Semgrep
Static analysis for code, dependencies and secrets, with AI triage
Overview
Semgrep is a security scanning platform for code (35+ languages), open-source dependencies and secrets, built on an engine whose rules read like the code they match. Semgrep Multimodal adds AI triage and fixes. The Community Edition engine is LGPL-2.1; the Free Edition covers 10 contributors, and Teams starts at $30 per contributor a month.
Pricing
Pricing shown for reference only. These figures reflect RECATOOLS research as of 12 Oct 2026 and may be out of date or incomplete. This is not financial or purchasing advice — always confirm the current price on the provider’s official website before making any decision.
- Open-source scanning engine
- Community rules, no login required
- Cross-file analysis with Pro rules
- Code and Supply Chain
- AI detection, triage and remediation; 60 AI credits
- Up to 10 repositories
- 20 AI credits per developer a month
- Single sign-on
- Up to 500 private repositories
- Support
- On-premises source control support
- 50 AI credits per developer a month
- Optional dedicated infrastructure
- Unlimited repos and contributors; dedicated account manager
Use cases
What you can produce with Semgrep
- Static analysis across 35+ languages with custom rules that read like code
- Dependency scanning with reachability analysis and SBOMs
- Secrets detection with validation (Teams add-on)
- AI triage, fix suggestions and logic-flaw detection with Semgrep Multimodal
- CI integration plus VS Code and JetBrains plugins
- Open-source Community Edition CLI for local scans
Semgrep is one of the most practical code-security scanners: fast, easy to extend with custom rules, and backed by reachability-aware dependency scanning and secrets detection. Its AI triage, now called Multimodal, is included in a limited form even on the free plan.
Watch the licences. The engine is open source, but its rules and some features are not, which is why a group of vendors forked it as Opengrep. Pricing is per contributor, so costs climb with team size, and no data-residency regions are named.
What we found
Semgrep is a static analysis platform for finding security bugs, vulnerable dependencies and leaked secrets in code. It grew from an open-source engine whose rules look like the code they match, which makes custom checks unusually easy to write, and it is run by Semgrep Inc., a San Francisco company started by Drew Dennison, Isaac Evans and Luke O'Malley. A $100 million Series D led by Menlo Ventures in February 2025 took its total funding to $204 million.
The commercial platform has three products: Code for static analysis across more than 35 languages, Supply Chain for dependency scanning with reachability analysis and SBOMs, and Secrets for credential detection with validation. Its AI layer, renamed from Assistant to Semgrep Multimodal, triages findings, suggests fixes and looks for logic flaws such as broken authorisation; Semgrep says it categorises false positives with over 95 per cent accuracy, a vendor figure. When AI is on, only the part of a file around a finding is sent to model providers, and scans run locally or in CI otherwise keep code on your machines.
Pricing is more generous than this page used to say. The Free Edition covers up to ten contributors and ten private repositories with cross-file Pro rules, Code and Supply Chain, and 60 AI credits. Teams starts at $30 per contributor a month for Code or Supply Chain, with Secrets at $15, and adds single sign-on; Enterprise adds on-premises source control support, dedicated infrastructure and volume pricing.
The open-source engine is now Semgrep Community Edition under LGPL-2.1. In December 2024 Semgrep moved some features behind a login and put its rules under a licence that bars competing use, and about ten security vendors responded by forking the engine as Opengrep, which remains active.
Semgrep holds 4.6 out of 5 from 56 reviews on G2 and 4.4 from 15 on Gartner Peer Insights. It suits teams that want fast, customisable scanning with a usable free tier.
Compiled by RECATOOLS from public sources: vendor documentation and pricing, code repositories and published reporting.
About this listing
This entry was compiled from publicly available data including Semgrep's official website, press releases, documentation, and reputable third-party publications. RECATOOLS is not affiliated with Semgrep unless explicitly stated.
Third-party AI tools update their pricing, features, availability, and policies frequently. Information here may be outdated by the time you read this — we make reasonable efforts to keep listings current, but cannot guarantee absolute accuracy.
For the latest details, please refer to Semgrep directly →
Spotted something out of date? Suggest an update →
Semgrep in the news
Alternatives to Semgrep
More in Security & Safety
