Skip to content
SPECIFICTION
Get listed

OpenGrep

github.com

Free plan Open source WindowsmacOSLinuxAPISelf-hosted
Visit github.com
Spec score 8.6 #5 of 30 in Network Protocol Analyzers

What it is

OpenGrep is a free, open-source static analysis engine for finding security issues and searching patterns in source code. It runs on Linux, macOS, and Windows, with self-hosted deployment. The project supports more than 30 languages, including Python, Java, JavaScript, Go, Rust, PHP, and Visual Basic, and existing Semgrep rules and rulesets work without changes. Its intrafile taint analysis tracks constructor and field assignments, flow between methods, higher-order functions across 12 languages, and collection operations such as map, filter, and reduce. OpenGrep produces JSON and SARIF output and documents a CI subcommand for workflow use. The project distributes self-contained binaries and says releases are signed with Cosign. OpenGrep is a Semgrep fork under the LGPL 2.1 license. The security policy requests vulnerability reports by email and lists only the latest version as supported.

Spec sheet

What it does
Opengrep is a static code analysis engine for finding security issues and searching code patterns.Read 15 Oct 2026 · github.com
Purpose
OpenGrep is an open-source static code analysis engine for finding security issues and searching code patterns.Read 3 Oct 2026 · github.com
Intended users
The project invites developers and organizations to use and contribute to its open static analysis engine.Read 3 Oct 2026 · opengrep.dev
Integrations
The repository documents a CI subcommand, and its output formats include JSON and SARIF.Read 3 Oct 2026 · github.com
License
The repository identifies OpenGrep as a fork of Semgrep under the LGPL 2.1 license.Read 3 Oct 2026 · github.com
Analysis features
Its intrafile taint analysis supports constructor and field assignment tracking, inter-method taint flow, higher-order functions across 12 languages, and collection methods such as map, filter, and reduce.Read 3 Oct 2026 · github.com
Build requirements
Developer builds require OCaml 5.5.0, dune, opam, a C toolchain, PCRE and GMP libraries, make and git.Read 15 Oct 2026 · github.com
Changelog: 1.28.0
The 26 August 2026 release improved install scripts, fixed Windows output handling, updated constant propagation and added PHP fixes.Read 15 Oct 2026 · github.com
Changelog: 1.29.0
The 28 August 2026 release migrated remaining PCRE1 uses to PCRE2 and fixed Kotlin scope-function taint desugaring.Read 15 Oct 2026 · github.com
Company size
LinkedIn lists Opengrep as a nonprofit software-development organization with company size of one employee.Read 15 Oct 2026 · linkedin.com
Consortium
The project says Aikido Security, Amplify, Endor Labs, Kodem, Orca Security and other application-security organizations support it.Read 15 Oct 2026 · opengrep.dev
Developer API
The docs.rs package documents a Rust Config and SearchEngine API with parallel searches, JSON serialization and optional AI analysis.Read 15 Oct 2026 · docs.rs
Directory API listing
VentureGaps lists a REST API and nine integrations, including GitHub, GitLab CI/CD, CircleCI, Jira, Bitbucket, Jenkins, Slack and GitHub Actions.Read 15 Oct 2026 · venturegaps.com
Distribution
Releases are self-contained OCaml binaries for multiple architectures, so Python is not required.Read 15 Oct 2026 · github.com
Documentation
The repository links a wiki with tutorials and language guides, including intrafile tainting, higher-order functions, C#, PHP and Visual Basic.Read 15 Oct 2026 · github.com
Free availability
The project says consortium members build the engine for free use and intend to keep it free and open-source.Read 15 Oct 2026 · opengrep.dev
Governance
The project says contributions are reviewed on merit and is backed by an application-security consortium that includes Aikido Security, Amplify, Endor Labs, Kodem, and Orca Security.Read 3 Oct 2026 · opengrep.dev
Independent context
Latio Pulse describes Opengrep as a forever-open-source alternative sponsored by more than ten security vendors and says Semgrep's SaaS management features were lacking in the author's experience.Read 15 Oct 2026 · pulse.latio.tech
Independent criticism
Crash Override argues that the consortium had made few significant contributions to Semgrep and characterizes the fork as self-serving.Read 15 Oct 2026 · crashoverride.com
Installation
The official installer supports Linux and macOS through install.sh and Windows through PowerShell install.ps1.Read 15 Oct 2026 · github.com
Integration: Aptori
Aptori runs OpenGrep through its aptori/scanners container and publishes results to the Aptori Platform.Read 15 Oct 2026 · docs.aptori.dev
Integration: Deckhouse
Deckhouse Code runs opengrep_sast_scan and opengrep_sast_junit jobs, publishes JSON and JUnit results, and can forward findings to DefectDojo.Read 15 Oct 2026 · deckhouse.io
Integration: Docker
A community Docker Hub image documents scans through Docker, GitHub Actions, GitLab CI and Docker Compose with JSON or SARIF output.Read 15 Oct 2026 · hub.docker.com
Intrafile taint
The engine adds intrafile cross-function taint analysis with higher-order-function support.Read 15 Oct 2026 · github.com
Language coverage
The README lists more than 30 languages, including Apex, Bash, C, C++, C#, Go, Java, JavaScript, PHP, Python, Ruby, Rust, Swift, Terraform, TypeScript, Visual Basic, XML and YAML.Read 15 Oct 2026 · github.com
Language support
The project says it supports 30+ languages, including Python, Java, JavaScript, Go, Rust, PHP, and Visual Basic.Read 3 Oct 2026 · github.com
Licence
The repository identifies the software as licensed under LGPL-2.1.Read 15 Oct 2026 · github.com
Limit: rule breadth
VentureGaps says the rule library is less extensive than established commercial SAST tools.Read 15 Oct 2026 · venturegaps.com
Limit: semantic depth
VentureGaps cautions that pattern-matching focus may miss complex semantic vulnerabilities.Read 15 Oct 2026 · venturegaps.com
Notable limit
The security policy lists only the latest version as supported.Read 3 Oct 2026 · github.com
Origin
Opengrep is a fork of Semgrep version 1.100.0.Read 15 Oct 2026 · github.com
Output formats
The tool supports JSON and SARIF outputs and can include metavariable values, fingerprints and enclosing match context.Read 15 Oct 2026 · github.com
Praise: extensibility
VentureGaps praises community-driven custom rule creation and describes the tool as highly extensible.Read 15 Oct 2026 · venturegaps.com
Praise: privacy
VentureGaps describes local analysis with no code sent to servers as a strength.Read 15 Oct 2026 · venturegaps.com
Project activity
The GitHub repository page shows about 3.2k stars, 276 forks and more than 10,500 commits.Read 15 Oct 2026 · github.com
Rating on VentureGaps
6.0 out of 10 from 0 field reports.Read 15 Oct 2026 · venturegaps.com
Release signing
Release binaries are signed with Cosign.Read 15 Oct 2026 · github.com
Rule compatibility
Existing Semgrep rules and rulesets are intended to work unchanged.Read 15 Oct 2026 · github.com
Security policy
Only the latest version is marked supported and vulnerability reports are requested by email at [email protected].Read 15 Oct 2026 · github.com
Security reports
The security policy asks users to report vulnerabilities by email and says the latest version is supported.Read 3 Oct 2026 · github.com
Supported systems
The README provides installation instructions for Linux, macOS, and Windows.Read 3 Oct 2026 · github.com
Taint tracking
Taint analysis tracks constructor and field assignments, inter-method flows, and collection methods such as map, filter and reduce.Read 15 Oct 2026 · github.com
Third-party CI project
A GitLab project created February 9, 2026 is dedicated to unpublished Opengrep custom rules and CI/CD.Read 15 Oct 2026 · gitlab.com
Windows support
Native Windows support was added after the fork.Read 15 Oct 2026 · github.com

Plans and prices

OpenGrep Free Open-source static analysis engine; CLI Read 3 Oct 2026 · opengrep.dev

Every OpenGrep plan and price →

Strong points and limits

Strong points

  • Supports more than 30 programming languages
  • Existing Semgrep rules work unchanged
  • Runs on Linux, macOS, and Windows
  • Offers JSON and SARIF output
  • Self-contained binaries are distributed

Limits

  • Only the latest version is supported
  • Deployment is self-hosted

Who it suits

OpenGrep suits developers and organizations looking for a self-hosted source-code analysis tool. It may be useful for teams already using Semgrep rules or integrating analysis through CI workflows.

Verdict

OpenGrep pairs broad language support with compatibility for existing Semgrep rules and CI-oriented output. Users should account for its self-hosted deployment and latest-version-only support policy.

Where Specifiction places it

Alternatives to OpenGrepAll alternatives →