semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

semgrep Copyleft license LGPL-2.1-or-later Active ★ 16,206 v1.173.0 released 2026-08-13

Install

semgrep on PyPI

pip

pip install semgrep

uv

uv add semgrep

poetry

poetry add semgrep

Package facts

License	LGPL-2.1-or-later (copyleft)
Python support	supports the current Python release (>=3.10)
Install friction	medium — platform-specific wheel
Runtime dependencies	27 — attrs, boltons, click-option-group, click, colorama, exceptiongroup, glom, jsonschema, mcp, opentelemetry-api, opentelemetry-sdk, opentelemetry-exporter-otlp-proto-http, opentelemetry-instrumentation-requests, opentelemetry-instrumentation-threading, packaging, peewee, pyjwt, requests, rich, ruamel.yaml, ruamel.yaml.clib, semantic-version, tomli, typing-extensions, urllib3, wcmatch, pywin32
Maintenance	actively maintained — 0 days since the last release
Last repo commit	2026-08-13
First released	2020-05-06
Popularity	one of the top 1,000 most-downloaded packages on PyPI (30-day window, as of 2026-08-13)
Known vulnerabilities	none known (OSV.dev, checked 2026-08-13)

Evidence: semgrep-1.173.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-macosx_10_14_x86_64.whl; semgrep-1.173.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-macosx_11_0_arm64.whl; semgrep-1.173.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-manylinux_2_34_aarch64.whl; semgrep-1.173.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-manylinux_2_34_x86_64.whl; semgrep-1.173.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-musllinux_1_2_aarch64.whl; semgrep-1.173.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-musllinux_1_2_x86_64.whl; semgrep-1.173.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-win_amd64.whl

Environment :: ConsoleOperating System :: MacOSOperating System :: Microsoft :: WindowsOperating System :: POSIX :: LinuxProgramming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Topic :: SecurityTopic :: Software Development :: Quality Assurance

About semgrep

from the package's own PyPI description — quoted content, verbatim

<br /> <p align="center"> <a href="https://semgrep.dev"> <picture> <source media="(prefers-color-scheme: light)" srcset="images/semgrep-logo-light.svg"> <source media="(prefers-color-scheme: dark)" srcset="images/semgrep-logo-dark.svg"> <img src="https://raw.githubusercontent.com/semgrep/semgrep/develop/images/semgrep-logo-light.svg" height="100" alt="Semgrep logo"/> </picture> </a> </p> <h2 align="center"> Code scanning at ludicrous speed. </h2> <p align="center"> <a href="https://formulae.brew.sh/formula/semgrep"> <img src="https://img.shields.io/homebrew/v/semgrep?style=flat-square" alt="Homebrew" /> </a> <a href="https://pypi.org/project/semgrep/"> <img alt="PyPI" src="https://img.shields.io/pypi/v/semgrep?style=flat-square&color=blue"> </a> <a href="https://semgrep.dev/docs/"> <img src="https://img.shields.io/badge/docs-semgrep.dev-purple?style=flat-square" alt="Documentation" /> </a> <a href="https://go.semgrep.dev/slack"> <img src="https://img.shields.io/badge/slack-3.5k%20members-green?style=flat-square" alt="Join Semgrep community Slack" /> </a> <a...

Read as markdown · JSON record · Source repository · Homepage · Docs

AI interpretation — verify before relying

AI-generated interpretation of the package facts above; every digit, version, license, or vulnerability id it cites is grounded in the facts already shown on this page

Semgrep is a fast, open-source static analysis tool that searches code for bugs, security vulnerabilities, and coding standard violations across 30+ languages using patterns that resemble the code itself.

Medium install friction due to 27 runtime dependencies and pre-built wheels across multiple platforms (macOS x86_64/arm64, Linux x86_64/aarch64, Windows). Active maintenance with days_since_release of 0 indicates solid project health.

Licensed under LGPL-2.1-or-later (copyleft), meaning derivative works must be distributed under compatible open-source terms. Review your usage context if bundling or modifying the package.

Usage

pip install semgrep
semgrep login
semgrep scan /path/to/code

Requires Python 3.10 or later; login to semgrep.dev recommended for access to Pro rules and Supply Chain scanning.

Verdict: Semgrep is actively maintained with zero known vulnerabilities and broad language support. Its copyleft LGPL-2.1-or-later license and medium install friction (27 runtime dependencies) are offset by comprehensive feature set for code quality and security analysis.

Needs verification

Community adoption metrics and real-world deployment scale beyond maintenance status.
Whether the 27 runtime dependencies introduce any transitive security or maintenance concerns.
Performance characteristics and resource requirements for large codebases or CI/CD environments.
Practical accuracy of Community Edition detection rates compared to AppSec Platform capabilities.

static code analysis toolsecurity vulnerability scannercode pattern matchingSAST security scanningbug detection lintersemantic code searchCI/CD security scanning