Suggest a tool

Semgrep

Repository: semgrep/semgrepHomepage

Metrics as of , from the GitHub or GitLab API of each repository. Refreshed monthly.

What Semgrep is

Semgrep is a static analysis engine that scans source code for bugs and enforces security and coding-standard rules. Its rules resemble the code being searched instead of abstract syntax trees or regular expressions. Semgrep Code lists support for more than 30 languages, including Python, Java, Go, JavaScript, TypeScript, C and Terraform. It runs in an IDE, as a pre-commit check, or inside CI/CD pipelines. Analysis happens locally, and code is not uploaded by default. The semgrep -e option runs ad hoc pattern queries from the terminal. The Community Edition analyzes code within a single function or file. The README lists cross-file, cross-function and data-flow reachability analysis as Semgrep AppSec Platform capabilities.

Written from the project's README, read .

Category
Code quality and static analysis
License
LGPL-2.1
Language
C
Changelog
Releases on GitHub

Repository metrics

Repository metrics
Stars16,7251
Forks1,0661
Open issues and PRs9221
Contributors2411
Commits in the last 90 days1321
Last commit2026-09-221
Last releasev1.177.0, 2026-09-101
Fetched

1 Fetched from the GitHub or GitLab API on . Hover a value for its own date.

Status

activeLast commit within 90 days of the fetch date.

Computed from the last commit date and the archive flag on the fetch date. See the status rules.

Alternatives

Listed code quality and static analysis tools, same primary language first, then by GitHub stars. Each line gives one fact from the tool's documentation where it differs from Semgrep's, with its source. See also Semgrep alternatives.

How to install

python3 -m pip install semgrep
From README, read .

Questions

Is Semgrep open source?

Yes. Semgrep is released under LGPL-2.1, an OSI-approved license, as reported by the GitHub API on 2026-09-22.

Is Semgrep maintained?

On 2026-09-22, the last commit to the default branch was on 2026-09-22, so the listed status is active. Rule: Last commit within 90 days of the fetch date.

How many GitHub stars does Semgrep have?

16,725 stars on 2026-09-22, from the GitHub API. The number is refreshed at each monthly update.

What language is Semgrep written in?

The repository's primary language, as reported by the GitHub API, is C.

How do I install Semgrep?

The README gives this command: python3 -m pip install semgrep

Sources

  1. GitHub REST API: repository, read
  2. GitHub REST API: commits, read
  3. GitHub REST API: latest release, read
  4. GitHub REST API: contributors, read
  5. README, read