Semgrep

Semgrep

Open Source(LGPL-2.1)
Verified
AI-Enhanced

AI-assisted SAST, SCA and Secrets Detection

SOC 2 Type II
GDPR
EU AI Act: Limited
Public status page
IDE plugin
+5
Last updated: Oct 27, 2026
Freemium
Visit Site17.1k
More
semgrep.dev
Semgrep screenshot 1
Visit semgrep.dev

Quick Answer

Semgrep is a code analysis tool for developers and AppSec teams. It supports over 35 programming languages and integrates with GitHub, GitLab, and Bitbucket. Best for mid-market product teams needing SAST, SCA, and secrets scanning. Freemium; paid plans from $30/month/contributor.

About SemgrepAI

Semgrep is an AppSec platform that unifies SAST, SCA, secrets scanning, and malware protection into one platform. It helps developers catch and fix vulnerabilities before code ships, while providing security teams with visibility and control. Free to get started; paid plans from $30/month/contributor.

What Makes It UniqueAI

Semgrep combines deterministic static analysis with AI reasoning to understand code context, eliminate false positives, and prioritize reachable vulnerabilities, validated by 95% of security reviewers.

AI-extracted from public sources. May contain errors. Methodology · Report an error

Decision Intelligence

Best For

AI
Developers building and shipping code securely
AppSec teams seeking high-signal results and reduced false positives
CISOs needing measurable security outcomes and unified visibility
Mid-market product teams needing SAST, SCA, and secrets scanning
Enterprise organizations requiring custom CI/CD and on-prem support
Startups looking for special pricing and streamlined AppSec
Pricing Overview

Type

Freemium

Free Trial

No

Credit Card

Not Required

Free Plan

Yes

Dimension Scores

· 7.2 avg

How good it is, across universal quality axes

Ease of Use8/10
Customization9/10
Support8/10
Integration7/10
Compliance & Data Protection6/10
Performance5/10
AI-scored from up to 37 public sources, reviewed by a person·High confidenceHow we score

Task Scores

· 4.9 avg

What it can do, per category it works in · showing 5 of 10 tasks scoring 5+

Security Scanning10/10
Multi Language Support9/10
Bug Detection8/10
Context Understanding8/10
Code Explanation5/10

Scores are AI-estimated from publicly available data — not an independent test or a verified user rating. How we rank →

Capabilities
Code
Code Review
Data Analysis
Automation
Agent
RAG
Categories
Cybersecurity
Code Assistant
LimitationsAI
  • -Secrets detection is not available on the Free plan
  • -Historical scanning for secrets detection is in Beta
  • -Custom AI Model Provider is only available on the Enterprise plan
  • -Self-managed/on-prem repositories are only supported on the Enterprise plan
  • -Custom CI/CD integration is only available on the Enterprise plan
Fit Score

Complexity

Intermediate

Company Size

Small
Medium
Enterprise

Target Team Size

Small Team
Large Team

Target Skill Level

Intermediate
Expert
Technical Specifications
SDK Available (unknown)
MCP Compatible (unknown)
Team Features
Webhook Support
Has DemoOpen demo
Function Calling (unknown)
Sandbox Mode
Audit Logs
No Signup
Works Offline (unknown)
Requires Host App
Framework
MCP Server
Inference API
IDE Plugins
VS Code
JetBrains
MCP transport:
STDIO
Authentication
Single Sign-On
OIDC
Okta
Microsoft Entra ID
Google Workspace
OAuth
GitHub
Developer Access
Webhooks→ Docs
Sandbox
Public
→ Try sandbox
Deployment:
Hybrid
Compliance, Privacy & Trust
GDPR: Stated by vendor
DPA
SOC 2: Stated by vendor
Type II
HIPAA: No info available
Privacy & data handling
Trains on user data: Unknown
Data deletion: 30 Days
Copyright policy: User Owns Output
Human review:
Recommended

The Model(s) Behind It

Model details — extracted from public vendor sources by our pipeline (AI extraction plus a source check) or admin-entered. Shown as claimed by the vendor; not independently audited by Intelloro.

Training Data Provenance
Not disclosed
Relevant to EU AI Act Art. 53 / Annex XI (GPAI)
Integrations & Connections
14 connections
S
C
W
R
+10
Cursor
Cursor

Cursor is your coding agent for building ambitious software

Wiz
Wiz

AI cybersecurity for all your cloud and AI applications

Replit Agent
Replit Agent

The best AI agent for building production-ready apps

GI
GitHubNative

PR checks and authentication

GI
GitLabNative

PR checks and authentication

BI
BitbucketNative

PR checks

AZ
AzureNative

PR checks

JI
JiraNative

Ticketing workflow routing

Auto-updated

Trust Score

99/100

Excellent

Based on 14 data signals

Confidence: High

Reflects publicly available data, not an independent audit

Compliance & Verified38/38
VerifiedYes
GDPRYes
SOC 2 reportYes
Open-source licenseLGPL-2.1
SOC 2 Type IIYes
EU AI ActYes
Human ReviewYes
Operational25/25
Status PageYes
Data ResidencyUS
Reliability9/10
Uptime (measured)99.98%
Market Proof10/10
Notable CustomersLyft, Slack, Dropbox
Company17/17
Company ListedYes
Team Size201-500
FundingSeries D+
Health—

Not yet checked

AI-Assisted Data

Some details are AI-generated estimates — verify with the vendor.

AI-generated estimate: Best For, Description, Limitations, What Makes Unique

How we source data

AI Governance & Regulatory Disclosures

Legally-sensitive fields — extracted from public vendor sources by our pipeline (AI extraction plus a source check) or admin-entered. Shown as claimed by the vendor; not independently audited by Intelloro.

EU AI Act Risk Tier
Limited (Article 50 transparency)
Subprocessor List (GDPR Art. 28)
https://trust.semgrep.dev/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57

Switching & Migration

Migration Difficulty
Moderate Effort
Support:
Slack
Priority
API Access
Open Source
Quick Stats
CategoryCybersecurity
PlatformsWeb, CLI, API
Integrations12
Launched2020
VerifiedOct 2026
Company & Links
CompanySemgrep, Inc.
Founded2017
Based inUnited States
FundingSeries D+ · $204M
Funding rounds
1 round
DocumentationChangelog
LinkedInTwitter/XYouTube
All Features
AI-assisted SAST, SCA, and Secrets Detection
Open-Source Malware Protection with Zero-Day Incident Detection
AI-powered detection, triage, and remediation
Automated noise filtering and false positive reduction
Generate tailored remediation and upgrade guidance in PRs and IDEs
Secure code as it's written with built-in guardrails
Pricing Plans
Free
Free
  • Cross-file analysis with Pro rules
  • AI-powered detection, triage, and remediation
  • 60 AI credits included
  • Fast CI/CD deploy via Semgrep infrastructure
  • Scan up to 10 repositories
  • Maximum 10 contributors
    • Teams
    $30/month
  • Cross-file analysis with Pro rules
  • AI-powered detection, triage, and remediation
  • 20 AI credits per developer per month
  • One-click CI/CD deploy using Semgrep infrastructure
  • Single sign-on (SSO)
  • Award-winning support
    • Enterprise
    Custom
  • Everything in Teams
  • Support for on-prem source code management
  • Support for custom CI/CD integrations
  • 50 AI credits per developer per month
  • Optional deployment in dedicated infrastructure
  • No limit on number of repositories scanned

    • Pricing verified from the vendor pricing page.

    User Reviews

    No reviews yet. Be the first to review!

    Alternatives

    Top Semgrep alternatives in the same category, ranked by quality.

    Snyk

    Snyk

    freemium

    AI Security Fabric — secure code, models & agents

    Snyk Code

    Snyk Code

    freemium

    SAST Code Scanning & Security Analysis

    Torq

    Torq

    enterprise

    AI SOC Platform — agentic AI for security operations

    Vectra AI

    Vectra AI

    enterprise

    AI-Native Security & Observability Platform — threat detection & response

    Palo Alto Cortex

    Palo Alto Cortex

    enterprise

    The single, autonomous platform for the modern SOC

    Darktrace

    Darktrace

    enterprise

    The Essential AI Cybersecurity Platform

    Looking for more Semgrep alternatives?

    Explore our complete list of alternatives with filters for free, cheaper, and higher-rated options.

    View All Alternatives
    Also great for CodingSee all
    Command Code
    Command Code
    The best coding agent for open models
    Claude Code
    Claude Code
    Code faster with an agentic AI assistant that
    Codex CLI
    Codex CLI
    Lightweight coding agent that runs in your te
    Base44
    Base44
    Build your own apps, websites, products and A
    Who It's For
    2 roles
    Information Security AnalystsSoftware Developers
    Platform, Content & Languages
    1 content types
    1 languages
    CodeEnglish+3 more

    Content Types

    Code

    Accepts

    Code

    Produces

    Code
    Text
    Languages: English

    Frequently Asked Questions

    What can Semgrep do?

    Semgrep can: AI-assisted SAST, SCA, and Secrets Detection, Open-Source Malware Protection with Zero-Day Incident Detection, AI-powered detection, triage, and remediation, Automated noise filtering and false positive reduction. Best for: Developers building and shipping code securely.

    How much does Semgrep cost?

    Semgrep offers a free plan, with paid plans starting from $30/month.

    Is Semgrep free?

    Semgrep offers a free plan with limited features. Paid upgrades are available for advanced usage.

    What makes Semgrep unique?

    Semgrep combines deterministic static analysis with AI reasoning to understand code context, eliminate false positives, and prioritize reachable vulnerabilities, validated by 95% of security reviewers.

    Does Semgrep have an API?

    Yes, Semgrep offers a public API for developers to integrate its capabilities into custom applications and workflows.

    What platforms does Semgrep support?

    Semgrep is available on web, CLI, and API.

    What languages does Semgrep support?

    Semgrep supports English.

    Who is Semgrep for?

    Semgrep is designed for Developers building and shipping code securely; AppSec teams seeking high-signal results and reduced false positives; CISOs needing measurable security outcomes and unified visibility.