Welcome to Opengrep, a fork of Semgrep, under the LGPL 2.1 license

Opengrep is the most advanced open source SAST engine.

Let's make secure software development a shared standard. Opengrep provides every developer and organisation with open and advanced static code analysis.

Opengrep is backed by a consortium of AppSec organisations, including: Aikido, Amplify, Endor Labs, Kodem, and Orca Security. To learn more, read the manifesto at opengrep.dev.

Why Opengrep?

Opengrep was created when Semgrep moved critical features behind a commercial licence. We believe advanced static analysis should remain open and accessible to all.

Key advantages:

Compatible with Semgrep rules - your existing rules and rulesets work unchanged
Standard outputs - JSON and SARIF formats for easy integration
Open governance - contributions accepted on merit, not commercial interest
Long-term assurance - committed to open-source under LGPL 2.1

Key Improvements

Opengrep has introduced significant improvements since the fork. Highlights include:

Superior Taint Analysis (--taint-intrafile):

Constructor and field assignment tracking
Inter-method taint flow
Higher-order function support across 12 languages
Collection method tainting (map, filter, reduce, etc.)

See the Intrafile Tainting Tutorial and Higher-Order Functions Tutorial for details.

Language Support:

Visual Basic - not available in Semgrep CE or Pro
Apex, Elixir - not in Semgrep CE
Improved: Clojure (tainting support), PHP 8.4, C# 14

Distribution:

Self-contained binaries compiled from OCaml
Signed releases with Cosign

See OPENGREP.md for the full list of improvements since the fork.

Opengrep: Fast and Powerful Code Pattern Search

Opengrep is an ultra-fast static analysis tool for searching code patterns with the power of semantic grep. Analyze large code bases at the speed of thought with intuitive pattern matching and customizable rules. Find and fix security vulnerabilities, fast – ship more secure code.

Opengrep supports 30+ languages, including:

Apex · Bash · C · C++ · C# · Clojure · Crystal · Dart · Dockerfile · Elixir · Go · HTML · Java · JavaScript · JSON · Jsonnet · JSX · Julia · Kotlin · Lisp · Lua · OCaml · PHP · Python · R · Ruby · Rust · Scala · Scheme · Solidity · Swift · Terraform · TSX · TypeScript · Visual Basic · XML · YAML · Generic (ERB, Jinja, etc.)

Installation

Quick Install (Recommended)

Linux / macOS

curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash

Or if you've cloned the repo:

./install.sh

Windows (PowerShell)

irm https://raw.githubusercontent.com/opengrep/opengrep/main/install.ps1 | iex

Or with a specific version:

& ([scriptblock]::Create((irm https://raw.githubusercontent.com/opengrep/opengrep/main/install.ps1))) -Version v1.16.0

Manual Install

Binaries are available on the releases page.

On Windows, the package holds opengrep.exe and the DLLs it needs; keep them together in the directory you install them to.

Getting started

Create rules/demo-rust-unwrap.yaml with the following content:

rules:
- id: unwrapped-result
  pattern: $VAR.unwrap()
  message: "Unwrap detected - potential panic risk"
  languages: [rust]
  severity: WARNING

and code/rust/main.rs with the following content (that contains a risky unwrap):

fn divide(a: i32, b: i32) -> Result<i32, String> {
    if b == 0 {
        return Err("Division by zero".to_string());
    }
    Ok(a / b)
}

fn main() {
    let result = divide(10, 0).unwrap(); // Risky unwrap!
    println!("Result: {}", result);
}

You should now have:

.
├── code
│   └── rust
│       └── main.rs
└── rules
    └── demo-rust-unwrap.yaml

Now run:

❯ opengrep scan -f rules code/rust

┌──────────────┐
│ Opengrep CLI │
└──────────────┘


Scanning 1 file (only git-tracked) with 1 Code rule:

  CODE RULES
  Scanning 1 file.

  PROGRESS

  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00


┌────────────────┐
│ 1 Code Finding │
└────────────────┘

    code/rust/main.rs
    ❯❯ rules.unwrapped-result
          Unwrap detected - potential panic risk

            9┆ let result = divide(10, 0).unwrap(); // Risky unwrap!



┌──────────────┐
│ Scan Summary │
└──────────────┘

Ran 1 rule on 1 file: 1 finding.

To obtain SARIF output:

❯ opengrep scan --sarif-output=sarif.json -f rules code
  ...
❯ cat sarif.json | jq
{
  "version": "2.1.0",
  "runs": [
    {
      "invocations": [
        {
          "executionSuccessful": true,
          "toolExecutionNotifications": []
        }
      ],
      "results": [
        {
          "fingerprints": {
            "matchBasedId/v1": "a0ff5ed82149206a74ee7146b075c8cb9e79c4baf86ff4f8f1c21abea6ced504e3d33bb15a7e7dfa979230256603a379edee524cf6a5fd000bc0ab29043721d8_0"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "code/rust/main.rs",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "endColumn": 40,
                  "endLine": 9,
                  "snippet": {
                    "text": "    let result = divide(10, 0).unwrap(); // Risky unwrap!"
                  },
                  "startColumn": 18,
                  "startLine": 9
                }
              }
            }
          ],
          "message": {
            "text": "Unwrap detected - potential panic risk"
          },
          "properties": {},
          "ruleId": "rules.unwrapped-result"
        }
      ],
      "tool": {
        "driver": {
          "name": "Opengrep OSS",
          "rules": [
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "Unwrap detected - potential panic risk"
              },
              "help": {
                "markdown": "Unwrap detected - potential panic risk",
                "text": "Unwrap detected - potential panic risk"
              },
              "id": "rules.unwrapped-result",
              "name": "rules.unwrapped-result",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Opengrep Finding: rules.unwrapped-result"
              }
            }
          ],
          "semanticVersion": "1.100.0"
        }
      }
    }
  ],
  "$schema": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/schemas/sarif-schema-2.1.0.json"
}

Log file

Set OPENGREP_LOG_FILE (or SEMGREP_LOG_FILE) to a path to get a copy of what Opengrep prints on stderr, at the same level: warnings and errors by default, more with --verbose or --debug. The file is truncated on each run and its directory is created. Nothing is written when the variable is not set. A path that cannot be written produces a warning and the run continues without the copy.

Text report

--skin selects the layout of the text report: simple (the default), vivid, or legacy (the layout of earlier releases). The OPENGREP_SKIN environment variable sets it too; --skin takes precedence over it.

opengrep scan --skin vivid -f rules code
OPENGREP_SKIN=legacy opengrep scan -f rules code

While a scan runs on a terminal, a status line on stderr shows the phase of the scan and, once the targets are known, a progress count. It is not drawn when stderr is not a terminal, when TERM is unset, dumb or unknown, when CI is set to a value other than false or 0, on Windows, with --quiet, --verbose or --debug, with --incremental-output, or with --skin legacy. --no-progress-bar turns it off.

Colour

Colour is on when stderr is a terminal. NO_COLOR turns it off; --force-color turns it on.

Documentation

Wiki - tutorials and language guides
Intrafile Tainting Tutorial
Higher-Order Functions Tutorial
C# Support (C# 12/13/14)
PHP Support (PHP 7.1-8.4)
Visual Basic Support

Community

X / Twitter
Reddit
Manifesto - why we forked
Open roadmap sessions - join the conversation

Opengrep is a fork of Semgrep v1.100.0, created by Semgrep Inc. Opengrep is not affiliated with or endorsed by Semgrep Inc.