[opensourcedex]

Opengrep is a free, open source application security project written in OCaml and released under LGPL-2.1. It has 3,084 GitHub stars, 263 forks and 92 open issues, and was last pushed 8 hours ago. On this registry it ranks #8 of 16 tracked projects in Application Security, with 5 head-to-head comparisons available. It gained 21 stars over the last 6 tracked days.

What is Opengrep?

What it is

Opengrep is an open-source static code analysis engine for finding security issues in code. It is a fork of Semgrep, released under the LGPL 2.1 license, and is backed by a consortium of AppSec organizations, including Aikido, Amplify, Endor Labs, Kodem, and Orca Security. The project lives in the developer security ecosystem as a command-line SAST tool that scans source code for patterns and vulnerabilities.

The concrete problem it addresses is the loss of access to advanced static analysis features when Semgrep moved critical capabilities behind a commercial license. Opengrep aims to keep those capabilities open and accessible by preserving compatibility with existing Semgrep rules, providing standard JSON and SARIF outputs, and committing to open governance and long-term open-source availability.

Key capabilities

  • Opengrep is compatible with Semgrep rules and rulesets, so existing rule libraries can be used without modification.
  • It emits standard JSON and SARIF outputs, which allow integration into developer tooling and security reporting pipelines.
  • It provides intrafile taint analysis through the --taint-intrafile option, including constructor and field assignment tracking, inter-method taint flow, higher-order function support across 12 languages, and collection method tainting.
  • It supports more than 30 languages, including Apex, Bash, C, C++, C#, Clojure, Crystal, Dart, Dockerfile, Elixir, Go, HTML, Java, JavaScript, JSON, Jsonnet, JSX, Julia, Kotlin, Lisp, Lua, OCaml, PHP, Python, R, Ruby, Rust, Scala, Scheme, Solidity, Swift, Terraform, TSX, TypeScript, Visual Basic, XML, YAML, and generic patterns.
  • It adds language coverage beyond Semgrep CE or Pro, including Visual Basic, and beyond Semgrep CE, including Apex and Elixir, while improving Clojure tainting, PHP 8.4, and C# 14 support.
  • It distributes self-contained binaries built with Nuitka, which do not require Python, and publishes signed releases with Cosign.
  • It operates under open governance, accepting contributions on merit rather than commercial interest, and commits to LGPL 2.1 licensing.

Who uses it and how

  • Developers use the opengrep scan command to search code bases for security patterns, such as a risky Rust unwrap, by supplying a rule file and a target path.
  • Security teams integrate Opengrep into automated workflows by consuming its JSON or SARIF output for triage, dashboards, or pull request feedback.
  • Organizations migrating from Semgrep use Opengrep to preserve existing Semgrep rules and rulesets while retaining access to advanced taint analysis features.
  • Teams that need broader language coverage use it for repositories containing Visual Basic, Apex, Elixir, or other supported languages.
  • Operators install the self-contained binary through the provided Linux, macOS, or Windows scripts, or download it from the releases page, and run scans locally or in a pipeline.

Getting started

Typical installation uses the Linux and macOS curl script, the Windows PowerShell install script, or manual binary download from the releases page. A basic workflow creates a YAML rule and a code sample, then runs opengrep scan -f rules code/rust to scan the target path.

When to use it — and when not to

Opengrep is a good fit for teams that want an open-source, Semgrep-compatible SAST engine with advanced taint analysis and support for languages such as Visual Basic, Apex, and Elixir. It may be less suitable for organizations that require a hosted service, commercial support, or a mature track record, because the repository is recorded as zero years old, has 92 open issues, and lists zero contributors. Self-hosting mainly means installing and operating the command-line binary and rule set, since the provided facts do not mention a database, storage service, or SMTP requirement.

project readme (upstream, from github) — read inline

Welcome to Opengrep, a fork of Semgrep, under the LGPL 2.1 license

Opengrep is the most advanced open source SAST engine.

Let's make secure software development a shared standard. Opengrep provides every developer and organisation with open and advanced static code analysis.

Opengrep is backed by a consortium of AppSec organisations, including: Aikido, Amplify, Endor Labs, Kodem, and Orca Security. To learn more, read the manifesto at opengrep.dev.

Why Opengrep?

Opengrep was created when Semgrep moved critical features behind a commercial licence. We believe advanced static analysis should remain open and accessible to all.

Key advantages:

  • Compatible with Semgrep rules - your existing rules and rulesets work unchanged
  • Standard outputs - JSON and SARIF formats for easy integration
  • Open governance - contributions accepted on merit, not commercial interest
  • Long-term assurance - committed to open-source under LGPL 2.1

Key Improvements

Opengrep has introduced significant improvements since the fork. Highlights include:

Superior Taint Analysis (--taint-intrafile):

  • Constructor and field assignment tracking
  • Inter-method taint flow
  • Higher-order function support across 12 languages
  • Collection method tainting (map, filter, reduce, etc.)

See the Intrafile Tainting Tutorial and Higher-Order Functions Tutorial for details.

Language Support:

  • Visual Basic - not available in Semgrep CE or Pro
  • Apex, Elixir - not in Semgrep CE
  • Improved: Clojure (tainting support), PHP 8.4, C# 14

Distribution:

  • Self-contained binaries via Nuitka (no Python required)
  • Signed releases with Cosign

See OPENGREP.md for the full list of improvements since the fork.

Opengrep: Fast and Powerful Code Pattern Search

Opengrep is an ultra-fast static analysis tool for searching code patterns with the power of semantic grep. Analyze large code bases at the speed of thought with intuitive pattern matching and customizable rules. Find and fix security vulnerabilities, fast – ship more secure code.

Opengrep supports 30+ languages, including:

Apex · Bash · C · C++ · C# · Clojure · Crystal · Dart · Dockerfile · Elixir · Go · HTML · Java · JavaScript · JSON · Jsonnet · JSX · Julia · Kotlin · Lisp · Lua · OCaml · PHP · Python · R · Ruby · Rust · Scala · Scheme · Solidity · Swift · Terraform · TSX · TypeScript · Visual Basic · XML · YAML · Generic (ERB, Jinja, etc.)

Installation

Quick Install (Recommended)

Linux / macOS
curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash

Or if you've cloned the repo:

./install.sh
Windows (PowerShell)
irm https://raw.githubusercontent.com/opengrep/opengrep/main/install.ps1 | iex

Or with a specific version:

& ([scriptblock]::Create((irm https://raw.githubusercontent.com/opengrep/opengrep/main/install.ps1))) -Version v1.16.0

Manual Install

Binaries are available on the releases page.

Getting started

Create rules/demo-rust-unwrap.yaml with the following content:

rules:
- id: unwrapped-result
  pattern: $VAR.unwrap()
  message: "Unwrap detected - potential panic risk"
  languages: [rust]
  severity: WARNING

and code/rust/main.rs with the following content (that contains a risky unwrap):

fn divide(a: i32, b: i32) -> Result<i32, String> {
    if b == 0 {
        return Err("Division by zero".to_string());
    }
    Ok(a / b)
}

fn main() {
    let result = divide(10, 0).unwrap(); // Risky unwrap!
    println!("Result: {}", result);
}

You should now have: 

.
├── code
│   └── rust
│       └── main.rs
└── rules
    └── demo-rust-unwrap.yaml

Now run: 

❯ opengrep scan -f rules code/rust

┌──────────────┐
│ Opengrep CLI │
└──────────────┘


Scanning 1 file (only git-tracked) with 1 Code rule:

  CODE RULES
  Scanning 1 file.

  PROGRESS

  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00


┌────────────────┐
│ 1 Code Finding │
└────────────────┘

    code/rust/main.rs
    ❯❯ rules.unwrapped-result
          Unwrap detected - potential panic risk

            9┆ let result = divide(10, 0).unwrap(); // Risky unwrap!



┌──────────────┐
│ Scan Summary │
└──────────────┘

Ran 1 rule on 1 file: 1 finding.

To obtain SARIF output: 

❯ opengrep scan --sarif-output=sarif.json -f rules code
  ...
❯ cat sarif.json | jq
{
  "version": "2.1.0",
  "runs": [
    {
      "invocations": [
        {
          "executionSuccessful": true,
          "toolExecutionNotifications": []
        }
      ],
      "results": [
        {
          "fingerprints": {
            "matchBasedId/v1": "a0ff5ed82149206a74ee7146b075c8cb9e79c4baf86ff4f8f1c21abea6ced504e3d33bb15a7e7dfa979230256603a379edee524cf6a5fd000bc0ab29043721d8_0"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "code/rust/main.rs",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "endColumn": 40,
                  "endLine": 9,
                  "snippet": {
                    "text": "    let result = divide(10, 0).unwrap(); // Risky unwrap!"
                  },
                  "startColumn": 18,
                  "startLine": 9
                }
              }
            }
          ],
          "message": {
            "text": "Unwrap detected - potential panic risk"
          },
          "properties": {},
          "ruleId": "rules.unwrapped-result"
        }
      ],
      "tool": {
        "driver": {
          "name": "Opengrep OSS",
          "rules": [
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Unwrap detected - potential panic risk"
              },
              "help": {
                "markdown": "Unwrap detected - potential panic risk",
                "text": "Unwrap detected - potential panic risk"
              },
              "id": "rules.unwrapped-result",
              "name": "rules.unwrapped-result",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Opengrep Finding: rules.unwrapped-result"
              }
            }
          ],
          "semanticVersion": "1.100.0"
        }
      }
    }
  ],
  "$schema": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/schemas/sarif-schema-2.1.0.json"
}

Documentation

Community

More

Opengrep is a fork of Semgrep v1.100.0, created by Semgrep Inc. Opengrep is not affiliated with or endorsed by Semgrep Inc.

Frequently asked questions

Is Opengrep free to use?

Opengrep is open source under the LGPL-2.1 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does Opengrep do?

Open-source code security engine for developers

What is Opengrep written in?

Opengrep is primarily written in OCaml. Its source is publicly available at https://github.com/opengrep/opengrep, and it has 3,084 GitHub stars.