What it does
Semgrep is an application security platform covering SAST, scanning of open source dependencies and secrets detection, along with malware protection for packages. The site pairs deterministic, rule-based analysis with AI reasoning, aiming to catch issues such as broken authorization and multi-step logic flaws. AI is used to triage findings with code context and earlier decisions, and to produce remediation and upgrade guidance in pull requests and IDEs. Triage decisions made by people are kept as reusable memories so that repeat false positives are suppressed later. Semgrep runs from the command line, in CI/CD and in the VS Code and JetBrains IDEs, with PR checks on GitHub, GitLab and Bitbucket, ticketing integrations, APIs, webhooks and MCP integrations for AI tools such as Cursor and Replit. The site also links to a rule registry, an online playground for writing and sharing rules, and a Community Edition.
Capabilities
- SAST, dependency and secrets scanning in one platform
- AI-assisted triage that filters likely false positives
- Remediation guidance in pull requests and IDEs
- Reusable triage memories that suppress repeat false positives
- Open source malware protection for packages
- CLI, CI/CD, IDE, API, webhook and MCP integrations
When to use it
- Scanning a codebase for vulnerabilities, hardcoded secrets and risky dependencies
- Cutting down the noise in security findings that a team reviews by hand
- Checking AI-generated code as it is written
- Writing and sharing custom detection rules
