- Home
- Network Protocol Analyzers
- OpenGrep
OpenGrep
What it is
OpenGrep is a free, open-source static analysis engine for finding security issues and searching source-code patterns. It runs on Linux, macOS, and Windows, and the project invites developers and organizations to use and contribute to the engine. It supports more than 30 languages, including Python, Java, JavaScript, Go, Rust, PHP, and Visual Basic. Existing Semgrep rules and rulesets work without changes.
Its intrafile taint analysis tracks constructor and field assignments, flow between methods, higher-order functions across 12 languages, and collection methods such as map, filter, and reduce. OpenGrep can produce JSON and SARIF output and includes a CI subcommand for workflow use. The project distributes self-contained binaries and says releases are signed with Cosign. It is a Semgrep fork under the LGPL 2.1 license, and deployment is self-hosted. The security policy requests vulnerability reports by email and lists only the latest version as supported.
For and against
For
- Supports more than 30 programming languages.
- Existing Semgrep rules and rulesets work unchanged.
- Provides JSON and SARIF output plus a CI subcommand.
- Runs on Linux, macOS, and Windows.
Against
- Deployment is self-hosted.
- Security policy supports only the latest version.
The verdict
OpenGrep combines broad language support with Semgrep rule compatibility and workflow-oriented outputs. Its security policy lists only the latest version as supported, so version currency matters.
Who it suits
OpenGrep suits developers and organizations looking for self-hosted source-code analysis across its supported languages. It may also fit teams using Semgrep rules or JSON and SARIF output in CI workflows.
Plans and prices
OpenGrep
Open-source static analysis engine; CLI
Read 3 Oct 2026 · opengrep.dev
On the record
- Analysis features
- Its intrafile taint analysis supports constructor and field assignment tracking, inter-method taint flow, higher-order functions across 12 languages, and collection methods such as map, filter, and reduce.github.com · read 3 Oct 2026
- Build requirements
- Developer builds require OCaml 5.5.0, dune, opam, a C toolchain, PCRE and GMP libraries, make and git.github.com · read 15 Oct 2026
- Changelog: 1.28.0
- The 26 August 2026 release improved install scripts, fixed Windows output handling, updated constant propagation and added PHP fixes.github.com · read 15 Oct 2026
- Changelog: 1.29.0
- The 28 August 2026 release migrated remaining PCRE1 uses to PCRE2 and fixed Kotlin scope-function taint desugaring.github.com · read 15 Oct 2026
- Company size
- LinkedIn lists Opengrep as a nonprofit software-development organization with company size of one employee.linkedin.com · read 15 Oct 2026
- Consortium
- The project says Aikido Security, Amplify, Endor Labs, Kodem, Orca Security and other application-security organizations support it.opengrep.dev · read 15 Oct 2026
- Developer API
- The docs.rs package documents a Rust Config and SearchEngine API with parallel searches, JSON serialization and optional AI analysis.docs.rs · read 15 Oct 2026
- Directory API listing
- VentureGaps lists a REST API and nine integrations, including GitHub, GitLab CI/CD, CircleCI, Jira, Bitbucket, Jenkins, Slack and GitHub Actions.venturegaps.com · read 15 Oct 2026
- Distribution
- Releases are self-contained OCaml binaries for multiple architectures, so Python is not required.github.com · read 15 Oct 2026
- Documentation
- The repository links a wiki with tutorials and language guides, including intrafile tainting, higher-order functions, C#, PHP and Visual Basic.github.com · read 15 Oct 2026
- Free availability
- The project says consortium members build the engine for free use and intend to keep it free and open-source.opengrep.dev · read 15 Oct 2026
- Governance
- The project says contributions are reviewed on merit and is backed by an application-security consortium that includes Aikido Security, Amplify, Endor Labs, Kodem, and Orca Security.opengrep.dev · read 3 Oct 2026
- Independent context
- Latio Pulse describes Opengrep as a forever-open-source alternative sponsored by more than ten security vendors and says Semgrep's SaaS management features were lacking in the author's experience.pulse.latio.tech · read 15 Oct 2026
- Independent criticism
- Crash Override argues that the consortium had made few significant contributions to Semgrep and characterizes the fork as self-serving.crashoverride.com · read 15 Oct 2026
- Installation
- The official installer supports Linux and macOS through install.sh and Windows through PowerShell install.ps1.github.com · read 15 Oct 2026
- Integration: Aptori
- Aptori runs OpenGrep through its aptori/scanners container and publishes results to the Aptori Platform.docs.aptori.dev · read 15 Oct 2026
- Integration: Deckhouse
- Deckhouse Code runs opengrep_sast_scan and opengrep_sast_junit jobs, publishes JSON and JUnit results, and can forward findings to DefectDojo.deckhouse.io · read 15 Oct 2026
- Integration: Docker
- A community Docker Hub image documents scans through Docker, GitHub Actions, GitLab CI and Docker Compose with JSON or SARIF output.hub.docker.com · read 15 Oct 2026
