OpenGrep
OpenGrep. Is a community fork of Semgrep CE, created in January 2025 after Semgrep moved several engine capabilities behind a commercial license.
Blurb
🔎 Static code analysis engine to find security issues in code. - opengrep/opengrep
Summary
When to use:
- You already run Semgrep rules and want CE-era engine features without a login
- You need cross-function taint, restored SARIF fingerprints, or native Windows support in OSS
- You prefer a multi-vendor consortium over a single vendor’s open-core split
When to skip: you want managed triage, SCA reachability, secrets validation, or AI autofix (stay on Semgrep AppSec Platform); you need the widest rule registry and vendor support today (Semgrep still leads mindshare).
Greenfield: either engine is fine; pilot both on the same rule pack.
Fork context: branched from Semgrep v1.100.0 (December 2024). Backers include Aikido, Endor Labs, Jit, Orca Security, and others. Goal is a foundation-governed engine with pro-only CE gaps reopened (cross-function analysis, extended languages, fingerprint metadata).
Pairs with: existing Semgrep CI configs (often drop-in); GitHub Actions; Shift Left gates on **Pull Request**s.
Details
| Topic | Notes |
|---|---|
| Compatibility | Semgrep rule syntax; common CLI flags; JSON and SARIF outputs |
| Engine focus | OCaml 5 parallelism, faster taint, extra languages (VB, Apex, Elixir) |
| Distribution | GitHub releases; also bundled in tools like Codacy (opengrep engine) |
| License | LGPL-2.1 |
| Governance | Consortium-backed; roadmap toward foundation stewardship |
vs Semgrep: Semgrep ships faster platform features (AI detection, supply chain, secrets). OpenGrep optimizes for OSS engine depth and rule portability. Semgrep has since added OCaml 5 and Windows support too; treat performance claims as benchmark-dependent.
References