Is Opengrep Free and Open-Source, and Who Maintains It?

Updated

Yes. Opengrep is free and open-source, and it is maintained by a consortium of application security organizations rather than a single vendor. The project's stated mission is to build the most advanced static analysis engine as fully open-source software, and its backers have committed to keeping it that way.

Who maintains Opengrep

Opengrep is supported by a group of organizations in the application security space, including:

  • Aikido Security
  • Amplify
  • Endor Labs
  • Kodem
  • Orca Security
  • and others

These organizations have united behind the project and contribute resources or OCaml development power. A full-time developer team builds the Opengrep engine, and the parties remain committed to keeping Opengrep free and open-source for the whole community.

What "free and open-source" means here

According to the project, the commitment is not just about licensing but about where capabilities live:

  • Essential metadata and new scanning capabilities are not hidden behind a login.
  • Future improvements and features won't be locked into specific vendors.
  • Contributions and pull requests are reviewed and accepted on merit, not contingent on any single company's commercial interest.

Why Opengrep exists

Opengrep is a fork of Semgrep CE (formerly Semgrep OSS). The project cites recent changes by Semgrep that affect its open-source nature, specifically removing critical features of the scanning engine behind a commercial license. The removed features reportedly include language support, tracking ignores, fingerprint, and meta-variables, among others. Opengrep was launched in response, with the goal of commoditizing and advancing Static Application Security Testing (SAST).

What users get

For users, Opengrep means:

  • A more capable scanning engine that doesn't hide essential metadata behind a login.
  • Backward compatibility with common JSON and SARIF outputs, so it can be adopted into existing workflows.
  • Previously pro-only capabilities, including inter-procedural (cross-function) analysis, cross-file analysis, Windows support, and extended language support.

How to get started

The project points to its GitHub repository for installing, running, or contributing to the Opengrep CLI: github.com/opengrep/opengrep. Community discussion is encouraged via X, Reddit, and other social channels.

If your concern is vendor lock-in or features moving behind a paywall, Opengrep's structure—a multi-company consortium with a full-time team and an explicit open-source commitment—is the core reason to consider it.