Skip to main content
  • Semgrep Supply Chain
  • Semgrep OSS Engine
  • Team & Enterprise Tier

Supported languages

This document provides information about supported languages and language maturity definitions for the following products:

  • Semgrep Code
  • Semgrep OSS

For commercial Semgrep offerings, check the Semgrep Pro > Supported languages page.

Semgrep Code and OSS​

Semgrep OSS is a fast, lightweight program analysis tool that can help you detect security issues in your code. It makes use of Semgrep's LGPL 2.1 open-source engine.

Semgrep Code is a static application security testing SAST solution that uses both Semgrep OSS Engine and a proprietary Semgrep Pro engine. This engine can perform more complex code analyses, resulting in a higher true positive rate than Semgrep OSS.

Use either tool to scan local code or integrate it into your CI/CD pipeline to automate the continuous scanning of your repositories.

ProductAnalysis
Semgrep OSS
  • Single-function analysis
  • Single-file analysis
Semgrep Code
  • All analyses in the OSS Engine
  • Cross-file (interfile) analysis
  • Cross-function (interprocedural) analysis

Language maturity levels​

Semgrep Code languages can be classified into four maturity levels:

  • Generally available (GA)
  • Beta
  • Experimental
  • Community supported*

*Community supported languages meet the parse rate and syntax requirements of Experimental languages. Users can still access community rules or write their own rules.

Their differences are outlined in the following table:

FeatureGABetaExperimentalCommunity supported
Parse Rate99%+95%+90%+
Number of rules10+5+0+. Query the Registry to see if any rules exist for your language.
Semgrep syntaxRegex, equivalence, deep expression operators, types and typing. All features supported in Beta.Complete metavariable support, metavariable equality. All features supported in Experimental.Syntax, ellipsis operator, basic metavariable functionality.
SupportHighest quality support by the Semgrep team. Reported issues are resolved promptly.Supported by the Semgrep team. Reported issues are fixed after GA languages.There are limitations to this language's functionality. Reported issues are tracked and prioritized with best effort.These languages are supported by the Semgrep community. While Semgrep may develop rules or engine updates for these languages, they are not prioritized.

Semgrep Code language support​

Semgrep Code supports over 30 languages and counting! 🚀

LanguageMaturity levelCross-function analysisCross-file analysis
CGA✅✅
C++GA✅✅
C#GA✅✅
GoGA✅✅
JavaGA✅✅
JavaScriptGA✅✅
KotlinGA✅✅
TypeScriptGA✅✅
RubyGA✅--
RustGA✅--
JSXGA✅--
PHPGA✅--
PythonGA✅--
ScalaGA✅--
SwiftGA✅--
GenericGA----
JSONGA----
TerraformGA----
ApexBeta✅--
ElixirBeta✅--

The following languages are Experimental:

  • Bash
  • Cairo
  • Clojure
  • Dart
  • Dockerfile
  • Hack
  • HTML
  • Jsonnet
  • Julia
  • Lisp
  • Lua
  • Ocaml
  • R
  • Scheme
  • Solidity
  • YAML
  • XML

If you'd like to request a language not shown here, please create an issue on the Semgrep GitHub repo.

Semgrep OSS language support​

All Semgrep OSS languages are community supported. Community supported languages meet the parse rate and syntax requirements of experimental languages in Semgrep Code. Semgrep OSS uses Semgrep's open source engine.

Community supported languages have varying levels of rule coverage - check the registry and filter out Pro rules to see the level of coverage for OSS.

Click to view Semgrep OSS languages.
  • Bash
  • C
  • C++
  • C#
  • Cairo
  • Clojure
  • Dart
  • Dockerfile
  • Generic
  • Go
  • Hack
  • HTML
  • Java
  • JavaScript
  • JSON
  • Jsonnet
  • Julia
  • Lisp
  • Lua
  • Kotlin
  • Ruby
  • Rust
  • JSX
  • Ocaml
  • PHP
  • Python
  • R
  • Scala
  • Scheme
  • Solidity
  • Swift
  • TypeScript
  • YAML
  • XML

More information​

Visit the cheat sheet generation script and associated semgrep-core test files to learn more about each feature:

Visit the Semgrep public language dashboard to see the parse rates for each language

Not finding what you need in this doc? Ask questions in our Community Slack group, or see Support for other ways to get help.