# Semgrep

> Semgrep is an application security platform that finds and helps fix vulnerabilities in code. Semgrep AppSec Platform (this site) manages findings, policies, and integrations across an organization. Semgrep Community Edition (CE) is the open-source (LGPL 2.1) engine and runs locally from the `semgrep` CLI.

Documentation lives at https://docs.semgrep.dev. Add `.md` to the end of any docs page URL to get clean Markdown, for example https://docs.semgrep.dev/getting-started/quickstart.md. Most of the web app at https://semgrep.dev requires login, except the rule registry and playground. If you are working for a user, use the API or CLI instead of scraping the app.

## Start here

- [Docs index for LLMs](https://docs.semgrep.dev/llms.txt): Full, curated map of every docs page with descriptions. Start here for anything beyond this file.
- [Full docs as one file](https://docs.semgrep.dev/llms-full.txt): All documentation concatenated as Markdown (several MB).
- [Quickstart](https://docs.semgrep.dev/getting-started/quickstart.md): Install the CLI, log in, and run a first scan.
- [Semgrep AppSec Platform versus Community Edition](https://docs.semgrep.dev/semgrep-pro-vs-oss.md): What you get with and without an account.
- [Supported languages](https://docs.semgrep.dev/supported-languages.md): Language and feature coverage per product.

## Products

- [Semgrep Code](https://docs.semgrep.dev/semgrep-code/overview.md): Static analysis (SAST) for first-party code. Analyzes across functions by default, with optional cross-file analysis.
- [Semgrep Supply Chain](https://docs.semgrep.dev/semgrep-supply-chain/overview.md): Dependency scanning with reachability analysis, SBOMs, and license compliance.
- [Semgrep Secrets](https://docs.semgrep.dev/semgrep-secrets/conceptual-overview.md): Secrets detection with validation of whether a credential is live.
- [Semgrep Multimodal](https://docs.semgrep.dev/semgrep-multimodal/overview.md): AI-powered detection, triage, and remediation. Formerly Semgrep Assistant.
- [Semgrep Guardian](https://docs.semgrep.dev/semgrep-guardian/overview.md): Scans code as AI coding agents write it and gives the agent findings to fix.
- [Semgrep Managed Scans](https://docs.semgrep.dev/deployment/managed-scanning/overview.md): Scan repositories from the platform without changing CI.
- [Semgrep Network Broker](https://docs.semgrep.dev/semgrep-ci/network-broker.md): Give the platform secure access to services on your private network, such as a self-hosted source code manager.

## Common tasks

- Install the CLI: `pipx install semgrep` or `uv tool install semgrep` (preferred). `brew install semgrep` also works but often lags behind the latest release.
- Scan with registry rules, no account needed: `semgrep scan --config auto` (or `--config p/<ruleset>`). This fetches rules from the registry and sends your project URL and anonymous metrics. For a fully offline scan, use `semgrep scan --config path/to/rule.yaml --metrics off`. Add `--json` or `--sarif` for machine-readable output.
- Scan with your organization's policies and send results to the platform: `semgrep login`, then `semgrep ci`.
- [CLI reference](https://docs.semgrep.dev/cli-reference.md): Every command and flag.
- [Write rules](https://docs.semgrep.dev/writing-rules/overview.md): Rule anatomy, [pattern syntax](https://docs.semgrep.dev/writing-rules/pattern-syntax.md), [rule syntax](https://docs.semgrep.dev/writing-rules/rule-syntax.md), and [testing rules](https://docs.semgrep.dev/writing-rules/testing-rules.md).
- [Playground](https://semgrep.dev/playground/new): Write and test a rule in the browser.

## AI coding agents

- [Choose a Guardian setup](https://docs.semgrep.dev/semgrep-guardian/choose-your-setup.md): Guardian supports Claude Code, Cursor, Codex, GitHub Copilot, VS Code, Devin (Windsurf), Kiro, and other MCP-compatible agents. Compares the remote Claude Code plugin with local CLI, MCP, and hook integrations.
- [Set up Guardian with other IDEs](https://docs.semgrep.dev/semgrep-guardian/ide-setup/other.md): Add the Semgrep MCP server or a post-write hook to any MCP-compatible agent.

## Rule registry

- [Registry](https://semgrep.dev/explore): Browse public rules and rulesets. The page for a single rule is at `https://semgrep.dev/r/<rule-id>`.
- `https://semgrep.dev/c/p/<ruleset>`: Raw YAML for a ruleset, for example [p/default](https://semgrep.dev/c/p/default). This is the URL the CLI fetches for `--config p/<ruleset>`, and it isn't formally documented. Requests without a login leave out Pro rules and don't say so.
- `https://semgrep.dev/c/r/<rule-id>`: Raw YAML for rules whose ID starts with the given prefix. A full ID such as [python.lang.security.audit.eval-detected.eval-detected](https://semgrep.dev/c/r/python.lang.security.audit.eval-detected.eval-detected) returns one rule. Also undocumented, with the same Pro-rule caveat.

## API

- [API v1 introduction](https://docs.semgrep.dev/api-reference/v1/Introduction.md): Requires a Team or Enterprise account. An admin creates a token at [Settings > Tokens > API tokens](https://semgrep.dev/orgs/-/settings/tokens/api) with the **Web API** scope. Send it as `Authorization: Bearer <token>`. Tokens without the Web API scope, such as CI tokens, can't call the API.
- [OpenAPI spec, v1](https://docs.semgrep.dev/public_v1.openapi.yaml): Deployments, projects, findings, triage, scans, secrets, dependencies, SBOM export, and tickets. Start with `GET /api/v1/deployments` to find your deployment slug and ID.
- [OpenAPI spec, v2](https://docs.semgrep.dev/public_v2.openapi.yaml): Newer API, still expanding. Each endpoint is marked Experimental, Beta, or Stable. [Introduction](https://docs.semgrep.dev/api-reference/v2/Introduction.md).

## Optional

- [Semgrep Community Edition](https://github.com/semgrep/semgrep): Source, issues, and releases for the open-source engine and CLI.
- [Semgrep rules](https://github.com/semgrep/semgrep-rules): Source for Semgrep-maintained registry rules. Licensed under the Semgrep Rules License v1.0: internal business use only, not for use in competing products. Third-party registry rules keep their own licenses.
- [Licensing](https://docs.semgrep.dev/licensing.md)
- [Release notes](https://docs.semgrep.dev/release-notes.md)
- [Pricing](https://semgrep.dev/pricing)