Semgrep

What it is for

Semgrep is an AppSec scan desk: you run SAST on a repo, add SCA or secrets if you want, and you can start Free at $0/contributor/month (Code + Supply Chain, 10 repos, 10 contributors). Use it when the job is findings you start at $0, not when you need a $20 chat seat.

What makes it unique: the cover is the official Semgrep rule Playground (python-no-prints-in-prod, test code, Open in Playground) from the GitHub rules-editor still — not a pricing card. The Playground itself is ops of Code.

Key features

• Code (SAST) — a scan of your source (Playground still; pricing Code). One finding. Rules, Pro rules, and the cover Playground are ops of this. CI is install. Free is $0/contributor. Teams Code is $30/contributor/month.
• Supply Chain (SCA) — a scan of dependencies and malware (pricing Supply Chain). A package, not a line in your file. Free is $0/contributor. Teams is $30/contributor/month.
• Secrets — a scan for hardcoded credentials (pricing Secrets). A leak, not a SAST rule. Teams Secrets is $15/contributor/month. Not on the Free card we fetched.
• Workflows — an automation graph that runs those scans (Introducing Semgrep Workflows). A pipeline, not a finding. Do not count it as another Code scan.
• OSS engine — the Semgrep CLI you run locally; Cloud is the hosted desk (GitHub; pricing Free). A deploy, not a rule. The engine is $0.

Contributors are the Cloud meter (Free max 10; Teams prices per contributor). AI credits on Teams (20/developer/month) are SKU, not a sixth surface. Guardian (AI-generated-code scan) is Code on a different input — do not count it.

Who it's for

Best fit: AppSec / eng teams who will stay on Free $0 (10 repos, 10 contributors, Code + Supply Chain, GitHub/GitLab auth) while they scan a first repo, then buy Teams Code at $30/contributor/month when they need Pro rules, SSO, and 20 AI credits — and add Secrets at $15 only when they want a leak scan.

Pricing

Verified 2026-10-22 (Asia/Shanghai) from semgrep.dev/pricing. Cloud is per contributor / month. Products are sold separately on Teams.

• Free — $0/month/contributor. Scan up to 10 repositories. Maximum 10 contributors. GitHub/GitLab auth. Includes Code ($0) and Supply Chain ($0). Community support.
• Teams — starting at $30/month per contributor. Cross-file analysis with Pro rules. AI-powered detection / triage / remediation. 20 AI credits per developer / month. One-click CI/CD. SSO. Award-winning support. Choose: Code $30/contributor/month; Supply Chain $30/contributor/month; Secrets $15/contributor/month.
• Enterprise — custom. Same AppSec platform as Teams plus white-glove onboarding, dedicated support, roadmap access. Confirm the live quote — do not invent an Enterprise dollar.

Confirm checkout; taxes follow your location.

Limitations / costs

• Free is 10 repos and 10 contributors. The 11th contributor is Teams, not a second Free bucket.
• $30 is per product per contributor. Code + Supply Chain + Secrets on one person is $75/month, not $30.
• A scan desk, not an uptime probe. For Playwright checks see Checkly. For traces/logs see SigNoz.

Alternatives

• Checkly — synthetic Playwright checks when you are not scanning source.
• SigNoz — OpenTelemetry APM when the job is traces, not SAST findings.
• Unleash — feature flags when you will gate a release, not scan it.

Official tutorial

Official semgrep channel video: Introducing Semgrep Workflows: a platform for building automated code security pipelines (oEmbed author: semgrep). First-party workflow walkthrough; the GitHub rule Playground still is the cover.

Written path: semgrep.dev/pricing plus the rules-editor still.

Website

https://semgrep.dev

Repository

https://github.com/semgrep/semgrep

Source

Catalog row curated for AI Tools Nav. Cover is the official Semgrep rule Playground from the project still. Dollars checked on semgrep.dev/pricing (Free $0 / 10 contributors; Teams Code $30/contributor; Supply Chain $30; Secrets $15). Tutorial oEmbed author: semgrep.

Last verified

2026-10-22 (Asia/Shanghai) editorial check.