Code & dependency security
Semgrep
App security platform that combines custom and built-in rules for SAST, dependencies, secrets, and supply-chain checks in CI and the editor.
Pricing as seen
See site.
Checked 16 Oct 2026. Prices change. Confirm on the vendor site before you buy.
Pricing sourceUpdated
16 Oct 2026
Added
16 Oct 2026
Supported builders
Practical once the code is in a repository you run in CI. Semgrep’s site names MCP integrations for Cursor and Replit. Lovable and Bolt projects fit after you export or sync the repo.
What it is
Semgrep scans source with rules: patterns you write and rules they maintain. The current platform page describes SAST, software composition analysis, secrets scanning, and malware protection in one product, with CLI, CI, and IDE support.
It also lists MCP integrations for AI tools such as Cursor and Replit. That makes it one of the code scanners that talks about agents directly, instead of only about a Jenkins plugin.
Best for: A real git repo where you want pull-request comments on dangerous patterns and leaked secrets.
Watch-outs
- Rules only catch what they describe. A quiet scan can mean a gap in the ruleset.
- Public pricing was not copied into this entry. Check the site.
Our take
Opinion from ShipSafeStack. Not a score, not a certification, and not a sponsorship.
The open rule model is why teams keep it even after they add a heavier platform. It will not see a misconfigured live Supabase project unless that misconfiguration is visible in code. Pair it with a URL scanner if the app is already deployed.