# Semgrep

**Canonical:** https://apis.io/providers/semgrep/  
**Website:** https://semgrep.dev/  
**APIs profiled:** 6

Semgrep is a fast, open-source static analysis engine and an associated AppSec Platform (Semgrep Code, Semgrep Supply Chain, and Semgrep Secrets) that finds bugs, security issues, and policy violations across source code, dependencies, and credentials. The open-source CLI runs pattern-based rules locally or in CI; the AppSec Platform layers a managed control plane on top with organization-wide policy, triage workflows, findings management, and an OpenAPI-described REST API for deployments, projects, findings, scans, secrets, and supply chain data. Editor, CI, and SCM integrations (VS Code, JetBrains, GitHub, GitLab, Bitbucket, Azure DevOps) round out the developer surface.

## Kin Score — 20.8 / 100 (emerging)

Scored 2026-08-25 under rubric 0.14.0. Trend: flat (+0.0 from 20.8).

| Facet | Score |
|---|---|
| Discoverability | 81.5 |
| Contract Quality | 0.0 |
| Governance | 0.0 |
| Contract Governance | 0.0 |
| Operational Transparency | 26.3 |
| Developer Ergonomics | 9.5 |
| Commercial Clarity | 36.8 |
| Access Clarity | 36.8 |

## Agent readiness — 2.5 (human-only)

| Dimension | Value |
|---|---|
| Spec Presence | no |
| Agentic Access | no |
| Reversibility Documented | no |
| MCP Server | no |
| Auth Clarity | no |
| Idempotency | no |
| Error Semantics | no |
| OpenAPI Examples | no |
| Rate Limit Signal | documented |
| Event Surface Described | no |
| Agent Skills | no |
| Well Known Catalog | no |
| Consent Identity | no |
| Agent Card | no |
| Dry Run Mode | no |
| Delegated Identity | no |
| Protected Resource Metadata | no |
| Dynamic Client Registration | no |
| Agentic Commerce | no |

## Access

Free — onboarding: unknown, pricing: free, trial: no (confidence: medium).

## APIs (6)

- **Semgrep AppSec Platform REST API** — OpenAPI-described REST API for the Semgrep AppSec Platform. Lists deployments, projects, findings, scans, secrets, and supply chain data, and supports CI/CD and triage automatio...
- **Semgrep CLI** — Open-source command-line static analysis engine. Runs locally and in CI to scan code with community and custom rules, emit SARIF/JSON output, and enforce policies. Authored prim...
- **Semgrep Community Rules** — Community and Semgrep-maintained rule packs covering security, correctness, best-practice, and supply chain findings across many languages and frameworks. Consumed by the CLI an...
- **Semgrep VS Code Extension** — Visual Studio Code extension that surfaces Semgrep findings inline while developers edit code, with quick-fix and triage actions tied to the AppSec Platform.
- **Semgrep Interfaces** — Shared interface definitions (ATD-generated types) used between the Semgrep CLI, AppSec Platform, and language-specific clients to keep output schemas in sync.
- **Semgrep Documentation** — Source for the Semgrep product documentation site, including CLI reference, rule-writing guides, AppSec Platform docs, and API reference.

## Security (3)

- **Semgrep Domain Security** — TLSv1.3 · HSTS · DMARC
- **Semgrep Vulnerability Disclosure** — security.txt · contact published
- **Semgrep Trust Center** — SOC 2, GDPR

## Plans (1)

- **Semgrep Plans Pricing**

## Tags

Static Analysis, SAST, Application Security, Supply Chain, Secrets Detection, Developer Tools, DevSecOps

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/providers/semgrep/). Scores are computed from the provider's own public artifacts under a published rubric.