Semgrep
Static analysis for many languages with rules that look like code.
Linting and formatting PyPI LGPL-2.1-or-later
How Semgrep is used
Semgrep joined the catalog on its public numbers (5,313,263 downloads a week on PyPI and 17,141 GitHub stars), not on our project count: it is a dependency in 8 public GitHub projects of our scan, 3 of them set up for AI coding agents. The most used alternative in our scan is Bandit (12 projects). Projects that use it most often also use Pydantic (87.5%), python-dotenv (87.5%), PyYAML (87.5%).
Semgrep popularity over time
Gid Score 54: downloads 79, use in agent projects 14, GitHub stars 59, downloads trend 52 (each 0-100). How it is calculated.
Often used with Semgrep
| Pydantic | 87.5% of Semgrep projects · 10.1× more than average |
|---|---|
| python-dotenv | 87.5% of Semgrep projects · 9.5× more than average |
| PyYAML | 87.5% of Semgrep projects · 14.7× more than average |
| Rich | 87.5% of Semgrep projects · 24.5× more than average |
| Click | 75.0% of Semgrep projects · 30.0× more than average |
| FastAPI | 75.0% of Semgrep projects · 10.0× more than average |
| Jinja2 | 75.0% of Semgrep projects · 34.5× more than average |
| jsonschema | 75.0% of Semgrep projects · 46.1× more than average |
Agent Skills for Semgrep
| semgrep-rule-creator from trailofbits/skills | Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static …npx skills add trailofbits/skills --skill semgrep-rule-creator |
|---|
Skills teach your coding agent how to use Semgrep well. Official means the pack comes from the same GitHub account as Semgrep. Read a skill before installing it: it can include scripts. All Agent Skills
Install
| Package | pip install semgrep |
|---|---|
| Main stacks | Python (7), React Native / Expo (1) |
| Example projects | president-xd/revula, VulnBuster/agent |
Alternatives to Semgrep
Tools that do the same job, so a project picks one or the other. Add-ons and libraries used alongside Semgrep are not listed here; they are in "Often used with".
| Tool | Gid Score | Used in agent projects | Downloads / wk | GitHub stars | License |
|---|---|---|---|---|---|
| Bandit pypi Security-focused static analyzer for identifying vulnerabilities in Python code. |
57 | 12 (0.7%) | 6.5M | 8,325 | Apache-2.0 |
More in Linting and formatting: ESLint Prettier Biome oxlint oxfmt Knip stylelint ESLint Import Resolver TypeScript