Flags

Flags can be given before or after the targets. A flag that takes a value accepts it as --flag=VALUE or as --flag VALUE. Some flags also have a one-letter form, such as -q for --quiet.

Environment variables

Some flags can also be set with an environment variable. When both are given, the flag takes precedence, and Opengrep logs a warning that names the ignored variable.

Flags accepted for compatibility

The following flags are accepted for compatibility with existing scripts and CI configurations. They have no effect, and Opengrep logs a warning for each of them:

--allow-local-builds, --enable-version-check and --disable-version-check, accepted by opengrep scan and opengrep ci;
--test-ignore-todo and --no-test-ignore-todo, accepted by opengrep test.

Every command also accepts --experimental, which has no effect and logs no warning.

Index

Flag / Environment	Accepted by	Summary
`--allow-rule-timeout-control`	scan, ci	Let rules set their own time limits, which are otherwise ignored.
`--audit-on` `OPENGREP_AUDIT_ON`	ci	Report blocking findings but exit with status 0 when the CI event has one of these names.
`--autofix`	scan	Apply the fixes of the rules to the scanned files.
`--baseline-commit` `OPENGREP_BASELINE_COMMIT` `OPENGREP_BASELINE_REF`	scan, ci	Report only the findings that are not present in the given commit.
`--config` `OPENGREP_RULES`	scan, ci, test	Load rules from a file, a directory, a URL, a git repository or the registry.
`--dataflow-traces`	scan, ci	Show the path from source to sink in the findings of taint rules.
`--debug`	scan, ci, test, validate, show, lsp	Log the messages of --verbose and the diagnostics of the engine.
`--disable-intrafile`	scan, ci, test	Analyze every taint rule one function at a time, including rules that set taint_intrafile or taint_interfile.
`--dryrun`	scan	Show the fixes --autofix would make, without writing them to the files.
`--dynamic-timeout`	scan, ci	Scale the time limit of each rule with the size of the file.
`--dynamic-timeout-max-multiplier`	scan, ci	The largest factor by which --dynamic-timeout multiplies the timeout.
`--dynamic-timeout-unit-kb`	scan, ci	The file size, in KB, of one step of --dynamic-timeout.
`--emacs`	scan, ci	Print one line per finding, in the format of Emacs compilation buffers.
`--emacs-output`	scan, ci	Write the findings in the Emacs format to a file as well.
`--enable-interfile`	scan, ci, test	Run cross-file taint analysis for the rules that set the taint_interfile option.
`--enable-nosem`	scan, ci	Whether nosem comments suppress findings; on by default.
`--error`	scan	Exit with status 1 when there are findings.
`--exclude`	scan, ci	Skip files and directories whose path matches a gitignore-style pattern.
`--exclude-minified-files`	scan	Skip files that look minified.
`--exclude-rule`	scan, ci	Skip the rule with this id.
`--files-with-matches`	scan, ci	Print only the paths of the files that have findings.
`--force-color` `OPENGREP_FORCE_COLOR`	scan, ci, test, validate	Style the output even when it does not go to a terminal.
`--force-exclude`	scan, ci	Apply --include and --exclude to files named on the command line as well.
`--gitlab-sast`	scan, ci	Print the findings as a GitLab SAST report.
`--gitlab-sast-output`	scan, ci	Write the findings as a GitLab SAST report to a file as well.
`--gitlab-secrets`	scan, ci	Print the findings as a GitLab secret detection report.
`--gitlab-secrets-output`	scan, ci	Write the findings as a GitLab secret detection report to a file as well.
`--guarded-taint-signatures`	scan	Drop a cross-function taint finding when the condition leading to the sink cannot hold for the call.
`--html`	show	Print the output of opengrep show as an HTML page.
`--include`	scan, ci	Scan only the files whose path matches one of these patterns.
`--incremental-output`	scan	Print each finding as soon as it is found.
`--inline-metavariables`	scan, ci	Replace the metavariables in the metadata of a rule with the code they matched.
`--interfile-dedup-by`	scan, ci	Whether a sink reached by several sources across files produces one finding or one per source.
`--interfile-depth`	scan, ci, test	The longest call chain the cross-file taint analysis follows.
`--interfile-timeout`	scan, ci	The time a rule may spend on the cross-file taint analysis.
`--jobs`	scan, ci	The number of workers that run rules in parallel.
`--json`	scan, ci, test, show	Print the findings as a JSON document.
`--json-output`	scan, ci	Write the findings as JSON to a file as well.
`--junit-xml`	scan, ci	Print the findings as a JUnit XML report, one failed test per finding.
`--junit-xml-output`	scan, ci	Write the findings as a JUnit XML report to a file as well.
`--lang`	scan	The language of a pattern given on the command line.
`--matching-diagnosis`	test	Explain why a failing rule test did not match.
`--matching-explanations`	scan, ci	Add to the JSON output a record of how each part of a rule matched.
`--max-chars-per-line`	scan, ci	The width at which lines of code are wrapped in the text output.
`--max-lines-per-finding`	scan, ci	The number of lines of code shown for a finding in the text output.
`--max-log-list-entries`	scan, ci	The number of items above which a list in the logs is replaced by a note.
`--max-match-per-file`	scan, ci	The number of matches in a file, across all rules, above which all its findings are dropped.
`--max-memory`	scan, ci, test	The memory that the analysis of one file may use before it is abandoned.
`--max-target-bytes`	scan, ci	Skip files larger than this size.
`--no-progress-bar`	scan	Do not draw the status line that shows the progress of a scan.
`--opengrep-ignore-pattern`	scan, ci, test	An additional comment prefix that suppresses the findings on a line.
`--optimizations`	scan, ci	Turn the optimizations of the engine, such as the prefilter, on or off.
`--output`	scan, ci	Write the output to a file instead of standard output.
`--output-enclosing-context`	scan	Record the function or class that contains each finding.
`--pattern`	scan	Search with a pattern given on the command line instead of a rule file.
`--project-root`	scan	The project root, where .gitignore and .semgrepignore are read.
`--quiet`	scan, ci, test, validate, show, lsp	Print only the findings, and nothing on standard error.
`--replacement`	scan	The fix of a pattern given on the command line.
`--rewrite-rule-ids`	scan, ci	Whether the ids of rules from a subdirectory are prefixed with its path; on by default.
`--sarif`	scan, ci	Print the findings as a SARIF 2.1.0 document.
`--sarif-output`	scan, ci	Write the findings as SARIF to a file as well, including suppressed findings.
`--scan-unknown-extensions`	scan, ci	Scan a file named on the command line even when its extension belongs to no language.
`--semgrepignore-filename`	scan	Read the ignored paths from a file with a name other than .semgrepignore.
`--severity`	scan	Report only the findings of rules with these severities.
`--show-supported-languages`	scan	Print the supported languages and exit.
`--skin` `OPENGREP_SKIN`	scan, ci, validate	The layout of the text output.
`--skip-invalid-configs`	scan	Skip invalid rule files in a directory or a git repository instead of stopping.
`--strict`	scan, test	Fail the run when a file cannot be parsed or another warning-level error occurs.
`--subdir`	ci	Scan only this directory, with the CI metadata of the whole repository.
`--suppress-errors` `OPENGREP_SUPPRESS_ERRORS`	ci	Make opengrep ci exit with status 0 on errors; on by default.
`--taint-intrafile`	scan, ci, test	Follow taint through calls to functions in the same file, for every taint rule.
`--test`	scan	Run the rule tests instead of scanning, as opengrep test does.
`--text`	scan, ci	Print the text output, the default format.
`--text-output`	scan, ci	Write the text output to a file as well.
`--time`	scan, ci	Report the time the scan took, per rule and per file.
`--timeout` `OPENGREP_TIMEOUT`	scan, ci, test	The time limit of a rule on a file, in seconds; 0 sets no limit.
`--timeout-threshold`	scan, ci, test	The number of rules that may time out on a file before the file is skipped.
`--use-git-ignore`	scan, ci	Whether files ignored by git are skipped; on by default.
`--validate`	scan	Check the rules instead of scanning, as opengrep validate does.
`--verbose`	scan, ci, test, validate, show, lsp	Log the progress of the run, at the info level.
`--version`	scan	Print the Opengrep version and exit.
`--vim`	scan, ci	Print one line per finding, in the format of Vim quickfix lists.
`--vim-output`	scan, ci	Write the findings in the Vim quickfix format to a file as well.

Examples

Flag position and values

rule.yaml

rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING

app.py

eval(1)

Command and result

$ opengrep scan -q --config=rule.yaml app.py
app.py

  warn  find-eval
  found eval

     1: eval(1)
$ opengrep scan app.py -q --config rule.yaml
app.py

  warn  find-eval
  found eval

     1: eval(1)

A flag accepted for compatibility

Command and result

$ opengrep scan --config rule.yaml --disable-version-check app.py 2>&1 >/dev/null | grep warning
warning  --disable-version-check is not supported by opengrep and has no effect

Flags

## Environment variables

## Flags accepted for compatibility

## Index

## Examples

### Flag position and values