Semgrep Python Packages

semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

libsast

Generic SAST Library

semgrep-mcp

A MCP server for using Semgrep to scan code for security vulnerabilities.

mcpwatchman

Independent security and quality audit for Model Context Protocol servers — static analysis, dependency CVE scanning, and evidence-linked scores for every server in the official MCP registry.

bugcorpus

Compiler from historical bugs into permanent deterministic detectors

foxguard

A fast universal code security scanner, written in Rust. Batteries included: supports 14 languages, TUI for triage, secrets, post-quantum audits, diff-aware scans and more 𓃥

praetor-security

Multi-engine static security analysis for code, repos, and AI agents: SAST, secrets, SCA, AI-security, and serialized-model/pickle scanning. Reports attack CHAINS and an agent capability profile. Reads, never runs. AGPL-3.0.

devsecops-radar

🛡️ Unify Trivy, Semgrep, Poutine & Zizmor scans into one AI-enhanced, offline-ready dashboard. Track CI/CD security trends, get LLM-powered analysis, and enforce policies — the open-source DevSecOps command center.

audit-packs

An evidence-first Compliance Intelligence Engine that transforms security scanner findings into standardized, evidence-backed compliance artifacts.

vulngate

Agent-neutral security checks before you ship — SAST, secrets, and dependency audit as a merge gate. Find, understand, and fix vulnerabilities in AI- or human-written code. BYO-inference, $0, MIT.

sechelix

Most AI security tools try to find more. SecHelix tries to prove itself wrong: every candidate finding goes to an independent verifier whose only job is to disprove it. Open-source AppSec agent for Claude Code, Codex and Copilot.

simplesecurity

Combine multiple popular python security tools and generate reports or output into different formats

redteam-mcp

Active red-teaming for MCP servers. Source analysis + live exploitation + auto-fix. Claude Code plugin.

gateshield

Policy-driven security orchestration for hardened CI/CD pipelines

semgrep-rules-manager

Manager of 14 third-party sources comprising approximately 4,000 Semgrep rules 🗂

crossfire-rules

Regex rule overlap analyzer for DLP, secret scanning, SAST, and IDS tools

securescan

Security scanning without the SaaS tax. Multi-scanner orchestration, baseline diffing, SBOM + SARIF, signed everything — runs in your terminal, your CI, or a dashboard you own.

constraints-registry

MCP server giving AI coding agents (Claude Code, Cursor, Codex) a queryable source of engineering constraints — policy-as-code guardrails for AI-generated code, backed by OPA, Conftest, Checkov & Semgrep.

semhound

Scan every repository across your GitHub organisations using Semgrep rules, with optional AI triage (Claude · Gemini · GPT · Bedrock)

vulnhawk

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PHP, Ruby.

velonus

AI-native application security scanner for developers — finds real issues, explains why they matter, and generates fixes. Fully self-contained: velonus scan never sends your code anywhere.

authdrift

Find OAuth handlers that will break when users rename their Gmail.

sgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

osemgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.