OpenGrep vs Skylos

OpenGrep is a free, open-source static analysis engine for finding security issues and searching patterns in source code. It runs on Linux, macOS, and Windows, with self-hosted deployment. The project supports more than 30 languages, including Python, Java, JavaScript, Go, Rust, PHP, and Visual Basic, and existing Semgrep rules and rulesets work without changes. Its intrafile taint analysis tracks constructor and field assignments, flow between methods, higher-order functions across 12 languages, and collection operations such as map, filter, and reduce. OpenGrep produces JSON and SARIF output and documents a CI subcommand for workflow use. The project distributes self-contained binaries and says releases are signed with Cosign. OpenGrep is a Semgrep fork under the LGPL 2.1 license. The security policy requests vulnerability reports by email and lists only the latest version as supported.

Skylos is an open-source static analysis tool that checks source code for security regressions, secrets, dead code, quality issues, and mistakes introduced by AI. It analyzes Python, JavaScript and TypeScript, Go, Java, Kotlin, PHP, Rust, Dart, C#, Shell, and deployment configuration, with analysis depth differing by language. Its CLI runs locally without an account for scans and CI checks. A free VS Code extension offers inline diagnostics and optional AI verification through OpenAI or Anthropic API keys. Cloud options include GitHub pull request workflows, OIDC identity, and optional Slack and Discord notifications. A normal CLI scan remains on the user's machine; Cloud receives data when reports are uploaded, cloud actions are triggered, or the public scan endpoint is used. Uploaded reports may include findings, file paths, snippets, and scan metadata. Skylos says it does not currently claim SOC 2, ISO 27001, or CSA STAR certification. The free plan includes one cloud project, 10 stored scans, and seven-day history. One-time credit packs begin at 9.00 USD. Skylos supports API, extension, Linux, macOS, self-hosted, web, and Windows use.