Semgrep is a SAST and SCA platform. The SAST engine uses abstract syntax tree pattern matching rather than text matching, making patterns language-aware. Scans run in seconds on typical PR diffs, fast enough to gate every PR without blocking the merge queue.
Semgrep Assistant adds AI triage using AI Memories — a model built from historical accepted and dismissed findings on the codebase. The Assistant classifies new findings as true or false positive at approximately 96% accuracy and generates code-level autofix patches that match the codebase's conventions.
Semgrep Supply Chain adds dependency vulnerability detection with reachability analysis: it traces whether a CVE in a dependency is reachable from an actual call site in the application code, filtering out findings with no exploitable path. The rule set includes 5,000+ community rules in a readable YAML format, plus support for custom rules using the same syntax. The OSS engine and community rules are free; the cloud platform (Team and Enterprise) adds centralized policy management, AI Assistant, and autofix.
