Top 12 Python semgrep Projects

semgrep

• Add a project

1. PRevent

   1 5 259 9.0 Python

   Prevent merging of malicious code in pull requests

   

2. AppSignal

   www.appsignal.com sponsored

   Monitoring that respects your time & budget. APM, error tracking, and dashboards for modern web apps. Ten-minute setup, transparent flat pricing, and support from engineers who actually use the product.

   

3. malicious-code-ruleset

   2 4 149 7.8 Python

   Focused malicious code detection ruleset, with a high protection-to-noise ratio

   

4. semgrep-rules-manager

   3 2 120 6.9 Python

   Manager of 14 third-party sources comprising approximately 4,000 Semgrep rules 🗂

   

5. autogrep

   4 1 87 7.7 Python

   Autogrep automates Semgrep rule generation and filtering by using LLMs to analyze vulnerability patches, enabling automatic creation of high-quality security rules without manual curation.

   

6. semgrep-docs

   5 1 61 9.6 Python

   Documentation of Semgrep: a fast, open-source, static analysis tool.

   

7. Vulnchain

   6 2 10 6.3 Python

   AI-powered multi-language security scanner: 154 Semgrep rules, 13 Joern CPG scripts, AI code detection, and attack-chain correlation

   

   Project mention: Why I built attack-chain correlation on top of Semgrep and Joern | dev.to | 2026-04-07

   → github.com/hamzamiladin/Vulnchain

8. scankii

   7 1 6 7.9 Python

   A local-first SAST & Runtime Security scanner built exclusively for LLM Agents. Detects cross-modal data leaks, prompt injections, and intercepts credentials before execution.

   

   Project mention: Scankii: The First Static Security Scanner Built to Stop AI Agents from Leaking API Keys | dev.to | 2026-07-01

   GitHub Repository: https://github.com/ashp15205/scankii Installation: pip install scankii

9. SaaSHub

   www.saashub.com sponsored

   SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

   

10. deepzero

    8 1 1 - Python

    Find zero-days while you sleep. DeepZero is an automated vulnerability research framework that parses, decompiles, and analyzes thousands of Windows kernel drivers for exploitable IOCTLs natively using AI agents.

    

    Project mention: Automating Zero-Day Discovery in Windows Kernel Drivers with LangChain DeepAgents | dev.to | 2026-04-06

    Check it out here: https://github.com/416rehman/deepzero.

11. Velonus

    9 1 1 - Python

    AI-native security copilot for Python developers. Scans for secrets, vulnerabilities, and dependency CVEs — then tells you how to fix them.

    

    Project mention: Velonus – Open-source AppSec scanner that deduplicates SAST noise | news.ycombinator.com | 2026-05-14

12. SecHelix

    10 2 1 9.6 Python

    Most AI security tools try to find more. SecHelix tries to prove itself wrong: every candidate finding goes to an independent verifier whose only job is to disprove it. Open-source AppSec agent for Claude Code, Codex and Copilot.

    

    Project mention: I pointed my own security tool at my own GitHub Action. It found two bugs. | dev.to | 2026-09-09

    git clone https://github.com/omarmohelal/SecHelix && cd SecHelix python examples/expense-api/prove.py

13. mcp-sinks

    11 1 0 4.7 Python

    Semgrep sink ruleset for MCP server security research — command injection, path traversal, SSRF, SQLi, deserialization, transport hygiene

    

    Project mention: How I found a CVSS 9.8 Critical in an OAuth-protected MCP server. And the one line fix. | dev.to | 2026-08-28

    View on GitHub

14. Pixeebot

    12 1 - - Python

    Pixeebot finds security and code quality issues in your code and inbound pull requests and creates merge-ready pull requests with recommended fixes. Pixeebot integrates with third party security tools such as Sonar, Semgrep, and CodeQL to automatically fix findings from each tool's scans.

Python semgrep related posts

• Product Engineers Should Ship Fast AND Secure Vibe Generated Code

  1 project | dev.to | 23 May 2025

• Manager of third-party sources of Semgrep rules

  1 project | /r/devsecops | 3 Aug 2023

Index

Sponsored

Monitoring that respects your time & budget

APM, error tracking, and dashboards for modern web apps. Ten-minute setup, transparent flat pricing, and support from engineers who actually use the product.

www.appsignal.com

Do not miss the trending Python projects with our weekly report!