# Semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

Repository: https://github.com/semgrep/semgrep
Canonical: https://ross.abutalabs.com/products/semgrep
Homepage: https://semgrep.dev
Language: OCaml
License: LGPL-2.1
License Family: copyleft
Topics: static-analysis, static-code-analysis, java, go, sast, semgrep, r2c, c, python, ruby, javascript, typescript
Last push: 2026-08-26T17:08:38+00:00
Link (homepage): https://semgrep.dev
Link (site_page): https://semgrep.dev/docs/for-developers/overview
Link (site_page): https://docs.semgrep.dev
Link (site_page): https://semgrep.dev/blog
Link (site_page): https://semgrep.dev/about

## Health v2 (maintenance only)
Score: 95/100 (v2, computed 2026-09-03T02:39:23.370411+00:00)
- activity 99, release rhythm 87, longevity 100
- inputs: {"age_days": 2455, "days_push": 7, "days_rel": 7, "gap_med": 7.0, "n_releases_24m": 87}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 16409, forks 1036 (observed 2026-08-28T04:11:16.290854+00:00)

## What it is
Semgrep is a fast, open-source static analysis tool that searches code, finds bugs, and enforces secure coding standards using rules that look like source code. It supports 30+ languages and integrates into IDEs, pre-commit hooks, and CI/CD pipelines, with a commercial platform for SAST, SCA, and secrets scanning.

## Use cases
- scan my codebase for security vulnerabilities
- write custom static analysis rules that look like source code
- enforce coding standards in CI on every pull request
- find hardcoded secrets in my repository
- detect reachable vulnerabilities in open source dependencies
- lint code across 30+ languages with one tool
- run SAST checks as a pre-commit hook
- search code semantically instead of with grep or regex

## When to choose
- you need fast, pattern-based static analysis across many languages
- you want to write custom rules without learning ASTs or complex DSLs
- you need to enforce secure guardrails and coding standards in CI/CD
- you want an open-source SAST engine with an optional commercial platform for SCA and secrets detection

## When to avoid
- you need deep cross-file or cross-function taint analysis in the free Community Edition, which is limited to single-file/function scope
- you need full SCA, secrets scanning, or organizational triage without the paid AppSec Platform
- you need dynamic analysis or runtime vulnerability detection rather than static scanning

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, linter, static-site-generator, developer-tools, code-review, vulnerability-scanning, parser
- domain: security, developer-tools, testing
- platform: windows, cli, python, cross-platform
- tags: static-analysis, sast, sca, secrets-scanning, pattern-matching, code-search, ci-cd, security-scanning, multi-language, devops, linux, macos, docker

## Member repositories
- semgrep/semgrep (main) score 95
- semgrep/semgrep-rules (plugin) score 75

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:11:16.290854+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:05:07.193060+00:00, confidence not recorded.
  - readme: https://github.com/semgrep/semgrep (fetched 2026-08-28T04:11:16.290854+00:00, sha f8450010a60b)
  - homepage: https://semgrep.dev (fetched 2026-08-29T08:02:34.624737+00:00, sha d5c6bce657b8)
  - site_page: https://semgrep.dev/docs/for-developers/overview (fetched 2026-08-29T08:02:34.634503+00:00, sha 344153629054)
  - site_page: https://docs.semgrep.dev (fetched 2026-08-29T08:02:34.637150+00:00, sha 6408ab0133ca)
  - site_page: https://semgrep.dev/about (fetched 2026-08-29T08:02:34.640859+00:00, sha 31241c725690)
  - site_page: https://semgrep.dev/about/careers (fetched 2026-08-29T08:02:34.642727+00:00, sha 83a3b4abf205)
  - site_page: https://semgrep.dev/blog (fetched 2026-08-29T08:02:34.638927+00:00, sha 45aaee91931d)
  - site_page: https://semgrep.dev/pricing (fetched 2026-08-29T08:02:34.644628+00:00, sha 6147fc6d0866)
  - site_page: https://semgrep.dev/products/semgrep-code (fetched 2026-08-29T08:02:34.646628+00:00, sha c8ec05fd699d)
  - site_page: https://semgrep.dev/products/semgrep-supply-chain-old (fetched 2026-08-29T08:02:34.648962+00:00, sha 13965dc4d178)
- Data as of 2026-08-30T08:39:29.467469+00:00.