Semgrep

Security · #1 of 3 in category · #8 of 27 overall

Open-source static analysis engine with a commercial AppSec Platform adding cross-file analysis and an AI assistant for triage.

Visit Semgrep [↗] See the matrix

[ Where it fits ]

On the documented evidence, Semgrep suits teams that need the reviewer inside their own infrastructure, teams that want to read and fork the source.

[ Documented strengths ]

Rule-Centric & Default Quiet. Fully rule-centric: custom rules, registry, and policy modes (Monitor/Comment/Block) control PR noise.
Dual-Workflow: Local vs. PR. CLI, IDE extension, and pre-commit locally; policy-managed PR/MR comments in CI.

[ Documented gaps ]

Business Logic Validation. No validation against issue trackers or requirements.
Sandbox Validation. Static analysis only; no sandbox or runtime validation.

[ Facts ]

Category: Security
Open source: Yes — LGPL-2.1 (CE engine); AppSec Platform proprietary
Pricing: Free Edition: $0, up to 10 contributors/10 repos (Code + Supply Chain), 60 AI credits included; Teams from $30/contributor/mo per product (Code SAST, Supply Chain SCA; Secrets $15), 20 AI credits/dev/mo, SSO, up to 500 private repos; Enterprise custom, unlimited repos/contributors, 50 AI credits/dev/mo source ↗
Self-hosted: Yes — full stack — CE engine (LGPL-2.1) runs fully local or in your CI; the AppSec Platform and Assistant are SaaS-only.
Platforms: GitHub GitLab Bitbucket AD Azure DevOps
Model control: Assistant/Multimodal defaults to Semgrep-managed OpenAI + AWS Bedrock keys; BYO now available (own OpenAI key, own Bedrock account, Azure OpenAI, Gemini, or xAI, configured per-org), though AI-powered detection scans stay on OpenAI/Bedrock only
Last verified: 2026-10-21

[ Against the 9 standards ]

Based on public documentation as of 2026-10-21. ✓ documented · ~ partial · ✗ not offered · ? undocumented. Undocumented scores zero — see the methodology.

~ Multi-dimensional Context

Cross-file, cross-function dataflow in the Pro engine; Assistant memories add project context; no ticket context.

✓ Rule-Centric & Default Quiet

Fully rule-centric: custom rules, registry, and policy modes (Monitor/Comment/Block) control PR noise.

✓ Dual-Workflow: Local vs. PR

CLI, IDE extension, and pre-commit locally; policy-managed PR/MR comments in CI.

✗ Business Logic Validation

No validation against issue trackers or requirements.

~ Continuous Learning

Assistant Memories store triage decisions and per-project instructions; the core engine does not learn.

✗ Sandbox Validation

Static analysis only; no sandbox or runtime validation.

~ Economic Transparency

LGPL engine is free to run; Assistant is credit-metered on vendor models, custom provider Enterprise-only.

~ Actionability

Assistant autofix posts suggested code changes in PR/MR comments; coverage varies by rule and language.

~ Measurable ROI

Platform dashboards track findings, fix rates, and remediation times; no dev-cycle ROI attribution.

[ Closest alternatives ]

Security Snyk Code 3/9 Security Aikido Security 2.5/9 AI PR Review Greptile 4.5/9 AI PR Review Tabnine 4.5/9

[ In our coverage ]

AI Code Review vs Static Analysis: 2026 Guide

AI code review vs static analysis compared: determinism vs reasoning, false positives, SAST coverage, cost, and why mature teams run both.

[ FAQ ]

Is Semgrep open source?

Yes. Semgrep publishes its source under LGPL-2.1 (CE engine); AppSec Platform proprietary, so you can read it, audit it and fork it.

Can Semgrep be self-hosted?

Yes — full stack. CE engine (LGPL-2.1) runs fully local or in your CI; the AppSec Platform and Assistant are SaaS-only. Verified against the vendor's own documentation on 2026-10-21.

How much does Semgrep cost?

Free Edition: $0, up to 10 contributors/10 repos (Code + Supply Chain), 60 AI credits included; Teams from $30/contributor/mo per product (Code SAST, Supply Chain SCA; Secrets $15), 20 AI credits/dev/mo, SSO, up to 500 private repos; Enterprise custom, unlimited repos/contributors, 50 AI credits/dev/mo. Seat price is only part of the bill: Semgrep handles models as assistant/multimodal defaults to semgrep-managed openai + aws bedrock keys; byo now available (own openai key, own bedrock account, azure openai, gemini, or xai, configured per-org), though ai-powered detection scans stay on openai/bedrock only, which is what usually decides the real monthly cost.

How does Semgrep score against the 9-pillar AI code review standard?

4.5 out of 9. It fully documents 2 standards, partially documents 5, does not offer 2, and leaves 0 undocumented. The score is coverage of documented capability, not a measure of review quality.

What are the alternatives to Semgrep?

The closest tools in this directory are Snyk Code, Aikido Security, Greptile, Tabnine. Each is scored against the same 9 standards, so the matrices are directly comparable.

Evaluating Semgrep?

Run it through the two-week trial protocol before you commit a team to it.

Evaluation guide [↗]