Semgrep AppSec Platform

Semgrep, Inc. is a Delaware corporation whose terms are governed by California law; the pages fetched do not state a founding year. It sells a code security platform for developers and AI coding agents, combining static analysis, dependency scanning and secrets detection.

The platform includes Semgrep Code (SAST), Semgrep Supply Chain (SCA and a malware firewall), Semgrep Secrets, Semgrep Guardian for AI-generated code and Semgrep Multimodal, which mixes AI and rule-based analysis. It runs in the CLI, CI/CD, IDEs and pull requests. Customers shown include Lyft, Slack, Dropbox and GitLab.

• Semgrep Code: SAST with rule-based and AI-assisted analysis.
• Semgrep Supply Chain: SCA with malware blocking for dependencies.
• Semgrep Secrets: detection of leaked credentials in code.
• Semgrep Guardian: scanning of AI-generated code during agent workflows.
• Agentic workflows and MCP integrations for Cursor and Replit.
• Integrations with GitHub, GitLab, Bitbucket, Azure and Jira.

A Vietnamese startup using Cursor can add Semgrep checks to pull requests for AI-generated code. A bank's engineering group can use custom rules to enforce internal secure-coding standards in CI.

• A community edition and free trial let teams start without procurement.
• Combined SAST, SCA, secrets and malware checks in one platform.
• Runs in IDEs, CLI and pull requests, so findings reach developers where they work.
• Migration program for teams moving from Checkmarx or Snyk.

AI coding agents increase code volume and supply chain malware reports are growing, pushing teams to automate triage and add dependency controls. Southeast Asian engineering teams adopting Cursor and similar tools need scanning built into agent workflows.

Semgrep, Inc. is a Delaware corporation; terms are governed by California law. The About page cites a $100M Series D led by Menlo Ventures, with Sequoia, Redpoint and Felicis among investors (2025 per page links).