Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Static Code Analysis

Run semgrep as a Trickest node on a checkout

semgrep-scan is the Trickest node for Semgrep, the open-source static analysis engine that scans source code for security vulnerabilities and dangerous patterns using rules written in a syntax that mirrors the code they match, returning findings as JSON or SARIF for downstream triage.

installpython3 -m pip install semgrepbrew install semgrep

C · LGPL-2.1 license

Agent
Scan a repository for vulnerabilitiesGate CI on findingsEmit SARIF for dashboards

overview

What semgrep-scan does

Semgrep matches bug and vulnerability patterns written in a syntax that mirrors the source itself. A rule for a dangerous call reads like the snippet it catches, not a dense regex. It parses each file into a syntax tree and matches on structure, so one rule holds across formatting and variable names.

Rule selection is the main dial. Pass --config with a registry pack like p/python, a local YAML file, a URL, or --config auto for project-tailored rules. Pick output next: --sarif for code-scanning dashboards, --json for pipelines, or GitLab SAST and JUnit XML. Add --error so findings fail the build. Use --exclude or --include to keep the scan on the paths you care about.

In a Trickest workflow the scan runs against a checked-out repository and writes findings as a file and a folder. The same triage path that already handles dynamic-scanner output can carry these static results. Encoding a fresh bug variant as a reusable pattern takes minutes, not a plugin build.

source github.com/semgrep/semgrep

use cases

Where semgrep-scan fits

Scan a repository for vulnerabilities

Point semgrep-scan at a source-code folder with a security rule pack to flag injection sinks, unsafe deserialization, and other risky patterns across the tree.

Gate CI on findings

Set the error exit behavior so a build fails when Semgrep reports issues, blocking risky code from merging.

Emit SARIF for dashboards

Write SARIF or GitLab SAST output so findings load directly into code-scanning dashboards and pull-request annotations.

Hunt with custom patterns

Supply a pattern and language to search for one specific construct across the codebase, useful for chasing a known bug variant everywhere it appears.

reference

semgrep-scan inputs and flags

89 inputs
NameTypeFlagDescription
target-folderFOLDER·Source-code folder to scan (the positional target).
configSTRING--configYAML file, directory, URL, or registry pack (e.g. p/python). Use auto to fetch project-tailored rules; repeat to combine.
sarifBOOLEAN--sarifOutput results in SARIF format for code-scanning dashboards.
jsonBOOLEAN--jsonOutput results in Semgrep's JSON format.
severitySTRING--severityReport only findings from rules matching INFO, WARNING, or ERROR.
excludeSTRING--excludeSkip any file or directory whose path matches a gitignore-style glob.
jobsSTRING--jobsNumber of subprocesses running checks in parallel (defaults to core count).
errorBOOLEAN--errorExit 1 when there are findings. Useful for CI and scripts.

Showing key inputs. semgrep-scan exposes 89 inputs in total.

Full flag reference (89 inputs)
NameTypeFlagDescription
proBOOLEAN--proInter-file analysis and Pro languages (currently Apex, C#, and Elixir. Requires Semgrep Pro Engine. See https://semgrep.dev/products/pro-engine/ for more.
vimBOOLEAN--vimOutput results in vim single-line format.
jobsSTRING--jobsNumber of subprocesses to use to run checks in parallel. Defaults to the number of cores detected on the system (1 if using --pro).
jsonBOOLEAN--jsonOutput results in Semgrep's JSON format.
langSTRING--langParse pattern and all files in specified language. Must be used with -e/--pattern.
testBOOLEAN--testRun test suite.
textBOOLEAN--textOutput results in text format.
timeBOOLEAN--timeInclude a timing summary with the results (internal use; --trace is better supported).
debugBOOLEAN--debugAll of --verbose, but with additional debugging information.
emacsBOOLEAN--emacsOutput results in Emacs single-line format.
errorBOOLEAN--errorExit 1 if there are findings. Useful for CI and scripts.
quietBOOLEAN--quietOnly output findings.
sarifBOOLEAN--sarifOutput results in SARIF format.
traceBOOLEAN--traceRecord traces from Semgrep scans to help debugging. This feature is meant for internal use and may be changed or removed without warning.
configSTRING--configYAML file, directory, URL, or registry pack (e.g. p/python). Use auto to fetch project-tailored rules; repeat --config to combine sources.
dryrunBOOLEAN--dryrunWith --autofix, print the proposed changes to the console instead of writing them to files.
legacyBOOLEAN--legacyPrefer old (legacy) behavior.
remoteSTRING--remoteQuickly checkout and scan a remote git repository URL. Requires --pro and --experimental.
strictBOOLEAN--strictReturn a nonzero exit code when WARN level errors are encountered. Fails early if invalid configuration files are present. Defaults to --no-strict.
autofixBOOLEAN--autofixApply autofix patches. Experimental and can cause data loss, so keep files in version control.
developBOOLEAN--developLiving on the edge.
excludeSTRING--excludeSkip any file or directory whose path matches a gitignore-style glob. May be repeated.
includeSTRING--includeScan only files or directories matching a gitignore-style glob, excluding all others. May be repeated.
metricsSTRING--metricsControl usage metrics sent to the Semgrep server: auto, on, or off.
no-timeBOOLEAN--no-timenegates --time
patternSTRING--patternCode search pattern. See https://semgrep.dev/docs/writing-rules/pattern-syntax for information on pattern features.
profileBOOLEAN--profile<undocumented>
secretsBOOLEAN--secretsRun Semgrep Secrets product, including support for secret validation. Requires access to Secrets, contact support@semgrep.com for more information.
timeoutSTRING--timeoutMaximum time to spend running a rule on a single file in seconds. If set to 0 will not have time limit. Defaults to 5.0 s.
verboseBOOLEAN--verboseShow more details about what rules are running, which files failed to parse, etc.
dump-astBOOLEAN--dump-astIf --dump-ast, shows AST of the input file or passed expression and then exit (can use --json).
no-errorBOOLEAN--no-errornegates --error
no-traceBOOLEAN--no-tracenegates --trace
oss-onlyBOOLEAN--oss-onlyRun using only the OSS engine, even if the Semgrep Pro toggle is on. This may still run Pro rules, but only using the OSS features.
severitySTRING--severityReport only findings from rules matching a severity: INFO, WARNING, or ERROR. May be repeated.
validateBOOLEAN--validateValidate configuration file(s). This will check YAML files for errors and run 'p/semgrep-rule-lints' on the YAML files. No search is performed.
junit-xmlBOOLEAN--junit-xmlOutput results in JUnit XML format.
no-dryrunBOOLEAN--no-dryrunnegates --dryrun
no-strictBOOLEAN--no-strictnegates --strict
diff-depthSTRING--diff-depthCall-graph depth for a Pro interfile differential scan (default 2).
max-memorySTRING--max-memoryMaximum memory in MiB per file or interfile phase; 0 means no limit (default 0).
no-autofixBOOLEAN--no-autofixnegates -a/--autofix
config-fileFILE--configA YAML rule file to load as the configuration (FILE form of --config).
force-colorBOOLEAN--force-colorAlways include ANSI color in the output, even if not writing to a TTY; defaults to using the TTY status
gitlab-sastBOOLEAN--gitlab-sastOutput results in GitLab SAST format.
replacementSTRING--replacementAn autofix expression that will be applied to any matches found with --pattern. Only valid with a command-line specified pattern.
enable-nosemBOOLEAN--enable-nosemEnables 'nosem'. Findings will not be reported on lines containing a 'nosem' comment at the end. Enabled by default.
exclude-ruleSTRING--exclude-ruleSkip any rule with the given id. Can add multiple times.
experimentalBOOLEAN--experimentalEnable experimental features.
project-rootSTRING--project-rootForce a specific directory as the project root for gitignore and semgrepignore. Requires --experimental.
config-folderFOLDER--configA directory of YAML rule files to load as the configuration (FOLDER form of --config).
disable-nosemBOOLEAN--disable-nosemnegates --enable-nosem
no-git-ignoreBOOLEAN--no-git-ignorenegates --use-git-ignore
optimizationsSTRING--optimizationsTurn on/off optimizations. Default = 'all'. Use 'none' to turn all optimizations off.
pro-intrafileBOOLEAN--pro-intrafileIntra-file inter-procedural taint analysis. Implies --pro-languages. Requires Semgrep Pro Engine. See https://semgrep.dev/products/pro-engine/ for more.
pro-languagesBOOLEAN--pro-languagesEnable Pro languages (currently Apex, C#, and Elixir). Requires Semgrep Pro Engine. See https://semgrep.dev/products/pro-engine/ for more.
target-folderFOLDER·Source code folder
gitlab-secretsBOOLEAN--gitlab-secretsOutput results in GitLab Secrets format.
no-force-colorBOOLEAN--no-force-colornegates --force-color
trace-endpointSTRING--trace-endpointEndpoint to send OpenTelemetry traces to when --trace is set (internal use).
use-git-ignoreBOOLEAN--use-git-ignoreSkip files ignored by git when the scan root is inside a repository.
baseline-commitSTRING--baseline-commitOnly show results that are not found in this commit hash. Aborts run if not currently in a git directory, there are unstaged changes, or given baseline hash doesn't exist.
dataflow-tracesBOOLEAN--dataflow-tracesExplain how non-local values reach the location of a finding (only affects text and SARIF output).
max-target-bytesSTRING--max-target-bytesMaximum size for a file to be scanned, e.g. 1.5MB; 0 or negative disables it (default 1000000).
rewrite-rule-idsBOOLEAN--rewrite-rule-idsRewrite rule ids when they appear in nested sub-directories (Rule 'foo' in test/rules.yaml will be renamed 'test.foo').
test-ignore-todoBOOLEAN--test-ignore-todoIf --test-ignore-todo, ignores rules marked as '#todoruleid:' in test files.
interfile-timeoutSTRING--interfile-timeoutMaximum time to spend on interfile analysis. If set to 0 will not have time limit. Defaults to 0 s for all CLI scans. For CI scans, it defaults to 3 hours.
timeout-thresholdSTRING--timeout-thresholdMaximum number of rules that can time out on a file before the file is skipped. If set to 0 will not have limit. Defaults to 3.
files-with-matchesBOOLEAN--files-with-matchesOutput only the names of files containing matches. REQUIRES --experimental
historical-secretsBOOLEAN--historical-secretsScans git history using Secrets rules.
incremental-outputBOOLEAN--incremental-outputOutput results incrementally. REQUIRES --experimental
max-chars-per-lineSTRING--max-chars-per-lineMaximum number of characters to show per line.
pro-path-sensitiveBOOLEAN--pro-path-sensitivePath sensitivity. Implies --pro-intrafile. Requires Semgrep Pro Engine. See https://semgrep.dev/products/pro-engine/ for more.
use-osemgrep-sarifBOOLEAN--use-osemgrep-sarifOutput results using osemgrep.
no-rewrite-rule-idsBOOLEAN--no-rewrite-rule-idsnegates --rewrite-rule-ids
no-test-ignore-todoBOOLEAN--no-test-ignore-todonegates --test-ignore-todo
enable-version-checkBOOLEAN--enable-version-checkChecks Semgrep servers to see if the latest version is run; disabling this may reduce exit time after returning results.
max-log-list-entriesSTRING--max-log-list-entriesMaximum number of entries that will be shown in the log (e.g., list of rule ids, list of skipped files). A zero or negative value disables this filter. Defaults to 100
disable-version-checkBOOLEAN--disable-version-checknegates --enable-version-check
matching-explanationsBOOLEAN--matching-explanationsAdd debugging information in the JSON output to trace how different parts of a rule are matched (a.k.a., "Inspect Rule" in the Semgrep playground)
max-lines-per-findingSTRING--max-lines-per-findingMaximum number of lines of code that will be shown for each match before trimming (set to 0 for unlimited).
no-secrets-validationBOOLEAN--no-secrets-validationDisables secret validation.
exclude-minified-filesBOOLEAN--exclude-minified-filesSkip minified files. These are files that are > 7% whitespace, or who have a large number of bytes per line. By defualt minified files are scanned
scan-unknown-extensionsBOOLEAN--scan-unknown-extensionsAnalyze files named directly on the command line regardless of extension, using --lang or the rule's language.
skip-unknown-extensionsBOOLEAN--skip-unknown-extensionsnegates --scan-unknown-extensions
show-supported-languagesBOOLEAN--show-supported-languagesPrint a list of languages that are currently supported by Semgrep.
no-exclude-minified-filesBOOLEAN--no-exclude-minified-filesnegates --exclude-minified-files
allow-untrusted-validatorsBOOLEAN--allow-untrusted-validatorsAllows running rules with validators from origins other than semgrep.dev. Avoid running rules from origins you don't trust.
allow-dynamic-dependency-resolutionBOOLEAN--allow-dynamic-dependency-resolutionExperimental: allow resolving dependencies dynamically by communicating with package managers during the scan.

example

Run semgrep-scan

semgrep-scan · command
# scan a source tree with auto-selected rules, emit SARIF, and fail on findings
semgrep scan --config auto --sarif --error ./src > findings.sarif
sample output
Scanning 128 files tracked by git with 342 rules:

  src/app.py
    ❱ python.lang.security.audit.dangerous-subprocess-use  [ERROR]
        A command built from user input is passed to a shell.
        22┆ subprocess.call("ping -c 1 " + host, shell=True)

  src/db.py
    ❱ python.sqlalchemy.security.sqlalchemy-execute-raw-query  [WARNING]
        Raw SQL built with string formatting; use bound parameters.
        58┆ conn.execute("SELECT * FROM users WHERE id = %s" % uid)

Ran 342 rules on 128 files: 2 findings (2 blocking).

guidance

Choosing semgrep-scan

Reach for semgrep-scan when you want language-aware static analysis with rules you can read and extend. It analyzes source, so it sits in build and review rather than against a live target. For runtime web testing, pair it with nuclei or another dynamic scanner.

bandit

Python-only AST rules. Prefer when the tree is Python and you want plugin-style checks without YAML patterns.

gosec

Go AST rules for Go codebases. Same single-language specialist role as bandit.

trufflehog

Secrets and credential history in git and files. Adjacent Static Code Analysis job, not pattern SAST.

faq

semgrep-scan questions

`--config auto` pulls a registry rule set tailored to languages and frameworks detected in the project. Pin a pack like `p/python`, a local YAML, or a URL when you need a fixed set. Repeat `--config` to combine sources.

Pass `--sarif`. Findings land in SARIF for GitHub code scanning and most dashboards. In Trickest that file is the node output. Use `--json`, `--gitlab-sast`, or `--junit-xml` for other pipelines.

Yes. `--error` exits 1 when there are findings, which CI gates on. Add `--strict` to also fail on WARN-level issues and invalid configs.

End the line with `nosemgrep` (enabled by default). Drop paths with `--exclude` and a gitignore-style glob, or list them in `.semgrepignore`.

Semgrep reads source with pattern rules at build and review time. Nuclei hits live targets with YAML templates. Use both when you want static coverage plus runtime checks.

Bandit and gosec are language-specific AST scanners (Python and Go). Semgrep spans many languages with YAML-like pattern rules. Keep the specialists for single-stack depth; use Semgrep on mixed-language repos or when rules must port across languages.

related

More Static Code Analysis tools

  1. bandit

    Python source in, JSON security findings out.

  2. gitleaks

    Detect hardcoded secrets in git repos and plain directories.

  3. gosec

    Go AST security scanner for credentials, crypto, and injection.

  4. guarddog

    A package coordinate in, indicator hits out.

  5. malcontent-scan

    A package coordinate in, behavior findings out.

  6. osv-malicious

    A package coordinate in, malware advisory rows out.

Run semgrep-scan yourself

A source-code folder feeds semgrep-scan, which matches security patterns across the tree and writes the findings as a queryable output.

Open semgrep-scan in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.