Opengrep
A fork of Semgrep CE offering a fully open-source static analysis engine with advanced SAST capabilities, inter-procedural analysis, and cross-file support without vendor lock-in.
Opengrep is an open-source alternative to:
Opengrep - The open-source code security engine
Opengrep is a fork of Semgrep CE (formerly Semgrep OSS) designed to keep the static analysis engine fully open-source. In response to recent changes by Semgrep that restricted critical features behind commercial licenses, Opengrep ensures backward compatibility while unlocking previously pro-only capabilities like inter-procedural analysis, cross-file analysis, and extended language support.
Key Features
- Fully Open-Source Engine: No hidden features or vendor lock-in; all capabilities remain freely accessible.
- Advanced Static Analysis: Supports inter-procedural analysis, cross-file analysis, and extended language support.
- Backward Compatibility: Maintains compatibility with common outputs like JSON and SARIF for seamless integration.
- Community-Driven Development: Regularly reviewed contributions from the community, not contingent on commercial interests.
- Long-Term Assurance: Future improvements and features remain open-source and vendor-neutral.
- Consortium Backing: Supported by a coalition of organizations including Aikido Security, Amplify, Endor Labs, Kodem, and Orca Security.
Tech / Self-Hosting
Opengrep is designed for self-hosting and can be deployed via its GitHub repository. The project is built in OCaml and encourages community contributions to advance static code analysis further.