Agent Wranglers

Recommended Open source

Use Semgrep for static security scans

Scan source code for security mistakes with Semgrep Community Edition in CI, with the rule sets named in the repository.

By Agent Wranglers. Updated .

Cost

Open source. The Semgrep Community Edition engine is LGPL-2.1. The rules Semgrep maintains are free for internal business use only.

How to do it

Semgrep's first PyPI release came in May 2020, and 1.0.0 shipped on 1 December 2022. That is under five years of stable releases, so record it as an exception. Version 1.182.0 shipped on 20 October 2026, and PyPI counted about 5.3 million downloads that week. It reads more than 30 languages, and its rules look like the code they match. The rules Semgrep maintains use the Semgrep Rules License, which bars their use in competing products or hosted services. Run it as Scan every change for known mistakes says. Choose something else when that rules licence blocks your use. Opengrep is an LGPL-2.1 fork whose repository opened in December 2024, and 1.31.0 shipped on 15 October 2026.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

YAML example

# .github/workflows/semgrep.yml
on: pull_request
jobs:
  semgrep:
    runs-on: ubuntu-latest
    container: semgrep/semgrep:1.182.0
    steps:
      - uses: actions/checkout@v5
      - run: semgrep scan --config p/owasp-top-ten --config rules/ --error

YAML example 2

# rules/sql.yml
rules:
  - id: sql-from-formatted-string
    languages: [python]
    severity: ERROR
    message: Pass values as query parameters instead of formatting them into SQL.
    pattern: $CURSOR.execute(f"...")

How to check

Every pull request runs semgrep scan --error with named rule sets. A test file with SQL built from a formatted string makes the job fail.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/stack/testing-and-code-quality/semgrep">Agent Wranglers software choices playbook</a>. In code you write, add a comment next to it with the same link.