← All repos

semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

GitHubsemgrep.dev
cgojavajavascriptpythonr2crubysastsemgrepstatic-analysisstatic-code-analysistypescript
Browse cluster: Static Analysis & Code Quality →
10,231commits
250contributors
27languages

Tech stack & purpose

Semgrep is a fast, open-source static analysis tool built by a team with a documented community and commercial offering. The project is written in OCaml for its core engine (semgrep-core), which handles parsing, pattern matching, and analysis across 30+ languages including Python, Java, Go, JavaScript, Ruby, TypeScript, and C, while a Python command-line interface orchestrates the tool and communicates with the Semgrep AppSec Platform. The core architecture converts source code to a unified Generic Abstract Syntax Tree, performs semantic pattern matching using rules that resemble source code syntax, and operates through a multi-stage pipeline of parsing, analysis, intermediate language conversion, pattern matching, and reporting. The technology stack includes OCaml with Dune as the build system, Python 3 with the uv dependency manager, and integrations with external services, tree-sitter parsers for language support, and Git-based workflows with pre-commit hooks and GitHub Actions for continuous integration and deployment.

Community & reference links

Languages

OCaml
76.2%
Python
20.2%
Standard ML
1.1%
C
0.5%
Shell
0.3%
Ruby
0.3%
Makefile
0.3%
Nix
0.2%
Dockerfile
0.2%
Dune
0.1%
Jsonnet
0.1%
Java
0.1%
Scala
0.1%
Elixir
0.1%
Swift
0.0%
PHP
0.0%
Mustache
0.0%
HTML
0.0%
JavaScript
0.0%
C#
0.0%
HCL
0.0%
Jinja
0.0%
C++
0.0%
Go
0.0%
Max
0.0%
Vue
0.0%
Rust
0.0%

Contributors (top 30 of 250)