How to Get Started with Opengrep

Updated

Opengrep is an open-source static analysis (SAST) engine, forked from Semgrep CE, and the way to start is through its CLI at github.com/opengrep/opengrep. You can install and run the engine locally to scan code, or contribute to the project. This guide covers what Opengrep is, how to get it running, and how to participate.

What Opengrep Is

Opengrep is a fork of Semgrep CE (formerly Semgrep OSS), created in response to changes by Semgrep that affected its open-source nature. According to the project, those changes removed critical features of the scanning engine behind a commercial license, including language support, tracking ignores, fingerprint, and meta-variables.

Opengrep's stated mission is to build the most advanced static analysis engine as fully open-source. It is backed by a consortium of application security organizations, including Aikido Security, Amplify, Endor Labs, Kodem, and Orca Security, with a full-time developer team and contributions of resources and OCaml development power.

Getting Started

The single entry point for installation, running, and contributing is the GitHub repository:

github.com/opengrep/opengrep

From there you can:

  • Install the Opengrep CLI
  • Run the engine locally against your code
  • Contribute to the project

Installing and Running

The repository is where you install and run the Opengrep CLI. Opengrep is designed to be backward compatible and supports common JSON and SARIF outputs, so you can adopt it and integrate it into existing workflows. Because it is backward compatible, teams already using Semgrep-style output formats can plug Opengrep into the same pipelines.

What the Engine Offers

Per the project, Opengrep unlocks capabilities that were previously pro-only, including:

  • Inter-procedural analysis (cross-function)
  • Cross-file analysis
  • Windows support
  • Extended language support

It also does not hide essential metadata and new scanning capabilities behind a login.

Contributing

Contributions and pull requests are regularly reviewed and accepted on merit, not contingent on the commercial interest of any single company. If you want to contribute, the GitHub repository is the place to start.

Community and Support

Community-driven conversations happen through Opengrep's social channels, including X and Reddit. These are the places to ask questions, follow development, and connect with other users and contributors.

Quick Reference

Task Where to go
Install / run the CLI github.com/opengrep/opengrep
Contribute code github.com/opengrep/opengrep (pull requests)
Community discussion X, Reddit, and other social channels

Key Takeaways

  • Opengrep is a fully open-source SAST engine forked from Semgrep CE.
  • Start at github.com/opengrep/opengrep to install, run, or contribute.
  • It is backward compatible and supports JSON and SARIF outputs for easy integration.
  • It unlocks previously pro-only capabilities like cross-function and cross-file analysis, Windows support, and extended language support.
  • Pull requests are reviewed on merit, and the community gathers on X and Reddit.