opengrep/opengrep

Health v2 · maintenance only

Adoption not part of the score

2995 stars · 254 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Opengrep is an open-source static application security testing (SAST) engine forked from Semgrep under LGPL-2.1, supporting pattern-based code search and taint analysis across 30+ languages. It is Semgrep-rule compatible and outputs JSON and SARIF for CI integration.

Use cases

• find security vulnerabilities in source code
• run static analysis in CI pipelines
• search codebases with semantic grep patterns
• perform taint analysis to trace untrusted input
• scan code with existing Semgrep rules
• generate SARIF reports for security findings

When to choose

• you want a fully open-source SAST engine without commercial license restrictions
• you already have Semgrep rules and want drop-in compatibility
• you need taint analysis or language support missing from Semgrep CE (e.g., Visual Basic, Apex, Elixir)

When to avoid

• you rely on Semgrep's proprietary platform features or commercial rules
• you need dynamic analysis or runtime security testing rather than static analysis

Facets

cli-tool · maturity active

security vulnerability-scanning search-engine parser linter security developer-tools testing windows cli cross-platform sast static-analysis semgrep-fork taint-analysis code-search sarif appsec command-line linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="opengrep/opengrep")