{
 "categories": [
  "developer-tools",
  "quality-management"
 ],
 "deployment": "saas",
 "evidence": [
  {
   "date": "2026-09-05",
   "fact": "homepage",
   "note": "Semgrep presents an AppSec platform that unifies SAST (Semgrep Code), SCA, and secrets scanning, and markets an MCP server for AI coding tools.",
   "source": "https://semgrep.dev/",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "license",
   "note": "Semgrep publishes a Free Edition (up to 10 contributors and 10 private repositories) plus paid Teams and Enterprise plans.",
   "source": "https://semgrep.dev/pricing",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "license",
   "note": "Semgrep Community Edition is LGPL 2.1. Semgrep AppSec Platform, Semgrep Code, Semgrep Secrets, and Semgrep Supply Chain are proprietary.",
   "source": "https://docs.semgrep.dev/licensing",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "platforms",
   "note": "Official quickstart documents Semgrep CLI install on macOS, Linux, and Windows (beta), plus Docker. The AppSec Platform is a web application.",
   "source": "https://docs.semgrep.dev/getting-started/quickstart",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "modalities.api.exists",
   "note": "Semgrep documents Semgrep AppSec Platform web API v1 in OpenAPI format.",
   "source": "https://docs.semgrep.dev/api-reference/v1/Introduction",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "modalities.api.kinds[0]",
   "note": "The findings endpoint is HTTPS REST GET /api/v1/deployments/{deploymentSlug}/findings on https://semgrep.dev, documented as OpenAPI 3.0.3.",
   "source": "https://docs.semgrep.dev/api-reference/v1/findingsservice/list-code-supply-chain-or-ai-powered-detection-findings",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "modalities.api.auth[0]",
   "note": "The API authenticates with an API token that has the Web API permission, provisioned from Settings.",
   "source": "https://docs.semgrep.dev/api-reference/v1/Authentication",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "modalities.api.auth[0]",
   "note": "API tokens are the token type that can connect to the Semgrep API. CLI tokens and default service tokens cannot.",
   "source": "https://docs.semgrep.dev/deployment/tokens",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "modalities.api.coverage",
   "note": "v1 documents deployments, findings, projects, and scans. The opened pages do not document executing a local scan through this API.",
   "source": "https://docs.semgrep.dev/api-reference/v1/findingsservice/list-code-supply-chain-or-ai-powered-detection-findings",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "modalities.mcp.first_party",
   "note": "The official semgrep/semgrep CLI README documents `semgrep mcp` with stdio and streamable-http transports, Docker, optional SEMGREP_APP_TOKEN, and a sample call to semgrep_scan_remote. Community mcp-server-semgrep is listed as inspiration.",
   "source": "https://raw.githubusercontent.com/semgrep/semgrep/develop/cli/src/semgrep/mcp/README.md",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "modalities.mcp.verdict",
   "note": "Semgrep Guardian vendor docs bundle the Semgrep MCP server and document local configs that run `semgrep` with args `[mcp]`, plus a hosted remote Claude Code plugin.",
   "source": "https://docs.semgrep.dev/semgrep-guardian/overview",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "modalities.cli.exists",
   "note": "Semgrep documents an official CLI with `semgrep scan`, `semgrep ci`, `semgrep login`, and structured `--json` / `--sarif` / `--text` output.",
   "source": "https://docs.semgrep.dev/getting-started/cli",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "modalities.cli.exists",
   "note": "CI documents SEMGREP_APP_TOKEN for authenticated `semgrep ci` against Semgrep AppSec Platform.",
   "source": "https://docs.semgrep.dev/semgrep-ci/ci-environment-variables",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "modalities.extensibility.webhooks",
   "note": "Semgrep AppSec Platform posts JSON semgrep_scan, semgrep_finding, and semgrep_supply_chain_incident objects to a subscriber URL, optionally signed with X-Semgrep-Signature-256.",
   "source": "https://docs.semgrep.dev/semgrep-appsec-platform/webhooks",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "modalities.data_access.export[0]",
   "note": "The CLI writes findings as JSON with `--json` / `--json-output`.",
   "source": "https://docs.semgrep.dev/getting-started/cli",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "modalities.data_access.export[1]",
   "note": "The CLI writes findings as SARIF with `--sarif` / `--sarif-output`.",
   "source": "https://docs.semgrep.dev/getting-started/cli",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "modalities.agent_docs.llms_txt",
   "note": "Opened https://docs.semgrep.dev/llms.txt. It is a documentation index of Semgrep CLI, platform, API v1/v2, and related pages, not a marketing fallback.",
   "source": "https://docs.semgrep.dev/llms.txt",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "verdict.scores.api",
   "note": "The OpenAPI REST API is documented and covers platform findings and related resources, but it is a management API rather than a full substitute for CLI scans.",
   "source": "https://docs.semgrep.dev/api-reference/v1/Introduction",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "verdict.scores.mcp",
   "note": "Official MCP is bundled in the CLI and can invoke semgrep_scan_remote. The opened pages do not publish a complete tool catalog, so the path is official with material documentation limits.",
   "source": "https://raw.githubusercontent.com/semgrep/semgrep/develop/cli/src/semgrep/mcp/README.md",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "verdict.scores.cli",
   "note": "The official CLI has account login, CI token auth, JSON/SARIF output, and product-scoped scan flags. That is a broad, maintained production path.",
   "source": "https://docs.semgrep.dev/getting-started/cli",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "freshness.watch[0].url",
   "note": "Opened the official CLI MCP README on the develop branch. It documents semgrep mcp transports, client configs, SEMGREP_APP_TOKEN, and the semgrep_scan_remote sample.",
   "source": "https://raw.githubusercontent.com/semgrep/semgrep/develop/cli/src/semgrep/mcp/README.md",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "freshness.watch[1].url",
   "note": "Opened Semgrep Guardian setup. It documents first-party MCP via `semgrep mcp` and a hosted remote Claude Code plugin.",
   "source": "https://docs.semgrep.dev/semgrep-guardian/overview",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "freshness.watch[2].url",
   "note": "Opened and verified as the current Semgrep API v1 authentication page (Web API token).",
   "source": "https://docs.semgrep.dev/api-reference/v1/Authentication",
   "tier": "declared"
  },
  {
   "date": "2026-09-05",
   "fact": "freshness.watch[3].url",
   "note": "Opened and verified as the current official local-scan CLI page, including output formats and semgrep ci versus semgrep scan.",
   "source": "https://docs.semgrep.dev/getting-started/cli",
   "tier": "declared"
  }
 ],
 "freshness": {
  "last_verified": "2026-09-05",
  "volatility": "high",
  "watch": [
   {
    "type": "mcp",
    "url": "https://raw.githubusercontent.com/semgrep/semgrep/develop/cli/src/semgrep/mcp/README.md"
   },
   {
    "type": "mcp",
    "url": "https://docs.semgrep.dev/semgrep-guardian/overview"
   },
   {
    "type": "docs",
    "url": "https://docs.semgrep.dev/api-reference/v1/Authentication"
   },
   {
    "type": "docs",
    "url": "https://docs.semgrep.dev/getting-started/cli"
   }
  ]
 },
 "homepage": "https://semgrep.dev/",
 "id": "semgrep",
 "license": "freemium",
 "modalities": {
  "agent_docs": {
   "llms_txt": true
  },
  "api": {
   "auth": [
    "bearer-api-token"
   ],
   "coverage": "partial",
   "docs": "https://docs.semgrep.dev/api-reference/v1/Introduction",
   "exists": true,
   "kinds": [
    "rest"
   ]
  },
  "cli": {
   "exists": true
  },
  "computer_use": {
   "issues": [],
   "viability": "unknown"
  },
  "data_access": {
   "export": [
    "json",
    "sarif"
   ],
   "import": []
  },
  "extensibility": {
   "scripting": [],
   "webhooks": true
  },
  "integrations": {
   "make": "unknown",
   "n8n": "unknown",
   "power_automate": "unknown",
   "zapier": "unknown"
  },
  "mcp": {
   "first_party": true,
   "third_party": [],
   "verdict": "official"
  },
  "rpa": {
   "drivability": "unknown",
   "notes": "No repeatable UI probe was run. Semgrep's official CLI, AppSec Platform REST API, outbound webhooks, and first-party MCP cover practical SAST and secrets automation without browser control.\n",
   "ui_stack": [
    "web-dom"
   ],
   "vendor_support": []
  },
  "sdk": {
   "exists": "unknown",
   "languages": [],
   "official": "unknown"
  }
 },
 "name": "Semgrep",
 "platforms": [
  "web",
  "windows",
  "macos",
  "linux"
 ],
 "related": {
  "alternatives": [
   "snyk",
   "sonarqube"
  ],
  "our_products": []
 },
 "schema_version": 1,
 "score_version": 1,
 "status": "active",
 "vendor": "Semgrep",
 "verdict": {
  "best_path": "cli",
  "scores": {
   "api": 7,
   "cli": 8,
   "computer_use": null,
   "integrations": null,
   "mcp": 6,
   "overall": 8,
   "rpa": null
  },
  "summary": "Semgrep is automatable today through the official Semgrep CLI. This record is Semgrep SAST and secret scanning, including Semgrep Code and the first-party MCP entry point bundled as `semgrep mcp`. It is not Snyk. The CLI installs with pipx, uv, Homebrew, or the `semgrep/semgrep` Docker image and runs on macOS, Linux, and Windows (beta). `semgrep scan` works without an account. `semgrep ci` uses a Semgrep account, `semgrep login`, or `SEMGREP_APP_TOKEN` to pull organization policies and optionally upload findings. Structured output includes text, JSON, and SARIF. Product flags include `--code`, `--supply-chain`, and `--secrets`. The same CLI hosts first-party MCP over stdio or streamable-http. Official client configs use `command: semgrep` / `args: [mcp]` and may set `SEMGREP_APP_TOKEN`. Semgrep Guardian documents the same local MCP command and a hosted remote plugin for Claude Code. The opened MCP README names one sample tool, `semgrep_scan_remote`; a full tool catalog was not published on the opened pages. Community `mcp-server-semgrep` is listed as inspiration, not the official server. The AppSec Platform REST API is OpenAPI-documented at `https://semgrep.dev` and authenticates with an API token that has the Web API permission in an Authorization: Bearer header. Documented resources include findings, deployments, projects, scans, and secrets. That API manages platform records; it does not replace local `semgrep scan` / `semgrep ci`. Outbound JSON webhooks post scan and finding objects. iPaaS connector catalogs were not opened. Computer-use viability is unassessed. The CLI scores 8 and is the best path because it scans locally, authenticates in CI, and is the process that serves MCP.\n"
 }
}