Semgrep

Overview

Semgrep is an open-source static analysis engine (LGPL-2.1 CLI, repository semgrep/semgrep) that matches code structure instead of text, so a rule reads almost like the source it finds. It supports 30+ languages. The CLI runs locally and offline with your own rules; community rules come from the Semgrep Registry; the paid Semgrep AppSec Platform adds dashboards, triage and diff-aware CI. This skill was checked against Semgrep 1.178 and 1.179 (September 2026).

Instructions

Install

python3 -m pip install semgrep      # needs Python 3.10+
# or: brew install semgrep          # Homebrew no longer supports Intel Macs
# or: docker run --rm -v "$PWD:/src" semgrep/semgrep semgrep scan --config p/security-audit
semgrep --version

Scan