// Guard secrets & permissions
semgrepv1.180.0
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
Open source Maintained For agents
IN ONE PARAGRAPH
semgrep is lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
Good for: Developers who want their agent (Claude Code, Codex, Cursor…) to guard secrets & permissions.
01How to start
- 1Read the official README for requirements and permissions.
- 2Install it from the official package registry:
pip install semgrep - 3Add it to your agent’s MCP config — Claude Code:
claude mcp add; Cursor:.cursor/mcp.json; Codex:~/.codex/config.toml.
02Alternatives & comparison
Compare side by side → trivy Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more ★ 38k vault A tool for secrets management, encryption as a service, and privileged access management ★ 36k infisical Infisical is the open-source platform for secrets, certificates, and privileged access management. ★ 30k grype A vulnerability scanner for container images and filesystems ★ 13k syft CLI tool and library for generating a Software Bill of Materials from container images and filesystems ★ 9.6k
03Related
- ›BlueDot Impact AI Alignment 课程 · BlueDot ImpactEnglish
- ›BlueDot Impact AI Governance 课程 · BlueDot ImpactEnglish
- ›AI Safety, Ethics and Society 教材 · Center for AI Safety / Dan HendrycksEnglish
- ›OWASP Top 10 for LLM Applications · OWASP GenAI Security ProjectMultilingual (incl. EN/ZH)
- ›MITRE ATLAS · MITREEnglish
- All tutorials →