vioscale
DevSecOps ToolsUnclaimed

Semgrep

AI-assisted SAST, SCA and Secrets Detection

Visit websiteCompare alternatives
Also known as
semgrep

What is Semgrep?

AppSec platform providing static application security testing (SAST), software composition analysis (SCA), and secrets detection with AI-powered detection, triage, and remediation capabilities.

Independently observed

Semgrep pricing

Plans, per-tier features and add-ons, dated and linked to live pricing. Pricing changes often; always verify at source before you rely on it.

Pricing as of verify at live pricing ↗Independently observed
from $30/moSubscriptionFree tier

Free tier available. Teams starting at $30/month per contributor. Enterprise pricing upon request.

Free Edition

Free
Free
monthly

Get started for free with the most popular code scanning engine

ai_credits
60
contributors
10
repositories
10
  • Cross-file analysis with Pro rules
  • AI-powered detection, triage, and remediation
  • 60 AI credits included
  • Fast CI/CD deploy via Semgrep infrastructure
  • Scan up to 10 repositories
  • Maximum 10 contributors
  • Authentication via GitHub/GitLab
  • Code and Supply Chain included

Teams

From $30/month per contributor (Code or Supply Chain); $15/month per contributor (Secrets)
monthly

Choose from Code (SAST), Supply Chain (SCA), or Secrets with AI-powered detection, triage, and remediation

ai_credits_per_developer
20
  • Cross-file analysis with Pro rules
  • AI-powered detection, triage, and remediation
  • 20 AI credits per developer per month
  • One-click CI/CD deploy using Semgrep infrastructure
  • Single sign-on (SSO)
  • Award-winning support

Enterprise

Contact sales
Contact sales

Built for impact and scale

What Semgrep does

The capabilities that matter for devsecops tools, normalised so it lines up with every alternative. “-” means we haven't confirmed it, not that it's missing.

Scan types
SAST (static analysis)
✓
DAST (dynamic analysis)
-
SCA / dependency scanning
✓
Secret scanning
✓
Container / image scanning
-
IaC misconfiguration scanning
-
Governance
OSS licence compliance
-
SBOM generation (SPDX/CycloneDX)
-
Remediation
Automated fix / upgrade PRs
✓
Prioritisation
Reachability / exploitability prioritisation
✓
Deployment
Hosting
Cloud only
Integration
First-class CI / pipeline integration
✓
In-editor / IDE scanning
-
Licensing
OSS engine available
-
Independently observed

Platform & deployment

Independently observed
Platforms
  • CLI
  • Web
Deployment
  • Cloud / SaaS

Integrations (2)

Independently observed
  • GitHub
  • GitLab

Semgrep alternatives

Other devsecops tools we track, ranked by the same independent score.

Independent · unbought · dated

The Vioscale score: one lens on the evidence

Not user reviews and not a paid placement: a confidence-weighted blend of the independent signals below (adoption, activity, security posture, and more), which you can sort and re-weight yourself. Vendors can correct their listing but can never move their rank, and stars are weighted low as a vanity metric. It is one way to read the evidence for Semgrep, not the verdict.

Balanced composite 64 / 100
medium · 60%
Signal contributions to the composite score
SignalScoreWeightContributionEvidence
Package Downloads9026.002326.3✓
Security Posture5040.002000.0✓
Pricing Transparency10010.001000.0✓
Capabilities8112.00973.8✓
Github Activity5418.00967.7✓
Release Cadence9610.00961.1✓
Reliability5018.00900.0✓
Price Level508.00400.0✓
Github Stars795.00396.7✓
Integrations1412.00164.7✓
Stackoverflow Activity012.000.0-

Computed . Re-weight it by intent, or see the full method.

All data & sourcesshow ↓

Every value we hold, with its source, retrieval date, and confidence. This is the evidence behind the score: don't trust it, verify it.

Activity

AttributeValueEvidence
Commits last 30d50mediumsource · 2026-08-01 · 65%

Adoption

AttributeValueEvidence
Github stars16,074highsource · 2026-08-01 · 90%
Package downloads weekly7,736,635highsource · 2026-08-01 · 85%

Features

AttributeValueEvidence
Capabilities{"sca":true,"sast":true,"hosting":"cloud","ci_native":true,"auto_fix_pr":true,"reachability":true,"secret_scanning":true}mediumsource · 2026-08-01 · 60%

Integrations

AttributeValueEvidence
Count2mediumsource · 2026-08-01 · 60%

Language

AttributeValueEvidence
PrimaryOCamlhighsource · 2026-08-01 · 90%

License

AttributeValueEvidence
SpdxLGPL-2.1highsource · 2026-08-01 · 95%

Pricing

AttributeValueEvidence
Modelcommercialmediumsource · 2026-08-01 · 60%
Free tierYesmediumsource · 2026-08-01 · 60%
Price levelmidmediumsource · 2026-08-01 · 60%
Starting gbp30mediumsource · 2026-08-01 · 60%
TransparentYesmediumsource · 2026-08-01 · 60%

Release

AttributeValueEvidence
Cadence days7mediumsource · 2026-08-01 · 70%

Reliability

AttributeValueEvidence
Status pageYesmediumsource · 2026-08-01 · 60%

Security

AttributeValueEvidence
Disclosure policyYesmediumsource · 2026-08-01 · 60%
GdprYeshighsource · 2026-08-01 · 75%
Soc2Yeshighsource · 2026-08-01 · 75%