Infer vs Semgrep Code
Infer
fbinfer.com
Semgrep Code
semgrep.devSide by side
| Figure | Infer | Semgrep Code |
|---|---|---|
| Price from | Free | $15/mo |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 7 |
| Spec score · C and C++ Static Analysis Tools | 8.5 (#5) | 8.7 (#3) |
| Installation | Infer can be installed from binary releases, built from source, or run using Docker images. | Official installation paths include Homebrew on macOS, pip on Windows and Linux, and a semgrep/semgrep Docker image on Linux. |
| Integrations | Infer documents integrations for Buck, cmake, Gradle, Make, Maven, Xcodebuild, xctool, and compilation databases. | Supported workflow connections include GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure, Buildkite, HackerOne, Slack, email, webhooks, VS Code and IntelliJ. |
| Languages | The documentation lists Java, C, C++, Objective-C, and Erlang; the latest release notes also describe Python and Swift frontends and an experimental Rust frontend. | Semgrep lists support for more than 30 programming languages and frameworks for SAST and nine for SCA. |
| Purpose | Infer is a static analysis tool that produces a list of potential bugs from Java or C/C++/Objective-C code. | Semgrep Code is a static application security testing product that finds code vulnerabilities and helps developers fix them. |
| Support | The project directs users to GitHub issues and the #infer IRC channel on Libera Chat for questions and issue reports. | Paid customers receive technical support from 8 AM to 1 AM UTC on weekdays through private Slack, the web help area or support email. |
| What it does | Infer is a static analyzer that reports potential bugs in source code before it ships. | Semgrep Code combines deterministic static analysis with AI analysis to identify traditional vulnerabilities such as XSS and SQL injection plus complex issues such as IDOR and business-logic flaws. |
Plans
Semgrep Code
- Free EditionFree
- Free EditionFree
- Teams Secrets$15 a month
- Teams — Code$30 a month
- Teams Code$30 a month
- Teams Supply Chain$30 a month
- EnterprisePriced on request
In their own words
Infer
Infer is a static analysis tool that examines compiled Java, C, C++, Objective-C, and Erlang code and reports potential bugs before release. Its checks include null pointer problems, resource or memory leaks, coding conventions, unavailable APIs, and concurrency issues such as data races. Some analyses can follow an issue across multiple functions or methods and files. Pulse provides memory-safety analysis, while RacerD checks thread safety. Cost analysis estimates asymptotic function complexity for Java and C-family languages; Hack support is experimental, and Python, Rust, and Swift are not supported by that analysis. Infer captures compilation commands, analyzes the captured files, and writes reports that can be reviewed with `infer explore`; files that are not compiled are not analyzed. Integrations are documented for build tools including Buck, CMake, Gradle, Make, Maven, Xcodebuild, and xctool. It can be installed from binary releases, built from source, or run in Docker. The free plan costs nothing. Infer runs on Linux and macOS, with web and self-hosted options; Windows is not supported.
Semgrep Code
Semgrep Code is a cloud-based static application security testing product for finding vulnerabilities in source code and helping developers address them. It combines deterministic analysis for issues such as XSS and SQL injection with AI analysis aimed at complex flaws, including IDOR and business logic vulnerabilities. Pull requests can carry tailored, step-by-step remediation instructions, and the product supports 35 programming languages. Semgrep lists integrations with GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure and Buildkite, plus VS Code and IntelliJ extensions and Slack, email and webhook notifications. The Free Edition includes Code and Supply Chain, with scanning for up to 10 repositories and a limit of 10 contributors. Teams supports up to 500 private repositories; Enterprise has no repository or contributor limit. For local or fully CI-based scans, code stays on the user's computer or CI environment; opting into AI processing sends part of a file containing a finding to a model. The Free Edition costs nothing. Teams — Code is listed at $30 a month.