the most advanced open source SAST engine

• 30+ languages

  From C, Java and Python to Apex, Elixir and Visual Basic, plus generic matching for templates like Jinja and ERB.

• cross-function & cross-file analysis

  Taint tracking follows data through functions, methods and fields, including higher-order functions and calls into the language's standard library.

• superior performance

  Pure OCaml 5 with multicore parallelism for maximal performance. Shipped as self-contained binaries for Linux, macOS and Windows.

## install

# installs the latest release into ~/.opengrep
$ curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash

# run in PowerShell
PS> irm https://raw.githubusercontent.com/opengrep/opengrep/main/install.ps1 | iex

# 1. grab the binary for your platform from the releases page
#    opengrep_osx_arm64, opengrep_manylinux_x86, opengrep_windows_x86.exe, …
# 2. make it executable and put it on your PATH
$ sudo install -m 755 opengrep_osx_arm64 /usr/local/bin/opengrep
$ opengrep --version

## source

Read the code, open an issue, send a PR.

Opengrep is backed by a consortium of application security companies. Each contributes funding or OCaml engineers to a full-time team building the engine, free and open for everyone.

• aikido security
• amplify
• endor labs
• kodem
• orca security
• + others

Opengrep was created as a fork of Semgrep CE when Semgrep moved critical features behind a commercial license. Opengrep is available under the LGPL 2.1 license.

## social channels

We encourage community driven conversations via X, Reddit or GitHub.