OpenGrep
OpenGrep is an open-source static analysis engine for searching source code patterns and identifying security issues.
What OpenGrep is
OpenGrep is an open-source static analysis engine for searching source code patterns and identifying security issues. It runs on Linux, macOS, and Windows and is aimed at developers and organizations analyzing code in their own environment. The project supports more than 30 programming languages, including Python, Java, JavaScript, Go, Rust, PHP, and Visual Basic. Existing Semgrep rules and rulesets work without changes. Its intrafile taint analysis tracks constructor and field assignments, flow between methods, higher-order functions across 12 languages, and collection operations such as map, filter, and reduce. OpenGrep produces JSON and SARIF output and includes a CI subcommand for workflow use. The project distributes self-contained binaries and says its releases are signed with Cosign. It is a fork of Semgrep under the LGPL 2.1 license. The free plan is free, and deployment is self-hosted. Its security policy asks for vulnerability reports by email and lists only the latest version as supported.
Good
- Supports 30+ programming languages.
- Existing Semgrep rules and rulesets work unchanged.
- Produces JSON and SARIF output.
- Includes a CI subcommand.
- Self-contained binaries are available for Linux, macOS, and Windows.
Watch out
- Deployment is self-hosted.
- The security policy supports only the latest version.
Who it suits
OpenGrep suits developers and organizations looking for a free static analysis engine they can run in their own environment. Existing Semgrep rule users can apply those rules without changes.
Verdict
OpenGrep offers broad language coverage, Semgrep rule compatibility, and output formats suited to development workflows. Its self-hosted deployment and latest-version-only support policy are worth weighing before adoption.
Plans and prices
From OpenGrep's own pricing page, checked 3 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| OpenGrep | Free | Open-source static analysis engine; CLI |
The facts
Each one read from OpenGrep's own pages, with the date it was checked.
What it does
- Analysis features
- Its intrafile taint analysis supports constructor and field assignment tracking, inter-method taint flow, higher-order functions across 12 languages, and collection methods such as map, filter, and reduce.checked 3 Oct 2026
- Build requirements
- Developer builds require OCaml 5.5.0, dune, opam, a C toolchain, PCRE and GMP libraries, make and git.checked 15 Oct 2026
- Changelog: 1.28.0
- The 26 August 2026 release improved install scripts, fixed Windows output handling, updated constant propagation and added PHP fixes.checked 15 Oct 2026
- Changelog: 1.29.0
- The 28 August 2026 release migrated remaining PCRE1 uses to PCRE2 and fixed Kotlin scope-function taint desugaring.checked 15 Oct 2026
- Consortium
- The project says Aikido Security, Amplify, Endor Labs, Kodem, Orca Security and other application-security organizations support it.checked 15 Oct 2026
- Developer API
- The docs.rs package documents a Rust Config and SearchEngine API with parallel searches, JSON serialization and optional AI analysis.checked 15 Oct 2026
- Directory API listing
- VentureGaps lists a REST API and nine integrations, including GitHub, GitLab CI/CD, CircleCI, Jira, Bitbucket, Jenkins, Slack and GitHub Actions.checked 15 Oct 2026
- Distribution
- Releases are self-contained OCaml binaries for multiple architectures, so Python is not required.checked 15 Oct 2026
- Documentation
- The repository links a wiki with tutorials and language guides, including intrafile tainting, higher-order functions, C#, PHP and Visual Basic.checked 15 Oct 2026
- Governance
- The project says contributions are reviewed on merit and is backed by an application-security consortium that includes Aikido Security, Amplify, Endor Labs, Kodem, and Orca Security.checked 3 Oct 2026
- Independent context
- Latio Pulse describes Opengrep as a forever-open-source alternative sponsored by more than ten security vendors and says Semgrep's SaaS management features were lacking in the author's experience.checked 15 Oct 2026
- Independent criticism
- Crash Override argues that the consortium had made few significant contributions to Semgrep and characterizes the fork as self-serving.checked 15 Oct 2026
- Installation
- The official installer supports Linux and macOS through install.sh and Windows through PowerShell install.ps1.checked 15 Oct 2026
- Integration: Aptori
- Aptori runs OpenGrep through its aptori/scanners container and publishes results to the Aptori Platform.checked 15 Oct 2026
- Integration: Deckhouse
- Deckhouse Code runs opengrep_sast_scan and opengrep_sast_junit jobs, publishes JSON and JUnit results, and can forward findings to DefectDojo.checked 15 Oct 2026
- Integration: Docker
- A community Docker Hub image documents scans through Docker, GitHub Actions, GitLab CI and Docker Compose with JSON or SARIF output.checked 15 Oct 2026
- Integrations
- The repository documents a CI subcommand, and its output formats include JSON and SARIF.checked 3 Oct 2026
- Intended users
- The project invites developers and organizations to use and contribute to its open static analysis engine.checked 3 Oct 2026
- Intrafile taint
- The engine adds intrafile cross-function taint analysis with higher-order-function support.checked 15 Oct 2026
- Language coverage
- The README lists more than 30 languages, including Apex, Bash, C, C++, C#, Go, Java, JavaScript, PHP, Python, Ruby, Rust, Swift, Terraform, TypeScript, Visual Basic, XML and YAML.checked 15 Oct 2026
- Language support
- The project says it supports 30+ languages, including Python, Java, JavaScript, Go, Rust, PHP, and Visual Basic.checked 3 Oct 2026
- Licence
- The repository identifies the software as licensed under LGPL-2.1.checked 15 Oct 2026
The company
- Company size
- LinkedIn lists Opengrep as a nonprofit software-development organization with company size of one employee.checked 15 Oct 2026
Money
- Free availability
- The project says consortium members build the engine for free use and intend to keep it free and open-source.checked 15 Oct 2026
Alternatives to OpenGrep
- 1
Semgrep Code
Free planOpen sourceWebAPIExtensionLinux8.3From $15 a month - 2
GitHub CodeQL
Free planWebExtensionLinuxmacOS7.5From $30 a month - 3
Bandit
Free planOpen sourceExtensionLinuxmacOSSelf-hosted7.2Free plan - 4
gosec
Free planOpen sourceAPILinuxmacOSSelf-hosted7.2Free plan - 5
Skylos
Free planWebAPIExtensionLinux7.0Free plan - 6
Puma Scan
Free planLinuxmacOSSelf-hostedWindows6.8From $299 a year