opengrep lsp
- See also
opengrep scan,HOME
opengrep lsp [FLAGS]Starts a Language Server Protocol server that scans the files open in an editor and reports the findings as diagnostics. The command is meant to be started by an editor. It reads JSON-RPC messages with Content-Length framing on standard input and writes its responses to standard output; there is no other transport.
Settings
The rules and the scan settings come from the client, in the scan object of the initializationOptions of the initialize request:
{
"scan": {
"configuration": ["/path/to/rules.yaml"],
"exclude": ["tests/"],
"onlyGitDirty": false,
"taintIntrafile": true
}
}| Setting | Equivalent flag | Default | Meaning |
|---|---|---|---|
configuration | --config | none | The rules, as a list of files, directories or other configuration sources. |
include | --include | none | Scan only the files that match one of these patterns. |
exclude | --exclude | none | Skip the files that match one of these patterns. |
onlyGitDirty | true | In a git repository, report only the findings on lines that differ from the last commit. | |
taintIntrafile | --taint-intrafile | false | Follow taint through calls to functions in the same file. |
maxTargetBytes | --max-target-bytes | 1000000 | Skip files larger than this many bytes. |
maxMatchPerFile | --max-match-per-file | 10000 | The number of matches in a file above which its findings are dropped. |
jobs | --jobs | the number of cores | The number of parallel workers. |
maxMemory | --max-memory | 0, no limit | The memory limit of a scan, in MiB. |
timeout | --timeout | 30 | The time limit of a rule on a file, in seconds. |
timeoutThreshold | --timeout-threshold | 3 | The number of timeouts after which a file is skipped. |
dynamicTimeout | --dynamic-timeout | false | Scale the timeout with the size of the file. |
dynamicTimeoutMaxMultiplier | --dynamic-timeout-max-multiplier | 20 | The largest factor by which the timeout is scaled. |
dynamicTimeoutUnitKb | --dynamic-timeout-unit-kb | 30 | The file size, in KB, of one step of the scaling. |
allowRuleTimeoutControl | --allow-rule-timeout-control | false | Let rules set their own time limits. |
The server scans each document that the editor opens.
Exit status
0 when the client ends the session, 2 on a fatal error, and 141 when the program that reads the output closed the pipe.
Flags
| Flag | Summary |
|---|---|
--debug | Log the messages of --verbose and the diagnostics of the engine. |
--develop | Listed in Internal and debugging interfaces. |
--profile | Listed in Internal and debugging interfaces. |
--quiet | Print only the findings, and nothing on standard error. |
--verbose | Log the progress of the run, at the info level. |
Examples
Starting the server
An editor starts the command and then communicates with it over standard input and output. When started from a shell, the server prints nothing: it waits for the initialize request of a client and answers on standard output.
$ opengrep lsp