Semgrep
- Source repository: semgrep/semgrep. GitHub/Star: 16009 (checked 2026-07-25).
- Fast static-analysis tool that finds bugs and security issues by matching lightweight, syntax-aware patterns over code. Rules are written as data in YAML, where
$X metavariables capture a subexpression and can be reused within the same rule; rules install from a registry, and no user code is required. - Descends from
sgrep, written by Yoann Padioleau as part of the pfff library, and renamed Semgrep in 2020. - Maintained by SemgrepCo.
- Written in OCaml, with a Python CLI.