Skip to content
Back to the index
25Code reviewProvisional score

Semgrep

Semgrep

Code security platform with an AI Assistant that detects complex vulnerabilities and trims false positives in PRs.

Updated

Visit Semgrep
Semgrep preview

The read

Semgrep combines static analysis with an AI Assistant called Semgrep Assistant that detects authorization flaws, business logic vulnerabilities, and IDORs that pattern-matching rules alone cannot find. The Assistant auto-triages findings, generates tailored PR remediation guidance, and creates reusable memories from past security decisions to prevent repeat false positives. Semgrep reports a 98 percent reduction in SCA false positives and 95 percent user agreement with its findings. A free community tier is available for open-source and small teams. Pricing for paid tiers is not published on the main site, requiring contact with sales.

Where it shines

  • Reduces SCA false positives by up to 98% using reachability analysis
  • Semgrep Assistant builds persistent memory of your team's security decisions
  • Open-source rule set is one of the most widely used security analysis engines

Worth knowing first

  • Paid pricing not public, requiring sales contact for team or enterprise evaluation
  • Primarily a security tool and does not cover general code quality or style issues

Index score

75.8

Provisional. This score is read from the product's public capability, not from the one-prompt rebuild the fully reviewed entries went through, so treat it as a placing rather than a verdict.

Craft78
Speed72
Control80
Value72
Rank
25 of 54
Builds
Tools
Category
Code review
Output
Security-focused PR findings with AI triage and remediation guidance
Pricing
Free tier
Best for
Security engineers wanting AI-triaged SAST, SCA, and secrets detection

Scores are our own editorial judgement, weighted craft 30, speed 25, control 25 and value 20.

Also worth a look

Full index