Semgrep Product Updates

Unified Policies—the single place to configure which rules run where, what blocks a build, and how findings are handled per branch—is now generally available. The Policies v2 API, which supports the new system programmatically, is now in public beta alongside it.

Agentic Workflows enters public beta with nine prebuilt workflows for vulnerability detection, so teams get deep, AI-powered vulnerability hunting across their code. Agentic Workflows hunt for the subtle authentication, injection, and logic flaws that matter most, covering 70+ CWEs across the OWASP Top 10.

Read more on the Semgrep blog: https://semgrep.dev/blog/2026/introducing-semgrep-agentic-workflows-automate-deep-vulnerability-hunting-at-scale/

When a supply chain incident hits, finding out whether you’re affected has meant logging into Semgrep and searching manually. Incident notifications are now live for all Semgrep Supply Chain customers on Unified Policies: when Semgrep's Security Research team declares an incident, Supply Chain checks the account’s SBOM and sends a Slack alert to configured channels showing whether the organization is affected. Teams still using legacy policies need to migrate to Unified Policies to get the notifications.

Guardian now includes MCP tools that let AppSec teams query SAST, SCA, and secrets findings directly using natural language. You can scope a query to specific projects or let the MCP figure out which ones match your question, and pick among Semgrep deployments if you’re in more than one.

Dependency path shows how a vulnerable package reached your project, tracing the chain from your app to the direct dependency to the transitive one, so teams can prioritize and remediate faster. That view has been available in the app and the API, but teams that consume Supply Chain results directly from the CLI had no way to see it there. Semgrep 1.168 adds the --x-dependency-paths flag, so CLI users now get dependency paths alongside any reported vulnerabilities.

The AI usage breakdown on the Usage page is now an interactive daily chart, breaking credit spend into four categories (AI scans, Autotriages, Autofixes, and Workflows) across selectable windows of 7, 30, or 90 days. Click a category in the legend to isolate it, or hover any day for the full breakdown.

For Python users, private registries historically presented a blocker to Semgrep Supply Chain features like dynamic dependency resolution, upgrade guidance, and autofix. Now, with Semgrep Network Broker, it’s possible to access those internal resources and avail the full functionality of Semgrep Supply Chain.

The Semgrep API now supports bulk token deletion. Admin, CI, Member, and CLI tokens each have a dedicated deletion endpoint, so covering all four types takes four API calls. For teams that rotate credentials on a schedule or need to revoke access programmatically after offboarding, this replaces the previous manual, one-at-a-time workflow in the UI.

Setting up policies in Semgrep today requires navigating separate configuration for rule mode, blocking vs. monitoring, and per-branch behavior. Unified policies replaces this with a single interface that covers all three and allows more granular customization. All customers now see a migration banner on the Policies page; the migration is self-service and preserves existing behavior. Customers using the legacy policies API, webhook integrations, or the demo org will be migrated in the coming weeks.

Semgrep v1.163.0 ships parallel rule parsing and validation, better data-structure caching, a faster JSON parser, and rule pre-filtering. These changes cause p50 and p75 scan times to fall by ~25-30% (for full and diff scans) versus Semgrep v1.162.0.