Open Source
Semgrep
by semgrep
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
Our verdict
We have not reviewed Semgrep yet
No one at Enterprise DNA has checked this listing against its sources. The description comes from public listings gathered automatically. Any fact below shows where it came from and when it was last checked.
From the listing
About Semgrep
Semgrep is a lightweight static analysis tool that scans source code across many languages to find bug variants using patterns that resemble the code itself. It works by matching user-defined or built-in patterns against the abstract syntax tree, enabling fast and precise detection of security issues and code defects.
Best for
Developers and security teams seeking fast, pattern-based static analysis across multiple languages.
Use cases
- Detect security vulnerabilities like injection or hardcoded secrets in codebases
- Enforce coding standards and prevent common bug patterns during development
- Scan large repositories quickly for specific code patterns or anti-patterns
Notes
17,340 stars on GitHub. Last updated 2026-10-29. Licensed LGPL-2.1.
Pros
- Fast scanning due to lightweight analysis
- Patterns are easy to write and read, resembling actual code
- Supports many programming languages
Cons
- May miss complex, context-dependent issues that require deeper analysis
- Pattern-based approach requires manual rule maintenance for custom checks
- Limited to static analysis, not a substitute for runtime testing
Key facts
What we have checked
- Latest version
- 1.185.0
- Days since the last commit
- 0
- GitHub forks
- 1,151
- GitHub stars
- 17,515
- Days to a first reply on issues
- 3.5
- Open issues
- 906
- Releases in the last 90 days
- 12
Each value shows when we last confirmed it and where it came from. Values we have not confirmed are left out, never guessed.
Stars and usage
How Semgrep is growing
17,379 to 17,515
Health and security
Is Semgrep looked after, and what do its setup files show
Health score
100 out of 100
| Part | Points | What we saw |
|---|---|---|
| Recent activity | 30 of 30 | Last push 0 days ago |
| Releases | 15 of 15 | 12 releases in 90 days |
| Issue replies | 19.7 of 20 | First reply in 3.5 days (median) |
| Maintainer | 15 of 15 | Owned by an organisation |
| Official source | Not counted | MCP servers only |
Alternatives
Alternatives to Semgrep
| Record | Type | How we know | Checked |
|---|---|---|---|
| SonarqubeThis is an alternative to it | Product | Linked recordGitHub |
Compare
Compare Semgrep side by side
Sources
Where this comes from
A source shows what was published when we checked it. It does not certify security, performance or a working installation. Read our method.
Changelog
What changed
Released 1.185.0
Released 1.184.0
Released 1.183.0
Released 1.182.0
Released 1.181.0
Released 1.180.0
Released 1.179.0
Released 1.178.0
Released 1.177.0
Released 1.176.0
Released 1.175.0
Released 1.174.0
Released 1.173.0
Open-source & AI alternatives
Swap-in tools that solve the same job. Weigh the trade-offs before you commit.
Get the free Developer’s Field Guide
A 27-page field guide to the AI coding workflow with Claude. Claude Code, MCP servers, the prompt patterns that work, and what to delegate. Free.
Enter your work email. We send it straight over, plus a few short notes worth knowing. Unsubscribe any time.