Semgrep

Semgrep pairs fast, customizable static analysis with an AI triage layer that filters false positives and explains findings in context, delivering AI-assisted security code review inside pull requests and CI/CD.

Semgrep (from the company formerly known as r2c) is a static application security testing (SAST) and code review platform built around a fast, pattern-based analysis engine that developers can extend with custom rules written in a simple, code-like syntax. It scans code for security vulnerabilities, secrets, supply-chain risks, and quality issues, and integrates directly into pull requests and CI/CD pipelines. The platform's AI layer, historically branded Semgrep Assistant and rebranded to Multimodal in March 2026, adds automated triage and context-aware explanations. The AI engine classifies each finding as a true or false positive and reportedly handles a large majority of triage work for customers, filtering noise before it reaches security engineers and connecting each rule to the specific code that triggered it. This positions Semgrep as an AI-assisted code review tool rather than just a raw scanner. Semgrep offers a free edition covering a limited number of contributors and repositories, a Team plan priced per contributor that unlocks cross-file analysis, Supply Chain reachability, Secrets, Pro rules, and the AI assistant, and an Enterprise tier quoted on request. Its open-source roots and strong developer ergonomics have made it a popular choice for security-conscious engineering teams that want to shift security review left.