Semgrep
Code security scanning with static analysis and AI triage
Semgrep is a code security platform from Semgrep, Inc. that scans source code and dependencies for vulnerabilities. It combines static application security testing (Semgrep Code), software composition analysis (Semgrep Supply Chain), secrets detection and malware protection, including a firewall that blocks malicious packages from public registries. The vendor says it pairs deterministic static analysis with AI reasoning to catch issues such as IDORs and broken authorization, triages findings using code context and past decisions, and suggests fixes in pull requests and IDEs. It runs from the CLI, CI/CD, VS Code and JetBrains, and checks pull requests on GitHub, GitLab, Bitbucket and Azure. MCP integrations connect it to AI coding tools.
- Filed under
- Code Assistance
- Pricing
- Freemium
- Platforms
- desktop · api
- Last updated
- November 10, 2026
What Semgrep does
- Semgrep Code (SAST). Static analysis that finds vulnerabilities in first-party code.
- Semgrep Supply Chain. Software composition analysis for open-source dependencies, with malware blocking.
- Semgrep Secrets. Detects hardcoded secrets using semantic analysis.
- AI triage and fixes. Triages findings using code context and proposes remediation in PRs and IDEs.
- Semgrep Guardian. Scans AI-generated code as it is written.
Who it’s for
- AppSec teams adding scanning to CI pipelines
- Developers wanting security checks in their IDE
- Teams reviewing code from AI coding agents
Semgrep pricing
Free up to 10 contributors; Teams from $30/contributor/mo for Code or Supply Chain, Secrets $15/contributor/mo; Enterprise custom.
As listed on November 9, 2026. Check semgrep.dev for current prices.
Things to know
- Free Edition limited to 10 contributors and 10 private repositories
- Paid Teams plan is priced per contributor per product
- AI credits are capped per developer each month
Quick answers
- What is Semgrep?
- Semgrep is a code security platform from Semgrep, Inc.
- Is Semgrep free?
- Semgrep has a free plan. Paid plans start at $15 a month. (As listed on November 9, 2026.)
- Who makes Semgrep?
- Semgrep is made by Semgrep, Inc..
- Where can you use Semgrep?
- Semgrep is available on desktop (apps, editor plugins or browser extensions) and an API for developers.
- What are some alternatives to Semgrep?
- Other tools filed in the same section include Datadog Static Code Analysis, GitHub Copilot and Pieces.
Tags
See also
Cross-referenced entriesDatadog Static Code Analysis
Static code analysis (SAST) with AI-suggested fixes
saststatic-analysiscode-security
GitHub Copilot
AI coding agent and assistant from GitHub
code-completioncoding-agentcode-review
Pieces
On-device AI memory layer for your work context
long-term-memorymcptimeline
Codex CLI
OpenAI's open-source terminal coding agent
clicoding-agentopen-source