semgrep

Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-scans.sh, which batches the semgrep processes and writes scans.json, and merges the output to SARIF. Supports two scan modes, "run all" for full ruleset coverage and "important only" for security findings at medium-to-high confidence and impact. Uses Semgrep Pro for cross-file taint analysis when it is available. Use when

Install

KitScout test notes

Not tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.

Similar tools

• rea-analysis-optimization 456,653 ★
  Optimize REA providers and shared analysis workflows for agent context, latency, CPU, and memory while preserv
• rea-ci-tests-audit 456,653 ★
  Audit REA CI and test suites for correctness, fixture drift, false passes, and measured performance; use for s
• diagnosing-bugs 323,485 ★
  Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or r
• migrate-to-shoehorn 323,485 ★
  Migrate test files from `as` type assertions to @total-typescript/shoehorn. Use when user mentions shoehorn, w
• webapp-testing 193,970 ★
  Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend