OpenGrep vs Semgrep Code
OpenGrep
github.com
Semgrep Code
semgrep.devSide by side
| Figure | OpenGrep | Semgrep Code |
|---|---|---|
| Price from | Free | $15/mo |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | Yes |
| Web | — | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 7 |
| Spec score · Static Application Security Testing Software | 8.5 (#5) | 8.7 (#2) |
| Company size | LinkedIn lists Opengrep as a nonprofit software-development organization with company size of one employee. | LinkedIn lists Semgrep as a privately held company with 201–500 employees. |
| Installation | The official installer supports Linux and macOS through install.sh and Windows through PowerShell install.ps1. | Official installation paths include Homebrew on macOS, pip on Windows and Linux, and a semgrep/semgrep Docker image on Linux. |
| Integrations | The repository documents a CI subcommand, and its output formats include JSON and SARIF. | Supported workflow connections include GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure, Buildkite, HackerOne, Slack, email, webhooks, VS Code and IntelliJ. |
| Purpose | OpenGrep is an open-source static code analysis engine for finding security issues and searching code patterns. | Semgrep Code is a static application security testing product that finds code vulnerabilities and helps developers fix them. |
| What it does | Opengrep is a static code analysis engine for finding security issues and searching code patterns. | Semgrep Code combines deterministic static analysis with AI analysis to identify traditional vulnerabilities such as XSS and SQL injection plus complex issues such as IDOR and business-logic flaws. |
Plans
Semgrep Code
- Free EditionFree
- Free EditionFree
- Teams Secrets$15 a month
- Teams — Code$30 a month
- Teams Code$30 a month
- Teams Supply Chain$30 a month
- EnterprisePriced on request
In their own words
OpenGrep
OpenGrep is a free, open-source static analysis engine for finding security issues and searching patterns in source code. It runs on Linux, macOS, and Windows, with self-hosted deployment. The project supports more than 30 languages, including Python, Java, JavaScript, Go, Rust, PHP, and Visual Basic, and existing Semgrep rules and rulesets work without changes. Its intrafile taint analysis tracks constructor and field assignments, flow between methods, higher-order functions across 12 languages, and collection operations such as map, filter, and reduce. OpenGrep produces JSON and SARIF output and documents a CI subcommand for workflow use. The project distributes self-contained binaries and says releases are signed with Cosign. OpenGrep is a Semgrep fork under the LGPL 2.1 license. The security policy requests vulnerability reports by email and lists only the latest version as supported.
Semgrep Code
Semgrep Code is a cloud-based static application security testing product for finding vulnerabilities in source code and helping developers address them. It combines deterministic analysis for issues such as XSS and SQL injection with AI analysis aimed at complex flaws, including IDOR and business logic vulnerabilities. Pull requests can carry tailored, step-by-step remediation instructions, and the product supports 35 programming languages. Semgrep lists integrations with GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure and Buildkite, plus VS Code and IntelliJ extensions and Slack, email and webhook notifications. The Free Edition includes Code and Supply Chain, with scanning for up to 10 repositories and a limit of 10 contributors. Teams supports up to 500 private repositories; Enterprise has no repository or contributor limit. For local or fully CI-based scans, code stays on the user's computer or CI environment; opting into AI processing sends part of a file containing a finding to a model. The Free Edition costs nothing. Teams — Code is listed at $30 a month.