| name | semgrep |
| description | Run Semgrep static analysis for security findings. Supports important-only or full scans, Semgrep Pro when available, merged SARIF, triage, and remediation plans. |
| allowed-tools | ["Bash","Read","Glob","Task","AskUserQuestion","TaskCreate","TaskList","TaskUpdate"] |
Semgrep
Use this for static security analysis.
Run the real scanner; do not substitute grep-only guesses for Semgrep findings.
Start
- Confirm Semgrep is installed and identify repo languages.
- Choose
important only for high-confidence security or run all for broad coverage.
- Use Semgrep Pro cross-file analysis when credentials/config allow it.
- Split large scans by language or package only when it improves reliability.
Flow
- Run the selected ruleset and capture raw output.
- Merge SARIF or JSON outputs when scanning in parallel.
- Triage each finding against the source code before calling it real.
- Rank by exploitability, impact, and confidence.
- Fix real findings or produce a file:line remediation plan.
- Re-run the relevant scan after fixes.
Output
Report command, rulesets, files scanned, result counts, real findings, false positives, and artifact paths.
Use references/full-reference.md and workflows/scan-workflow.md for the full command workflow and ruleset matrix.
Then consider
harden when static findings imply exploitable security paths.converge when fixes must drive CI green.
