semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

No known security advisories. The current version has no OSV.dev malware reports and no critical or high-severity vulnerabilities.

semgrep has 36.8M monthly downloads and 16K GitHub stars. Version 1.168.0 supports Python 3.10+, first published in 2020.

It is actively maintained under a copyleft license, last released in Jun 2026.

It is built on top of attrs, boltons and click. It is used by 68 tracked packages, including codeshield, njsscan and mobsfscan.

GitHub topics include static-analysis, static-code-analysis and java.

Provenance Mismatch

This package's publish attestation (PEP 740) proves it builds from semgrep/semgrep-proprietary, not the linked semgrep/semgrep. Stars and other GitHub metrics shown here come from the claimed repository.

Shared Repository

This package shares its GitHub repository (semgrep/semgrep) with 1 other package. Stars, forks, and other GitHub metrics reflect the entire repository.

tg-engine (1.1K)

Downloads

Day

1.0M

Week

7.6M

Month

36.8M

Stars

15.8K

Forks

Issues

Version

Package Insights

click for breakdown

Actively Maintained

click for breakdown

Industry Standard

click for breakdown

click for breakdown

Score breakdown - each component scores 0-100, weighted by percentage

Maintenance

100

Popularity

88

Adoption

60

Community

70

Provenance

0

How the maintenance status was determined

Last commit

5 days ago

Monthly downloads

36,774,225

• Active

Activity within 30 days

Stable

Activity within 31-180 days

Minimal

Activity within 181-365 days, or no activity data

At Risk

No activity for > 365 days, but > 10,000 monthly downloads

Archived

Repository flagged as archived on GitHub

How the popularity category was determined

Monthly downloads

36,774,225

Stars

15,768

Stars per 1k downloads

0.43

• Industry Standard

> 10,000,000 monthly downloads

Hidden Gem

< 0.5 stars per 1k downloads and > 100,000 monthly downloads

Community Favorite

> 5 stars per 1k downloads

Rising Star

Balanced ratio of stars to downloads

Unknown

Fewer than 1,000 monthly downloads, or no star data

How download momentum is calculated

Week daily avg

1,092,069

Month daily avg

1,225,808

Momentum

-10.9%

((week_daily_avg - month_daily_avg) / month_daily_avg) * 100

click for breakdown

click for breakdown

Release Cadence

click for breakdown

Contributor Risk

click for breakdown

Python version support tiers

requires_python

>=3.10

Cutting Edge

Minimum supported version is 3.12 or newer

• Modern

Minimum supported version is 3.9, 3.10, or 3.11

Legacy

Supports 3.8 or older (or Python 2)

Unknown

No requires_python specified or unparseable

License categories

License

LGPL-2.1-or-later

Permissive

MIT, Apache, BSD, ISC, Unlicense, CC0, etc.

• Copyleft

GPL, LGPL, AGPL, MPL, EPL, etc.

Proprietary

Commercial, all rights reserved, custom EULAs

Unknown

No license specified, or none of the above match

How the release cadence was determined

Last release

12 days ago

Total releases

346

Releases/year

56.1

• Rapid

Last release within 365 days and > 12 releases/year

Regular

Last release within 365 days

Slow

Last release 366-730 days ago

Stalled

Last release > 730 days ago, or no releases

Unknown

No usable release date available

How contributor risk was determined

Contributors

210

Monthly downloads

36,774,225

High Load

≤ 2 contributors and ≥ 50,000 monthly downloads

Moderate Load

< 10 contributors and ≥ 500,000 monthly downloads

Low Load

< 25 contributors and ≥ 5,000,000 monthly downloads, or sole maintainer with ≥ 10,000 monthly downloads

• Balanced

Enough contributors for the package's popularity

Unknown

No contributor data available

Engagement

66

Issue Burden

53.6

per 1k stars

Discussions

0.1

per 1k stars

Fork Ratio

21.3%

contrib / forks

Stale Release

No

PR Velocity

Quiet

Weekly Downloads

Last 7 days

7,644,484

Last 30 days

36,821,634

Peak day (2026-03-26)

2,297,178

2026-03-26 – 2026-07-03. Enable JavaScript for the interactive chart.

GitHub Stars

Current

15,768

Earliest (2026-01-14)

13,832

Change

+1,936

2026-01-14 – 2026-07-05. Enable JavaScript for the interactive chart.

Not all downloads include detailed metadata. Breakdowns reflect the subset that does.

Downloads by OS

Linux 687.3K

Windows 5.8K

macOS 4.8K

Python Versions

3.12

40.7% 278.3K

3.10

26.6% 181.8K

3.11

14.0% 95.5K

3.13

13.7% 93.7K

3.14

5.1% 34.6K

Top Countries

1.

US

644.5K

2.

NL

13.6K

3.

DE

4.8K

4.

IE

4.7K

5.

CH

3.3K

6.

IN

3.0K

7.

GB

2.7K

8.

FR

1.9K

9.

SG

1.8K

10.

SA

1.8K

Dependencies

27

attrs >=21.3
boltons ~=21.0
click ~=8.1.8
click-option-group ~=0.5
colorama ~=0.4.0
exceptiongroup ~=1.2.0
glom >=23.3
jsonschema ~=4.25.1
mcp ==1.23.3
opentelemetry-api ~=1.37.0
opentelemetry-exporter-otlp-proto-http ~=1.37.0
opentelemetry-instrumentation-requests ~=0.58b0
opentelemetry-instrumentation-threading ~=0.58b0
opentelemetry-sdk ~=1.37.0
packaging >=21.0
peewee ~=3.14
pyjwt ~=2.13.0
pywin32 ==311
requests ~=2.22
rich >=13.5.2
ruamel-yaml >=0.18.15
ruamel-yaml-clib ==0.2.15
semantic-version ~=2.10.0
tomli ~=2.4.0
typing-extensions ~=4.2
urllib3 ~=2.0
wcmatch ~=8.3

Used By

68

View all 68 dependents

GitHub Topics

Tags from the package's GitHub repository describing what it does.

Static Analysis Static Code Analysis Java Go Sast Semgrep R2c C Python Ruby Javascript Typescript

Package Information

License

LGPL-2.1-or-later

First Release

May 6, 2020

Last Release

1 week ago

Last Commit

6 days ago

Latest Version

1.168.0

Total Releases

346

Contributors

210

Open PRs

32

Archived

No

Python Versions

3.10 3.11 3.12 3.13 3.14

Wheels

cp310 cp311 cp312 cp313 cp314 cp36 cp37 cp38 cp39 py310 py311 py312 py313 py314 py36 py37 py38 py39

Tracking Since

January 6, 2026

Data Updated

July 5, 2026

Data Freshness

Fresh

Links

semgrep/semgrep