Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

Semgrep Supply Chain

Freemium#6 of 65 in Software Composition Analysis Software

Semgrep Supply Chain: A developer-focused SCA tool combining reachability, SBOMs, detection, and upgrade automation. Ranked #6 of 65 in Software Composition Analysis Software by our editors (8.7/10); pricing: Free plan; best for developer teams needing code-aware SCA.

8.7/10Editor score
Visit Semgrep
Semgrep Supply Chain8.7 Visit Semgrep

At a glance

  • Editor score
    8.7 / 10
  • Pricing
    Free plan
  • Best for
    Developer teams needing code-aware SCA
  • Free plan
    Yes
  • Paid from
    $30/user/mo
  • SBOM generation
    Yes
  • Founded
    2017 · San Francisco, California, United States
  • Facts checked
    22 Sep 2026
Semgrep Supply Chain screenshot

  • Where it wins

    • Codebase-aware reachability identifies vulnerable dependency paths
    • SBOM generation, license checks, and malicious-package detection
    • Broad source-control and CI/CD integrations with a free edition

  • Where it doesn't

    • Free Edition is limited to 10 repositories and 10 contributors
    • Teams pricing is charged per contributor each month
    • Enterprise pricing is not displayed in the published plans

Our verdict on Semgrep Supply Chain

Semgrep Supply Chain is a software composition analysis product for development and security teams. It examines open-source dependencies, identifies vulnerable code paths through codebase-aware reachability analysis, generates and exports SBOMs through documented API endpoints, checks licenses, and detects malicious dependencies. Pull-request and merge-request scanning brings findings into development workflows, while dependency inventory and search support ongoing visibility across supported ecosystems. It is aimed at teams that want dependency security connected to source control and CI/CD rather than handled as a separate review step.

The freemium structure gives smaller teams a defined starting point. The Free Edition costs $0 per contributor per month and includes Supply Chain, with up to 10 repositories and a maximum of 10 contributors. Teams costs $30 per contributor per month, billed monthly, and adds single sign-on and one-click CI/CD deployment, with Supply Chain available as a selectable product. Enterprise adds on-premises source-code management support, custom CI/CD integrations, and no limit on repositories or contributors. The per-contributor model is straightforward, but larger teams should assess how contributor-based billing fits their development process.

Platform fit is a major strength. Semgrep Supply Chain supports GitHub, GitLab, and Bitbucket, along with GitHub Actions, GitLab CI/CD, Bitbucket Pipelines, Jenkins, Buildkite, CircleCI, and Azure Pipelines. Its feature set extends beyond vulnerability identification through autofix pull requests, breaking-change detection, AI-powered dependency upgrade guidance, and malicious-dependency detection. Support spans JavaScript/npm, Python/PyPI, Ruby/RubyGems, Java/Maven, Go/Go modules, C#/.NET/NuGet, Rust/Cargo, PHP/Composer, Kotlin/Gradle, Swift/SPM, and Scala. Choose it when code-aware analysis and workflow integration matter; teams seeking a narrower dependency scanner may not need its broader feature set.

Your product? Our editors can test Semgrep Supply Chain in depth and publish a review, labelled as paid · from $149/mo →

Semgrep Supply Chain pricing

Plans Free planFreemium A usable free plan; paid tiers unlock the limits above. Prices checked 22 Sep 2026.
See plans on semgrep.dev

All 3 Semgrep Supply Chain plans and prices →

Semgrep Supply Chain fact sheet

Free planYes
Paid from$30/user/mo
Supported ecosystemsC# (NuGet); Dart (Pub); Go (Go modules); Java (Gradle, Maven); JavaScript/TypeScript (npm, Yarn, pnpm); Kotlin (Gradle, Maven); PHP (Composer); Python (pip, pip-tool, Pipenv, Poetry); Ruby (RubyGems); Rust (Cargo); Scala (Maven); Swift (SwiftPM)
SBOM generationYes
Reachability analysisYes
Pull request scanningYes
Monitored projects500 projects
Deployment optionsHybrid
DeploymentCloud, Self-hosted
PlatformsWeb, Linux, macOS
Compliance & securitySOC 2, GDPR, SSO/SAML
SupportEmail, Community, Docs
Built forSmall business, Mid-market, Enterprise (editorial estimate)
Integrations14 integrations: GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure Pipelines … See all →
PricingFree plan (source)
Websitesemgrep.dev
Facts checked22 Sep 2026

Semgrep Supply Chain integrations

Semgrep Supply Chain lists 14 integrations on its own site.

  • GitHub
  • GitLab
  • Bitbucket
  • Jenkins
  • CircleCI
  • Azure Pipelines
  • Buildkite
  • Slack
  • Email
  • Webhooks
  • VS Code
  • IntelliJ
  • SAML
  • OpenID Connect

See all Semgrep Supply Chain integrations →

Alternatives to Semgrep Supply Chain

See all Semgrep Supply Chain alternatives →

Semgrep Supply Chain vs the competition

Compare Semgrep Supply Chain with any tool side by side →

Used Semgrep Supply Chain? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Semgrep Supply Chain for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Your rating

0 characters · at least 80, up to 3,000

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Featured on iTechGuides — Semgrep Supply Chain 8.7/10

Semgrep Supply Chain is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/semgrep-supply-chain/"><img src="https://www.itechguides.com/best/badge/semgrep-supply-chain.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update