What people actually say about Semgrep
46 mentions across 6 sources · 69% positive · researched Oct 8, 2026
Hacker News, YouTube, Product Hunt, Stack Overflow, GitHub, Lemmy
What users praise
- • Open-source core with 16.9k stars gives engineers an auditable analysis engine, not a black box.
- • Custom pattern rules that look like the source code itself make tailored checks practical.
- • Free tier covers 10 repos and 10 contributors, generous enough for early-stage teams.
What frustrates them
- • False positives remain a recurring complaint in Stack Overflow and community threads through 2025.
- • A single PR can add a finding and its suppression, weakening the merge gate.
- • Guarding against novel threats like malicious MCP services still isn't built in.
This is a summary. The full report adds every quote we found, a per-source breakdown, recurring themes, hidden costs and the learning curve — run a free scan below, or see the full Semgrep review.
What comes up again and again about Semgrep
Recurring themes across everything we collected, with where each one showed up.
Semgrep is the trusted, open-source baseline SAST engine that engineers can extend with custom rules
praised · seen on Hacker News, GitHub, Stack Overflow
False positives and alert noise remain the enduring complaint against SAST, Semgrep included
criticised · seen on Stack Overflow, Lemmy, GitHub
Community is building on top of Semgrep for AI-era threats like MCP servers and vibe-coded code
praised · seen on Hacker News, GitHub
The AI-assisted security tooling space is getting crowded — comparing Semgrep, Qina Clarity, VibeGuard, and LLM-based scanners is now its own conversation
mixed · seen on Hacker News, Stack Overflow, Lemmy
Salt-of-the-earth worries about security gates being bypassable within a single PR
criticised · seen on GitHub
Semgrep's commercial pitch is shifting toward AI-generated code security and agentic workflows
praised · seen on Hacker News, Product Hunt, YouTube
How hard is Semgrep to learn?
Users describe it as intermediate · typically A few hours to get going
Where people get stuck
- • Writing useful custom rules requires picking up Semgrep's pattern syntax, which looks easy but has sharp edges
- • Setting up triage workflows and noise filtering takes iteration before the signal-to-noise ratio improves
- • Configuring Semgrep as an org-wide gate across multiple repos requires planning around suppression policy
- • Multimodal AI detection features and MCP server integration have newer surfaces that lack mature docs
Who Semgrep actually suits
Works well for
- • Security engineers who want to write and own custom static analysis rules
- • Platform teams standardizing SAST/SCA/secrets across GitHub, GitLab, Bitbucket or Azure DevOps
- • Startups that need real SAST coverage on a free or $30/contributor budget
- • Teams shipping AI-generated code that need a guardrail in Cursor, Replit, or CI
- • AppSec teams drowning in noise and willing to invest in triage-learning setup
Not the right fit for
- • Teams wanting a fully managed, zero-configuration scanner with no rules to maintain
- • Buyers looking for a pure LLM-based security reviewer with no static analysis learning curve
- • Small non-engineering teams expecting turnkey security coverage with no security staff
- • Organizations that can't review suppression changes separately from feature PRs
- • Windows-only shops that can't host a CLI-based scanner in their CI
What people are discussing right now
Discussion volume is medium and trending up
- Custom rule authoring and third-party rulesets (notably MCP server auditing)
- AI-assisted code security and comparisons against LLM-based scanners
- Reachability analysis and false-positive reduction
- Challenges of using Semgrep as a merge-blocking security gate
- Integration with Cursor, Replit, VS Code and JetBrains environments
What people really think about Semgrep
A real-time sweep of the open web — social media, forums, review sites, video reviews and live community discussions — distilled into one honest verdict with the actual mentions behind it.
What's inside your Semgrep report
Everything you need to decide — distilled from real, current user opinion.
Live mentions
The actual posts, reviews & complaints about Semgrep — with links and dates.
Honest verdict
A straight answer on whether it lives up to the hype — and who it’s really for.
Praise & gripes
What users genuinely love and the frustrations that keep coming up.
Real quotes
Representative voices from real users, not marketing copy.
Recurring themes
The patterns across hundreds of opinions, surfaced at a glance.
Red flags
Hidden costs and dealbreakers people only discover after signing up.
How it works
Sign up free
Create an account in seconds — get 5 free scans, no card.
We sweep the web
Live social media, forums, reviews & video opinions — in ~30–60s.
Get your report
An honest, downloadable verdict with the real mentions behind it.
Ready to see the real verdict on Semgrep?
Your scan is ready in under a minute · $1.
Top alternatives to Semgrep
Researching options? Explore the closest alternatives.
Checkmarx
Enterprise AppSec platform that scans AI-generated code across source, dependencies, containers and AI assets, with hybrid Checkmarx Fusion detection and
Apiiro
Apiiro is an agentic AppSec platform that maps code-to-runtime risk and fixes it with AI AutoFix agents.
Hex Security
AI-native container security and runtime threat detection for Kubernetes workloads
Deepsource
AI code review platform that combines 5,000+ static analysis rules with an AI review agent on every pull request.
Ida Pro Mcp
MIT-licensed MCP server for AI-assisted reverse engineering that bridges IDA Pro's database to Claude Code, Cursor and other LLM clients
Skylos
Skylos is an open-source CLI and PR check that catches dead code, secrets, and AI agent shortcuts before they merge.
Check sentiment on these too
Run a live scan on the alternatives before you decide.
Semgrep — questions buyers ask
What do people complain about most with Semgrep?
The complaints that recur most often are false positives remain a recurring complaint in Stack Overflow and community threads through 2025, a single PR can add a finding and its suppression, weakening the merge gate and guarding against novel threats like malicious MCP services still isn't built in. Drawn from 46 mentions across 6 sources.
What do users like about Semgrep?
Users consistently praise open-source core with 16.9k stars gives engineers an auditable analysis engine, not a black box, custom pattern rules that look like the source code itself make tailored checks practical and free tier covers 10 repos and 10 contributors, generous enough for early-stage teams.
Is Semgrep hard to learn?
Users describe it as intermediate; most people are up and running in a few hours; the usual sticking points are writing useful custom rules requires picking up Semgrep's pattern syntax, which looks easy but has sharp edges and setting up triage workflows and noise filtering takes iteration before the signal-to-noise ratio improves.
Who should not use Semgrep?
Based on what users report, it is a poor fit for teams wanting a fully managed, zero-configuration scanner with no rules to maintain, buyers looking for a pure LLM-based security reviewer with no static analysis learning curve and small non-engineering teams expecting turnkey security coverage with no security staff.
What are people saying about Semgrep right now?
Discussion volume is medium and trending up. Current topics: custom rule authoring and third-party rulesets (notably MCP server auditing), AI-assisted code security and comparisons against LLM-based scanners and reachability analysis and false-positive reduction.
How current is this report?
Each scan runs live the moment you click — it reflects what people are saying now, and every report lists the dated mentions behind it.
Can I download it?
Yes — download the full report as a polished, shareable PDF.