Semgrep Supply Chain

Software Composition Analysis Software

Free planAPILinuxmacOSSelf-hostedWeb

7.3#10 of 64$30/mofirst paid tier

Overview

Semgrep Supply Chain is ranked #10 of 64 in software composition analysis software on Specifiction. It runs on API, Linux, macOS, Self-hosted, Web. There is a free plan. Paid plans start at $30/mo.

Semgrep Supply Chain plans and pricing

All plans

Free Edition Free $0/month/contributor up to 10 repositories · maximum 10 contributors · GitHub/GitLab authentication semgrep.dev · 30 Sept 2026

Teams — Supply Chain $30/mo $30/month/contributor 500 private repositories max · 20 AI credits per developer per month · SSO semgrep.dev · 30 Sept 2026

Enterprise Not published Custom No limit on repositories scanned or contributors · optional dedicated infrastructure · dedicated account manager semgrep.dev · 30 Sept 2026

Compared on software composition analysis software

Free plan: Yessemgrep.dev
Supported ecosystems: C# (NuGet); Dart (Pub); Go (Go modules); Java (Gradle, Maven); JavaScript/TypeScript (npm, Yarn, pnpm); Kotlin (Gradle, Maven); PHP (Composer); Python (pip, pip-tool, Pipenv, Poetry); Ruby (RubyGems); Rust (Cargo); Scala (Maven); Swift (SwiftPM)semgrep.dev
SBOM generation: Yessemgrep.dev
Reachability analysis: Yessemgrep.dev
Pull request scanning: Yessemgrep.dev
Monitored projects: 500 projectssemgrep.dev
Deployment options: hybridsemgrep.dev

Facts

Purpose: Semgrep Supply Chain detects vulnerabilities in open-source dependencies, blocks malware, and provides codebase-aware reachability analysis and upgrade guidance.semgrep.dev · 30 Sept 2026
Reachability: Semgrep says codebase-aware reachability can reduce false positives by up to 98%.semgrep.dev · 30 Sept 2026
Severity coverage: The product page states that critical and high severity findings have GA-level support in 12 languages.semgrep.dev · 30 Sept 2026
Malware detection: Semgrep describes malicious dependency detection, impact analysis, and policies to help respond to zero-day supply-chain attacks.semgrep.dev · 30 Sept 2026
Dependency upgrades: The product offers autofix pull requests, line-level breaking-change detection, and upgrade guidance based on LLM reasoning and static-analysis context.semgrep.dev · 30 Sept 2026
Supply-chain features: The pricing comparison lists software composition analysis, lockfile and code scanning, reachability analysis, malicious dependency detection, SBOM generation, license compliance checking, and dependency search.semgrep.dev · 30 Sept 2026
Integrations: Semgrep lists GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure, and Buildkite among its CI integrations, with Slack, email, webhooks, VS Code, and IntelliJ also listed.semgrep.dev · 30 Sept 2026
API access: The pricing comparison lists REST API access for Teams and Enterprise.semgrep.dev · 30 Sept 2026
Plan limits: The pricing comparison lists 10 private repositories maximum for Free Edition, 500 maximum for Teams, and unlimited for Enterprise.semgrep.dev · 30 Sept 2026
Support: The pricing page lists community-based support for Free Edition, award-winning support for Teams, and a dedicated account manager and tailored onboarding for Enterprise.semgrep.dev · 30 Sept 2026
Code handling: Semgrep says that when it runs locally or fully in a CI pipeline, source code stays on the user's computer or CI environment; opted-in AI processing submits part of a file containing a finding to a model.semgrep.dev · 30 Sept 2026
Compliance: Semgrep's Trust Portal says its SOC 2 Type II report and full-scope penetration test cover the AppSec Platform, including Supply Chain.trust.semgrep.dev · 30 Sept 2026
Company history: Semgrep says it was founded in 2017 by Drew Dennison, Isaac Evans, and Luke O’Malley.semgrep.dev · 30 Sept 2026