What are the best alternatives to semgrep?
The highest-scoring alternative to semgrep is skill-scanner from getsentry/skills, at 88/100 (grade B) on the Suede Skill Check; semgrep scores 92/100. The table compares 7 security audit skills in security from other publishers, each with a full SuedeAI.directory page. Every score follows the published rubric.
semgrep and 7 alternatives
Alternatives share semgrep's category and task, come from other publishers and each have a full directory page. Ranked by Suede Skill Check score.
| Skill | Publisher | Suede Skill Check | License | What it does |
|---|---|---|---|---|
| semgrep Compared skill | Trail of Bits Official trailofbits/skills | 92/100 · A | CC-BY-SA-4.0 | Runs a Semgrep security scan over a codebase, detecting languages, selecting rulesets, requiring approval of the plan, and merging output to SARIF. |
| skill-scanner | Sentry Official getsentry/skills | 88/100 · B | Apache-2.0 | Scans agent skills for prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks before installation. |
| gha-security-review | Sentry Official getsentry/skills | 86/100 · B | Apache-2.0 | Reviews GitHub Actions workflows for exploitation vulnerabilities such as pwn requests, expression injection, credential theft, and supply chain attacks, with concrete proof-of-concept scenarios. |
| security-review | Sentry Official getsentry/skills | 86/100 · B | CC-BY-SA-4.0 | Reviews code for security vulnerabilities including injection, XSS, authentication, authorization, and cryptography issues, using a systematic process with confidence-based reporting. |
| aig-scanner | Tencent Tencent/AI-Infra-Guard | 82/100 · B | MIT | Runs AI security scans of infrastructure, AI tools and skills, and AI agents, and evaluates LLM jailbreak resistance with Tencent's AI-Infra-Guard. |
| firebase-security-rules-auditor | Firebase Official firebase/skills | 78/100 · C | Apache-2.0 | Audits Firebase Firestore and Cloud Storage security rules for vulnerabilities including privilege escalation, role bypasses, and resource exhaustion. |
| redis-security | Redis Official redis/agent-skills | 75/100 · C | MIT | Guides Redis security, covering authentication with requirepass and ACL users, TLS, least-privilege access control, network exposure limits, and disabling dangerous commands. |
| security-audit | Cloudflare Official cloudflare/security-audit-skill | 72/100 · C | MIT | Provides security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons, including focused reviews, vulnerability research, audits, and pen tests. |
Questions and answers
What is the highest-scoring alternative to semgrep?
skill-scanner from getsentry/skills, at 88/100, grade B. It earns full points for structural checks, recent maintenance and instruction depth. Scans agent skills for prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks before installation.
How does semgrep compare with its alternatives?
semgrep scores 92/100, grade A. Of the 7 alternatives, 7 score lower; their scores run from 72 to 88. All of them sit in security and match the security audits keyword map.
Are the alternatives to semgrep free?
All 7 alternatives to semgrep are published in public GitHub repositories and cost nothing to download. Every one uses an open-source or open-content license, led by Apache-2.0 (3), MIT (3) and CC-BY-SA-4.0 (1), so you can use and adapt the files at no cost under those terms. 2 skills name credentials for an outside service; each full page lists them under Before you install.
Do the alternatives to semgrep work in Claude Code, Codex and Cursor?
Yes. Each of the 7 alternatives to semgrep is a SKILL.md folder in the Agent Skills format, which Claude Code, Codex and Cursor all read. The skills CLI (npx skills add) installs every one of them into Claude Code, Codex, Cursor and other agents, and each full skill page adds a project-level copy into .claude/skills for Claude Code and .agents/skills for Codex.