Skip to content
aicoolies logo
Semgrep logo

Alternatives to Semgrep

2 editor-selected alternatives · Semgrep overview →

source: tools.alternatives · stored order · active records only; review scores are annotations and never change membership or order

A directional evidence panel appears only when the substitute rationale, trade-offs, sources, and verification date have been recorded. Older selections without that panel remain visible but are unclassified under the new evidence contract.

Agentic Security logo
1

Agentic Security

open sourceexplicit relation

Agentic Security is an open-source vulnerability scanner for LLM agent workflows that tests AI systems against jailbreaks, fuzzing, and multimodal attacks. It probes weaknesses across text, image, and audio inputs through multi-step jailbreak simulations, randomized stress testing, and reinforcement learning-powered adaptive attacks. The toolkit connects directly to LLM APIs for high-volume real-world attack scenarios, helping developers identify and patch safety gaps before deployment.

Agentic Security is a 100% free and open-source AI vulnerability scanner and red-teaming tool under the Apache-2.0 license. It provides customizable datasets and automated prompt-fuzzing algorithms to detect prompt injections, jailbreaks, and SSRF vulnerabilities in LLMs with no software costs.
reviewdog logo
2

reviewdog

88/100open sourceexplicit relation

reviewdog is an open-source automated code review tool that integrates any linter or static analysis tool with GitHub, GitLab, Bitbucket, and Gitea pull requests. Parses output in errorformat, Checkstyle XML, SARIF, and JSON formats to post inline review comments on changed lines only. Works with GitHub Actions, Travis CI, CircleCI, GitLab CI, and Jenkins. Supports 40+ languages through universal linter adapter architecture.

Reviewdog is a free and open-source automated code review tool licensed under MIT that integrates linter results into pull requests on GitHub, GitLab, and other CI platforms without commercial subscription costs.Review →

Open-source Semgrep alternatives

Agentic Security, reviewdog — see all open-source developer tools.

More Code Review AI tools

same category, not editor-selected alternatives — see how Semgrep compares →

OpenLITOpenLIT is an open-source AI engineering platform that provides OpenTelemetry-native observability for LLM applications. It combines distributed tracing, evaluation, prompt management, a secrets vault, and GPU telemetry in a single self-hostable stack. With 50+ integrations across LLM providers and frameworks, it lets teams monitor AI applications using their existing observability backends like Grafana, Datadog, or Jaeger.CiliumCilium is a CNCF Graduated, Apache-2.0 project for Kubernetes networking, security, and observability using eBPF. It can replace kube-proxy, enforce identity-aware L3-L7 network policies, and add Hubble flow observability plus Tetragon runtime-security signals. Current source checks support GKE Dataplane V2 using Cilium/eBPF and Azure CNI Powered by Cilium for AKS.MCP-ScanMCP-Scan is a security tool that scans MCP servers for vulnerabilities including tool poisoning, prompt injection, cross-origin escalation, and rug pull attacks. Acquired by Snyk in 2026, it is the first dedicated security scanner for the MCP ecosystem. It analyzes tool descriptions, permissions, and behavior patterns to detect malicious or compromised MCP servers before they can exploit AI agents.PangolinIdentity-based remote access platform built on WireGuard that combines reverse proxy and VPN capabilities. Pangolin supports clientless browser access for web apps and client-based private-resource access across macOS, iOS, Windows, Linux, and Android, with zero-trust rules, peer-to-peer tunnels, automatic SSL, SSO/OIDC options, and cloud or self-hosted deployment.CodeRabbitAI-powered code review tool that automatically analyzes pull requests and provides line-by-line feedback on code quality, bugs, security vulnerabilities, and best practices. Integrates with GitHub and GitLab as a bot that comments on PRs. Uses LLMs to understand code context and suggest improvements. Learns from your codebase patterns and team preferences. Supports all major programming languages. Reduces review cycle time while catching issues human reviewers might miss.MergifyMergify is a pull request automation platform that keeps main branches green with merge queue batching, merge protections, CI Insights, flaky-test detection, and stacked pull requests. Its Stacks workflow turns commits on one local branch into focused PR chains, helping teams review large AI-generated or feature-heavy changes without losing queue safety.SonarQubeSonarQube is an open-source code quality and security platform with 10K+ GitHub stars that inspects code for bugs, vulnerabilities, code smells, and security hotspots. It enforces quality gates in CI/CD pipelines, supports 30+ languages in Team plans and 40+ in Enterprise, and remains the industry standard for static code quality management.Aikido SecurityAikido Security is an all-in-one AppSec platform unifying SAST, DAST, SCA, CSPM, secrets detection, container scanning, IaC analysis, and runtime protection in a single developer-friendly dashboard. Cuts false positive noise by 95% through reachability analysis that evaluates vulnerabilities in actual deployment context. Features AI AutoFix for one-click remediation, CI/CD gating, and AI-powered pentesting agents. Trusted by 50,000+ organizations. Supports 50+ programming languages.SnykSnyk is the leading developer security platform providing continuous scanning for vulnerabilities in code (SAST), open-source dependencies (SCA), container images, and infrastructure as code. Integrates directly into IDEs, Git repositories, CI/CD pipelines, and container registries. Features AI-powered fix suggestions, license compliance checking, and real-time vulnerability database. Free for individual developers with paid plans for teams. Supports 30+ programming languages.

Semgrep head-to-head

FAQ

Which Semgrep alternative is listed first?

Agentic Security is first in the editor-selected list of 2 Semgrep alternatives. The stored order is editorial; review scores do not determine membership or position.

Are there open-source Semgrep alternatives?

Yes — Agentic Security, reviewdog are open source.