← All repos

semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

GitHubsemgrep.dev
cgojavajavascriptpythonr2crubysastsemgrepstatic-analysisstatic-code-analysistypescript
Browse cluster: Static Analysis & Code Quality →
10,243commits
250contributors
27languages

Tech stack & purpose

Semgrep is a fast static analysis tool that searches code, finds bugs, and enforces secure guardrails and coding standards across many programming languages including C, Go, Java, JavaScript, Python, Ruby, and TypeScript. The project is built on a two-part architecture: a Python command-line interface that handles orchestration and communication with the Semgrep AppSec Platform, and an OCaml engine (`semgrep-core`) responsible for parsing, pattern matching, and analysis. The core engine processes code through a multi-stage pipeline converting source code to a Generic Abstract Syntax Tree, optionally to an Intermediate Language representation, then performs semantic pattern matching against rules to identify issues. Semgrep is developed and maintained as an open-source Community Edition project.

Community & reference links

Languages

OCaml
76.2%
Python
20.3%
Standard ML
1.1%
C
0.5%
Shell
0.3%
Ruby
0.3%
Makefile
0.3%
Nix
0.2%
Dockerfile
0.2%
Dune
0.1%
Jsonnet
0.1%
Java
0.1%
Scala
0.1%
Elixir
0.1%
Swift
0.0%
PHP
0.0%
Mustache
0.0%
HTML
0.0%
JavaScript
0.0%
C#
0.0%
HCL
0.0%
Jinja
0.0%
C++
0.0%
Go
0.0%
Max
0.0%
Vue
0.0%
Rust
0.0%

Contributors (top 30 of 250)