What it does
Semgrep combines a command-line code scanner with a hosted AppSec Platform. Developers can scan a codebase for security issues, then use the platform for team workflows and additional checks such as dependency and secrets analysis. It fits security checks before code is merged; it is not a substitute for tests that exercise an application while it runs.
Start with the code you want to check
Semgrep's quick start asks for Python 3.10 or later on the machine running its CLI. It documents installing the CLI with pipx or uv, then scanning a project with semgrep scan. The project can be a codebase, repository, or folder within a monorepo. The official guide also documents a CLI-only route that does not require a GitHub or GitLab account.
cd path/to/project
semgrep scan
That command is an illustrative example from the documented workflow, not a scan performed for this listing. If you want the hosted AppSec Platform workflow, the quick start has you sign up through GitHub or GitLab and create an organization; findings can then be reviewed through that service.
Choose coverage and access to match the team
The public plan page distinguishes a free tier from paid team and enterprise plans. It lists Code and Supply Chain in the free tier, with limits of ten repositories and ten contributors. Paid plans add broader analysis and team capabilities; check the current plan page before choosing features or seats. The page lists pricing by contributor but this guide omits exact amounts.
Semgrep is most useful for catching security patterns in code and dependencies as part of development. Its CLI makes a local first scan practical, while the hosted workflow adds organization-level management. Keep the scope clear: static analysis reports what its rules find in the source and dependencies, not whether a deployed application behaves correctly. The documented CLI prerequisite is Python 3.10 or later, and the quick start labels Windows support as beta.
Strengths
- The CLI can scan a project or a folder in a monorepo, without requiring a GitHub or GitLab account for the documented local route.
- The free tier includes Code and Supply Chain checks, with a stated cap of ten repositories and ten contributors.
- The product combines source-code analysis with dependency and secrets products for teams that need more than one security check.
Watch out for
- The CLI requires Python 3.10 or later, and the official quick start labels Windows support as beta.
Best for
- Scanning application source for security issues before merge
- Adding dependency checks to a development workflow
- Teams that want local scanning with an optional hosted review workflow
Sources
- Quickstart - Semgrep (Oct 25, 2026)
- Pricing and Plans | AppSec Platform SAST, SCA, and Secrets | Semgrep (Oct 25, 2026)