spb/tools-spboucher-ai

1{2  "slug": "semgrep",3  "name": "Semgrep",4  "aliases": ["Semgrep Community Edition", "Semgrep CE", "Semgrep AppSec Platform"],5  "vendor": { "name": "Semgrep, Inc.", "slug": "semgrep-inc", "website": "https://semgrep.dev" },6  "homepage_url": "https://semgrep.dev/",7  "docs_url": "https://docs.semgrep.dev/",8  "repo_url": "https://github.com/semgrep/semgrep",9  "pricing_url": "https://semgrep.dev/pricing/",10  "license_url": "https://github.com/semgrep/semgrep/blob/develop/LICENSE",11  "product_type": "cli-tool",12  "product_status": "active",13  "summary": "Static analysis engine that matches code patterns written in the target language's own syntax, with an LGPL community edition and a commercial AppSec platform",14  "description": "Semgrep is a static analysis tool from Semgrep, Inc. Its engine, released as Semgrep Community Edition under LGPL-2.1, lets users write rules as code snippets with metavariables and ellipses in the syntax of the language being analyzed, rather than in an abstract query language, and supports dozens of languages including Python, JavaScript and TypeScript, Go, Java, Rust, Swift and infrastructure formats. A public registry supplies thousands of rules for security, correctness and style, runnable locally with `semgrep --config`.\n\nThe commercial Semgrep AppSec Platform builds on the engine with cross-file and cross-function dataflow analysis, proprietary Pro rules, software composition analysis of dependencies, secrets detection, and a hosted dashboard that tracks findings across repositories and posts them into pull requests. A free tier of the platform exists for small teams.\n\nIn the community edition analysis is largely intra-file, so some taint-tracking findings are only available in the paid product. The rule-writing model is easy to start with but false positives require tuning, and a 2024 licensing change to the rules registry led to a community fork, Opengrep.",15  "capabilities": ["Pattern-based rules written in the target language with metavariables", "Support for many programming languages and configuration formats", "Public rule registry and custom rule authoring", "CI integration and SARIF output", "Pro engine with interfile dataflow, SCA and secrets detection (commercial)", "Hosted dashboard and pull-request comments (commercial)"],16  "workflows": ["Run security rules in CI on every pull request", "Write a custom rule to ban a deprecated API in a codebase", "Scan dependencies and secrets from the AppSec Platform"],17  "advantages": ["Rules read like the code they match", "Fast local scans without building the project", "Large public rule registry"],18  "limitations": ["Deeper interfile analysis reserved for the paid engine", "False positives require rule tuning", "Rules registry licensing has shifted; verify terms before redistribution"],19  "prerequisites": ["Python or a standalone binary; optional Semgrep account for the platform"],20  "audiences": ["Application security engineers", "Developers adding static checks to CI"],21  "alternatives": ["trivy"],22  "comparison_notes": "Trivy focuses on vulnerabilities in dependencies, container images and infrastructure configuration rather than on patterns in first-party source code; the two are complementary in a CI pipeline.",23  "categories": [{ "slug": "security-tools", "primary": true }, { "slug": "testing-qa" }],24  "tags": ["static-analysis", "sast", "security", "cli", "ci", "open-source", "saas"],25  "use_cases": ["scan-code-for-vulnerabilities"],26  "operating_systems": ["macos", "linux", "windows"],27  "execution_modes": ["local", "cloud"],28  "interfaces": ["cli", "web", "ide-extension"],29  "deployment_models": ["desktop", "saas"],30  "integrations": ["GitHub Actions", "GitLab CI", "Visual Studio Code", "SARIF consumers"],31  "data_formats": ["YAML rules", "SARIF", "JSON"],32  "languages": ["OCaml", "Python"],33  "source_model": "mixed",34  "license_spdx": "LGPL-2.1-only",35  "pricing_model": ["open-source", "freemium", "paid", "enterprise"],36  "pricing_checked_at": "2026-11-02",37  "self_hostable": true,38  "sources": [39    { "url": "https://semgrep.dev/", "type": "official_site", "title": "Semgrep AppSec Platform", "supports": ["name", "summary", "capabilities"], "checked_at": "2026-11-02" },40    { "url": "https://docs.semgrep.dev/", "type": "official_docs", "title": "Semgrep Documentation", "supports": ["capabilities", "languages", "workflows"], "checked_at": "2026-11-02" },41    { "url": "https://github.com/semgrep/semgrep/blob/develop/LICENSE", "type": "license_page", "title": "Semgrep LICENSE (LGPL-2.1)", "supports": ["license_spdx", "source_model"], "checked_at": "2026-11-02" },42    { "url": "https://semgrep.dev/pricing/", "type": "pricing_page", "title": "Semgrep Pricing", "supports": ["pricing_model"], "checked_at": "2026-11-02" }43  ],44  "confidence": "high",45  "discovery_method": "editorial-research",46  "depth": "standard",47  "editorial_status": "reviewed",48  "visibility": "public",49  "featured": false,50  "author": "batch-B2"51}52