Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

OpenGrep

Free#9 of 25 in Static Application Security Testing SoftwareNetwork Protocol Analyzers

OpenGrep: A broad, scriptable SAST engine for teams comfortable managing scans themselves. Ranked #9 of 25 in Static Application Security Testing Software by our editors (7.8/10); pricing: Free plan; best for open-source teams needing broad rule-based scanning.

7.8/10Editor score
Visit OpenGrep
OpenGrep7.8 Visit OpenGrep

At a glance

  • Editor score
    7.8 / 10
  • Pricing
    Free plan
  • Best for
    Open-source teams needing broad rule-based scanning
  • Free plan
    Yes
  • Paid from
    Free
  • Analysis target
    Source
  • Facts checked
    22 Sep 2026
OpenGrep screenshot

  • Where it wins

    • Analyzes source across 30+ programming and configuration languages
    • Supports customizable rules, taint analysis, SARIF, and semantic matching
    • Runs locally with CI scanning and self-contained signed binaries

  • Where it doesn't

    • Self-hosted deployment requires teams to manage the scanning environment
    • Does not include software composition analysis
    • IDE integration coverage is limited

Our verdict on OpenGrep

OpenGrep is an open-source static application security testing engine and semantic code-search CLI for developers and organizations that want local, scriptable scanning. It analyzes source code with customizable rules and supports more than 30 programming and configuration languages. Teams can run it on Linux, macOS, Windows, or in a self-hosted environment, without relying on a hosted service. Its focus is source analysis rather than dependency analysis, making it a fit for code-centric security workflows.

Its strongest technical scope comes from the combination of semantic pattern matching, taint analysis, and customizable rules. Taint analysis includes intra-file cross-function analysis, while JSON and SARIF output support downstream reporting and CI workflows. The CI command is designed for repository scanning, and autofix support is available through incremental output postprocessing. Self-contained signed binaries also simplify distribution across supported desktop and server platforms. These capabilities make OpenGrep suitable for teams that want rule-driven checks they can script, inspect, and integrate into their own development processes.

The trade-off is operational ownership and narrower ecosystem coverage. Deployment is self-hosted, so teams must manage how scans run and how results fit into their pipelines. OpenGrep does not provide software composition analysis or AI features, and its IDE integration coverage is limited. Teams prioritizing broad language coverage, customizable analysis, and local control should consider it. Teams seeking dependency scanning, a hosted workflow, or deeper verified IDE coverage should look for a different SAST product.

Your product? Our editors can test OpenGrep in depth and publish a review, labelled as paid · from $149/mo →

OpenGrep pricing

Plans Free planFree Free to use — no paid tier required for the core job.
See plans on github.com

OpenGrep fact sheet

Free planYes
Paid fromFree
Analysis targetSource
Supported languagesNot verified
IDE supportNot verified
CI/CD supportYes
DeploymentSelf-hosted
SCA includedNot verified
Fix guidanceNot verified
DeploymentSelf-hosted
PlatformsWindows, macOS, Linux
SupportCommunity, Docs
Built forSolo, Small business, Mid-market, Enterprise (editorial estimate)
PricingFree plan
Websitegithub.com
Facts checked22 Sep 2026

Alternatives to OpenGrep

See all OpenGrep alternatives →

Also Ranked In

OpenGrep is ranked in 2 of our directories.

Used OpenGrep? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used OpenGrep for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Your rating

0 characters · at least 80, up to 3,000

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Featured on iTechGuides — OpenGrep 7.8/10

OpenGrep is listed in our Static Application Security Testing Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/opengrep/"><img src="https://www.itechguides.com/best/badge/opengrep.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update