p/ci --error in CI and fail the build when a blocking rule matches; emit SARIF for GitHub code scanning or GitLab SAST.
• Encode team conventions as rules — a banned API, a required wrapper, a logging call that must carry a correlation id — and let the linter enforce the standard.
• Audit a third-party or legacy code drop you are permitted to read, mapping eval, shell=True, disabled certificate checks and deserialization sinks in one pass.
• Use generic mode against non-code files: infrastructure definitions, templated configs, generated sources that no parser understands.
• Drive bulk remediation with --autofix after a rule has proven out, reviewing the diff instead of editing each call site by hand.
• Ship a custom rule pack inside an internal rule repository and share it with other teams via semgrep publish.

Similar

• Nuclei — template-driven dynamic scanning of running systems; Semgrep examines source code instead of live targets, and the two are complementary.
• Gitleaks — credential and secret hunting in repositories and history; a fast pre-commit companion to a Semgrep scan.
• Trivy — dependency, container-image and misconfiguration scanning, covering the supply-chain and infrastructure surface rather than your own code.
• Lynis and CrowdSec — host hardening audits and runtime intrusion prevention, where Semgrep is the shift-left check on the code itself.

Platform

Linux · macOS · Windows (beta) — requires Python 3.10 or later, installed with pipx, uv or Homebrew · official semgrep/semgrep Docker image · runs in CI from GitHub Actions, GitLab CI and other runners · the engine is written primarily in OCaml with a Python CLI wrapper.

Licence

LGPL 2.1 — the Semgrep Community Edition engine, as stated in the repository’s LICENSE file and in the project’s own licensing page. The proprietary extensions are separate products under commercial terms: Semgrep Code (which adds the cross-file, interprocedural engine), Semgrep Secrets, Semgrep Supply Chain and the Semgrep AppSec Platform. The maintained rules in the semgrep-rules repository are licensed under the Semgrep Rules License v1.0 (free for internal business use; not for use in competing products).

Website

semgrep.dev · documentation · source on GitHub · rule registry · also see the Security & Privacy category for more tools that keep systems in check.