Skip to main content
Join the official 2020 Python Developers SurveyStart the survey!

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

Project description

Semgrep logo

Lightweight static analysis for many languages.
Find and block bug variants with rules that look like source code.

Getting Started · Examples · Resources
Usage · Contributing · Commercial Support

Homebrew PyPI Issues welcome! Issues welcome! 1500+ GitHub stars

Semgrep tl;dr:

  • A simple, customizable, and fast static analysis tool for finding bugs
  • Combines the speed and customization of grep with the precision of traditional static analysis tools
  • No painful domain-specific language; Semgrep rules look like the source code you’re targeting
  • Batteries included with hundreds of existing community rules for OWASP Top 10 issues and common mistakes
  • Runs in CI, at pre-commit, or in the editor
  • Runs offline on uncompiled code

Semgrep supports:

Go Java JavaScript JSON Python Ruby (beta) JSX (beta) C (alpha) OCaml (alpha)

Semgrep is proudly supported by r2c. Learn more about a hosted version of Semgrep with an enterprise feature set at

Getting Started

The best place to start with Semgrep and rule writing is its Quick Start. For a more in-depth introduction to its syntax and use cases visit the Semgrep Tutorial.

Semgrep can be installed using brew, pip, or docker:

# For macOS
$ brew install semgrep

# On Ubuntu/WSL/linux, we recommend installing via `pip`
$ python3 -m pip install semgrep

# To try Semgrep without installation run via Docker
$ docker run --rm -v "${PWD}:/src" returntocorp/semgrep --help

To confirm installation and get an overview of Semgrep's functionality run with --help:

$ semgrep --help

Once installed, Semgrep can be run with single rule patterns or entire rule packs:

# Check for Python == where the left and right hand sides are the same (often a bug)
$ semgrep -e '$X == $X' --lang=py path/to/src

# Run a rule pack with rules for many languages
$ semgrep --config= path/to/src

Explore the Semgrep Registry of rules and CI integrations at


Use case Semgrep rule
Ban dangerous APIs Prevent use of exec
Search routes and authentiation Extract Spring routes
Enforce the use secure defaults Securely set Flask cookies
Enforce project best-practices Use assertEqual for == checks, Always check subprocess calls
Codify project-specific knowledge Verify transactions before making them
Audit security hotspots Finding XSS in Apache Airflow, Hardcoded credentials
Audit configuration files Find S3 ARN uses
Migrate from deprecated APIs DES is deprecated, Deprecated Flask APIs, Deprecated Bokeh APIs
Apply automatic fixes Use listenAndServeTLS

Try it out

Give some rule packs a spin by running on known vulnerable repositories:

# juice-shop, a vulnerable Node.js + Express app
$ git clone
$ semgrep -f juice-shop
# railsgoat, a vulnerable Ruby on Rails app
$ git clone
$ semgrep -f railsgoat
# govwa, a vulnerable Go app
$ git clone
$ semgrep -f govwa
# vulnerable Python+Flask app
$ git clone
$ semgrep -f Vulnerable-Flask-App
# WebGoat, a vulnerable Java+Sprint app
$ git clone
$ semgrep -f WebGoat


Learn more:

Get in touch:


Command Line Options

See semgrep --help for command line options.

Exit Codes

semgrep may exit with the following exit codes:

  • 0: Semgrep ran successfully and found no errors
  • 1: Semgrep ran successfully and found issues in your code
  • >=2: Semgrep failed to run


To upgrade, run the command below associated with how you installed Semgrep:

# Using HomeBrew
$ brew upgrade semgrep

# Using `pip`
$ python3 -m pip install --upgrade semgrep

# Using Docker
$ docker pull returntocorp/semgrep:latest


Semgrep is LGPL-licensed, feel free to help out: CONTRIBUTING.

Semgrep is a frontend to a larger program analysis library named pfff. pfff began and was open-sourced at Facebook but is now archived. The primary maintainer now works at r2c. Semgrep was originally named sgrep and was renamed to avoid collisons with existing projects.

Commercial Support

Semgrep is supported by r2c. We're hiring!

Interested in a fully-supported, hosted version of Semgrep? Drop your email and we'll be in touch!

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for semgrep, version 0.21.0
Filename, size File type Python version Upload date Hashes
Filename, size semgrep-0.21.0-cp36.cp37.cp38.py36.py37.py38-none-macosx_10_14_x86_64.whl (28.7 MB) File type Wheel Python version cp36.cp37.cp38.py36.py37.py38 Upload date Hashes View
Filename, size semgrep-0.21.0-cp36.cp37.cp38.py36.py37.py38-none-manylinux1_x86_64.whl (30.3 MB) File type Wheel Python version cp36.cp37.cp38.py36.py37.py38 Upload date Hashes View
Filename, size semgrep-0.21.0.tar.gz (63.4 kB) File type Source Python version None Upload date Hashes View

Supported by

Pingdom Pingdom Monitoring Google Google Object Storage and Download Analytics Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page