Semgrep
Improving LLM security agents' vulnerability discovery and reducing false positives, Searching and filtering text output from CLI tools via piping
It's a powerful CLI-based code scanner, but requires comfort with command-line tools and regular expressions to be effective.
General command-line text searching for users unfamiliar with CLI tools, Finding specific bug callsites in complex legacy codebases
Related Tools
FIRST-HAND READS
What people reported, in their own words. Every line links to where it was said.
“giving models access to the open source semgrep as a tool makes some perform worse and none perform better”
NEGATIVE · performance · Hacker News · 2026-06-28
“semgrep (which is almost cheating, since it finds bugs on its own, but worth a try since models can still be useful in helping rule out false positives and suggest mitigations)”
POSITIVE · features · Hacker News · 2026-06-23
“giving LLM security agents access to good tools (Semgrep, CodeQL, etc.) makes them significantly better esp. when it comes to false positives”
POSITIVE · performance · Hacker News · 2026-02-20
“Semgrep scanned the same codebase and found 222 issues, 208 of which were false positives, and missed this one entirely”
NEGATIVE · performance · Hacker News · 2026-02-11
“I've tried giving them tools like CodeQL, semgrep and Joern, but that's been pretty disappointing. They can run basic queries, but all they surface are noisy false positives, and they can't reason their way out of why it might be a false positive early on”
NEGATIVE · performance · Hacker News · 2025-08-01
“the IA tool of Semgrep just signalled me a real although very minor issue on some C project”
POSITIVE · performance · Hacker News · 2025-07-31
Have You Used This Tool?
Sign in to share your experience with this tool.
Sign in