Capability comparison
Both engines run natively on Windows without WSL or a container, and both use OCaml 5 for multicore execution. Their command-line interfaces remain similar, though individual arguments have diverged.Opengrep capabilities
--taint-intrafile tracks taint across functions inside a single file. The equivalent in the Semgrep line is --pro-intrafile, a Semgrep Code capability, so Opengrep distributes this analysis depth under LGPL 2.1. Opengrep adds parsers for Crystal and Visual Basic, which Semgrep does not support, and for Apex, which is Beta in Semgrep Code and absent from CE. Its engine controls cover per-rule timeouts, timeouts that scale with file size, --force-exclude, custom ignore annotations, and per-rule max-match-per-file. Releases are self-contained binaries with no Python runtime dependency, signed with Cosign.
Semgrep CE capabilities
CE ships with the community rules in the Semgrep Registry; the VS Code and IntelliJ extensions; andpre-commit support. Opengrep publishes no ruleset of its own, so sourcing rules, keeping them current, and covering new vulnerability classes is the user’s responsibility.
CE is also the entry point to Semgrep AppSec Platform. The same rules, configuration, and CLI carry over, and the free tier for up to 10 contributors and 10 private repositories enables cross-file analysis (using Semgrep Pro Engine), Pro rules, dependency scanning, and AI triage without a migration.
What Semgrep AppSec Platform adds
Cross-file analysis
Semgrep Code performs cross-file (interfile) and cross-function (intrafile) constant propagation and taint analysis, plus framework-specific and language-specific semantic analysis. A vulnerability whose source is in one file and whose sink is in another is found through cross-file analysis. Tracing a value across files also resolves findings that a single-file engine reports without seeing an upstream sanitizer: Semgrep CE doesn’t track data beyond a single function or file and may find more false positives compared to running cross-file analysis. Pro rules are written to use cross-file analysis, and produce more precise results than the overlapping Community rules they supersede. See Perform cross-file analysis and Rule upgrades and supersession.Maintained rules
The Semgrep Registry holds two sets: Community rules are public, contributed by anyone, and use features available in the Semgrep CE engine. Pro rules are authored by Semgrep’s Security Research team and use the Semgrep Pro engine, including cross-file analysis. That team covers new CVEs and weakness patterns as they emerge.Language depth
Every language in Semgrep CE is Community supported: single-function analysis with community rules. The same languages under Semgrep Code are generally available, with cross-file and cross-function dataflow analysis and Pro rules: 710+ for Python, 250+ for JavaScript, 230+ for TypeScript, 190+ for Java, 170+ for C#. Language versions differ. CE supports up to C# 7.0, Semgrep Code up to C# 13.LANGUAGE SUPPORTSee Supported languages for Semgrep Code, and Supported languages for Semgrep CE for the side-by-side table.
Scanning beyond SAST
Semgrep AppSec Platform is a suite, and configuration is preserved across the CLI, CI, the IDE, and the web app:- Semgrep Supply Chain performs reachability analysis on open source dependencies, detects malicious packages, enforces license policy, provides dependency search, and exports SBOMs.
- Semgrep Secrets detects 630+ credential and key types, with entropy analysis, semantic analysis, historical scanning, and validation that confirms whether a leaked secret is still active.
- Semgrep Guardian runs Code, Supply Chain, and Secrets inside AI coding agents. It bundles the Semgrep MCP server, hooks, and skills into one install, scans every file an agent writes, and prompts the agent to regenerate until the scan returns clean. It supports Claude Code, Cursor, Codex, GitHub Copilot, VS Code, Windsurf, Kiro, and any MCP client.
- Semgrep Multimodal is a capability layer across those products. It combines AI reasoning with rule-based analysis for detection, triage, and remediation. Autotriage reduces backlogs by roughly 60% on first use and reaches a 95% user agreement rate at steady state, measured across more than 6 million findings; post-processing analysis reduces noise by 20% in the developer workflow. Autofix produces fix PRs, and Memories carry triage decisions forward so the same class of finding is not re-triaged in every repository.
Program operations
Semgrep AppSec Platform supplies Managed Scans across thousands of repositories, SCM connections for GitHub, GitLab, Bitbucket, and Azure DevOps, SSO, project and team management, Policies that route findings to monitor, comment, or block mode, PR and MR comments with triage commands, Jira tickets, Slack and webhook notifications, and a dashboard.Community engines with an LLM
Detection accuracy depends on rules. A scan finds a vulnerability class because a rule encodes its source, sink, sanitizers, and framework, and taint analysis traces the flow deterministically. A model applied to a repository without that encoding approximates those flows, returns different results between runs, and has no coverage of vulnerability classes discovered after its training data. Semgrep Multimodal runs both layers: Pro Engine taint analysis establishes where user input reaches sensitive operations, Pro rules supply coverage, and the model reasons over those flows about authorization, intent, and business logic.Maintenance and performance
Both projects ship features and fixes regularly. Semgrep publishes no head-to-head speed comparison with Opengrep. Performance depends on codebase, ruleset, and configuration, and optimizing one use case often costs another. Measure on your own repositories. Semgrep’s solutions and support teams can help structure an evaluation or proof of value.Which to choose
Choose Opengrep for an open source engine end to end, where the user writes and maintains their own rules, and needs its packaging and engine controls (self-contained binaries, per-rule timeouts, Crystal or Visual Basic parsers). Choose Semgrep CE for a free engine that ships with rules and IDE integrations, and to have a direct upgrade path that carries rules and configuration onto a broader platform. Choose Semgrep AppSec Platform to run a security program. It provides cross-file analysis, maintained Pro rules, dependency and secrets scanning, AI-assisted detection, triage, and remediation, and the deployment, policy, and reporting layer around them. The free tier covers Semgrep Code and Supply Chain for up to 10 contributors and 10 private repositories with nothing to self-host. Past roughly 10 developers or a handful of repositories, the cost of a community engine shifts from the license to platform work: per-repository CI, custom dashboards, and manual triage. To compare on your own code, run two engines over the same repository and compare in both directions: what one finds that the other misses, and what one reports that the other rules out.Licensing and vendor use
The Semgrep CE engine has been LGPL 2.1 since development began in early 2020, and Opengrep carries the same license. Rules licensing differs. As announced in Important updates to Semgrep OSS in December 2024, Semgrep-maintained rules in thesemgrep-rules repository, both Community and Pro, moved from Commons Clause with LGPL 2.1 to the Semgrep Rules License v1.0, which is not an open source license. Individuals, security consultants, and companies may use the rules internally. Vendors may not use them in competing products or SaaS offerings. Rules from third-party repositories in the Registry keep their source licenses. Opengrep’s maintainers cite the move of features behind a commercial license as their reason for forking.
To build code scanning into a product you sell, read the Semgrep Rules License and How are Semgrep and its rules licensed?, then contact partnerships@semgrep.com.