Skip to content
SPECIFICTION
Get listed

Semgrep Supply Chain

semgrep.dev

From $30/mo Free plan WebmacOSLinuxAPISelf-hosted
Visit semgrep.dev
Spec score 8.2 #4 of 21 in Ruby Static Analysis Tools

Spec sheet

Purpose
Semgrep Supply Chain detects vulnerabilities in open-source dependencies, blocks malware, and provides codebase-aware reachability analysis and upgrade guidance.Read 30 Sep 2026 · semgrep.dev
Integrations
Semgrep lists GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure, and Buildkite among its CI integrations, with Slack, email, webhooks, VS Code, and IntelliJ also listed.Read 30 Sep 2026 · semgrep.dev
Compliance
Semgrep's Trust Portal says its SOC 2 Type II report and full-scope penetration test cover the AppSec Platform, including Supply Chain.Read 30 Sep 2026 · trust.semgrep.dev
Support
The pricing page lists community-based support for Free Edition, award-winning support for Teams, and a dedicated account manager and tailored onboarding for Enterprise.Read 30 Sep 2026 · semgrep.dev
Headquarters
San Francisco, California, United StatesRead 28 Sep 2026 · semgrep.dev
Founded
2017Read 28 Sep 2026 · semgrep.dev
API access
The pricing comparison lists REST API access for Teams and Enterprise.Read 30 Sep 2026 · semgrep.dev
Code handling
Semgrep says that when it runs locally or fully in a CI pipeline, source code stays on the user's computer or CI environment; opted-in AI processing submits part of a file containing a finding to a model.Read 30 Sep 2026 · semgrep.dev
Company history
Semgrep says it was founded in 2017 by Drew Dennison, Isaac Evans, and Luke O’Malley.Read 30 Sep 2026 · semgrep.dev
Dependency upgrades
The product offers autofix pull requests, line-level breaking-change detection, and upgrade guidance based on LLM reasoning and static-analysis context.Read 30 Sep 2026 · semgrep.dev
Malware detection
Semgrep describes malicious dependency detection, impact analysis, and policies to help respond to zero-day supply-chain attacks.Read 30 Sep 2026 · semgrep.dev
Plan limits
The pricing comparison lists 10 private repositories maximum for Free Edition, 500 maximum for Teams, and unlimited for Enterprise.Read 30 Sep 2026 · semgrep.dev
Reachability
Semgrep says codebase-aware reachability can reduce false positives by up to 98%.Read 30 Sep 2026 · semgrep.dev
Severity coverage
The product page states that critical and high severity findings have GA-level support in 12 languages.Read 30 Sep 2026 · semgrep.dev
Supply-chain features
The pricing comparison lists software composition analysis, lockfile and code scanning, reachability analysis, malicious dependency detection, SBOM generation, license compliance checking, and dependency search.Read 30 Sep 2026 · semgrep.dev

Plans and prices

Free Edition Free $0/month/contributor up to 10 repositories · maximum 10 contributors · GitHub/GitLab authentication Read 30 Sep 2026 · semgrep.dev
Teams — Supply Chain $30 a month $30/month/contributor 500 private repositories max · 20 AI credits per developer per month · SSO Read 30 Sep 2026 · semgrep.dev
Enterprise Priced on request Custom No limit on repositories scanned or contributors · optional dedicated infrastructure · dedicated account manager Read 30 Sep 2026 · semgrep.dev

Every Semgrep Supply Chain plan and price →

Where Specifiction places it

Alternatives to Semgrep Supply ChainAll alternatives →