What is Opengrep?

Updated

Opengrep is an open-source static code security engine — a SAST (Static Application Security Testing) tool — created as a fork of Semgrep CE (formerly Semgrep OSS). It exists because Semgrep moved critical scanning-engine features behind a commercial license, and Opengrep's stated mission is to keep advanced static analysis fully open-source. If you currently use Semgrep CE and want to keep access to engine capabilities without a commercial license or login, Opengrep is designed as a backward-compatible replacement.

Why Opengrep exists

According to the project, recent changes by Semgrep affected its open-source nature by removing critical features of the scanning engine behind a commercial license. The features moved out of the open-source engine reportedly include:

  • Language support
  • Tracking ignores
  • Fingerprint
  • Meta-variables
  • Other engine capabilities

Opengrep's stated goal is to build "the most advanced static analysis engine — fully open-source," and to commoditize and advance SAST rather than gate it.

What you get as a user

The project describes its value to users in three main ways:

Area What Opengrep offers
Engine capability A more capable scanning engine that does not hide essential metadata and new scanning capabilities behind a login
Compatibility Backward compatible, with support for common JSON and SARIF outputs so it can be integrated into existing workflows
Advanced analysis Unlocks previously pro-only capabilities, including inter-procedural (cross-function) analysis, cross-file analysis, Windows support, and extended language support
Long-term assurance Future improvements and features won't be locked into specific vendors

Contributions and pull requests are described as being reviewed and accepted on merit, not contingent on any single company's commercial interest.

Who is behind it

Opengrep is backed by a consortium of organizations in the application security space, including Aikido Security, Amplify, Endor Labs, Kodem, and Orca Security, among others. A full-time developer team builds the engine, with each organization contributing resources or OCaml development power. The parties state they remain committed to keeping Opengrep free and open-source.

How to get started

The project points to its GitHub repository for installation, running, and contributing:

  • Repository: github.com/opengrep/opengrep — install, run, or contribute to the Opengrep CLI.

Community discussion is encouraged via X, Reddit, and other social channels listed on the site.

When Opengrep is a good fit

Opengrep is worth evaluating if you:

  • Use Semgrep CE and depend on engine features that have moved behind a commercial license.
  • Need SAST output in JSON or SARIF for CI/CD integration.
  • Want cross-function or cross-file analysis without a vendor login.
  • Prefer a tool whose roadmap and contributions are governed by a multi-vendor consortium rather than one company.

Because Opengrep is positioned as backward compatible with common output formats, the practical starting point is to install the CLI from the GitHub repository and test it against your existing rules and pipelines before committing to a migration.