Semgrep Supply Chain

Free plan APILinuxMacSelf-hostedWeb

Visit Semgrep Supply Chain Alternatives Pricing

What Semgrep Supply Chain is

Semgrep Supply Chain is a hybrid software supply-chain security service for finding risks in open-source dependencies. It performs software composition analysis, lockfile and code scanning, codebase-aware reachability analysis, malicious dependency detection, SBOM generation, license compliance checks, and dependency search. Semgrep says reachability analysis can reduce false positives by up to 98%, while critical and high severity findings have GA-level support in 12 languages. Upgrade assistance includes autofix pull requests, line-level breaking-change detection, and guidance using LLM reasoning with static-analysis context. Supported ecosystems include NuGet, Pub, Go modules, Gradle, Maven, npm, Yarn, pnpm, Composer, pip, Pipenv, Poetry, RubyGems, Cargo, and SwiftPM. Integrations include major CI services plus Slack, email, webhooks, VS Code, and IntelliJ. Free Edition costs $0/month/contributor for up to 10 repositories and 10 contributors. Teams costs $30/month/contributor; Enterprise pricing is custom.

Who it suits

It suits development teams managing open-source dependencies across supported languages and CI systems. The Free Edition fits smaller repositories, while larger teams can use higher repository limits and enterprise support.

What it does well

Detects vulnerabilities and malicious dependencies
Code-aware reachability analysis
SBOM and license compliance tools
Autofix pull requests and upgrade guidance
Hybrid deployment with local code handling

What to know first

Free Edition limited to 10 repositories
Free Edition limited to 10 contributors
REST API access listed for Teams and Enterprise
Enterprise pricing is custom

Limits

Free Edition is $0/month/contributor and supports up to 10 repositories and 10 contributors. Teams costs $30/month/contributor, supports up to 500 private repositories, and includes 20 AI credits per developer per month. Enterprise has no repository or contributor limit, with custom pricing.

Plans

Plan	Billed and limits	Price
Free Edition	$0/month/contributor · up to 10 repositories · maximum 10 contributors · GitHub/GitLab authentication	Free
Teams — Supply Chain	$30/month/contributor · 500 private repositories max · 20 AI credits per developer per month · SSO	$30 a month
Enterprise	Custom · No limit on repositories scanned or contributors · optional dedicated infrastructure · dedicated account manager	On request

As semgrep.dev lists them, read 30 Sept 2026. The maker's own page has the final word.

Getting started

Open https://semgrep.dev/.
Choose Free Edition, Teams — Supply Chain, or Enterprise.
Authenticate Free Edition with GitHub or GitLab.
Connect repositories through a supported CI integration or deployment environment.
Enable scanning, reachability analysis, SBOM, and other supply-chain checks.
Add Slack, email, webhooks, VS Code, or IntelliJ integrations if needed.

Verdict

Semgrep Supply Chain combines dependency security, reachability analysis, malware detection, and upgrade workflows in one service. Its free tier has clear repository and contributor limits, while paid plans add capacity and support.

Questions

Is Semgrep Supply Chain free?

Yes. Free Edition costs $0/month/contributor; paid Teams starts at $30/month/contributor.

Which platforms does it support?

Platforms listed are API, Linux, macOS, self-hosted, and web, with hybrid deployment options.

Does it generate SBOMs?

Yes. SBOM generation is included among the listed supply-chain capabilities.

Which repositories can Free Edition scan?

Free Edition allows up to 10 private repositories and 10 contributors.

Does it offer API access?

REST API access is listed for Teams and Enterprise.

How is source code handled?

Local or fully CI-based runs keep source code in the user's computer or CI environment. Opted-in AI processing submits part of a file containing a finding to a model.

Facts from Semgrep Supply Chain's own pages

API access: The pricing comparison lists REST API access for Teams and Enterprise. · semgrep.dev, 30 Sept 2026
Code handling: Semgrep says that when it runs locally or fully in a CI pipeline, source code stays on the user's computer or CI environment; opted-in AI processing submits part of a file containing a finding to a model. · semgrep.dev, 30 Sept 2026
Company history: Semgrep says it was founded in 2017 by Drew Dennison, Isaac Evans, and Luke O’Malley. · semgrep.dev, 30 Sept 2026
Compliance: Semgrep's Trust Portal says its SOC 2 Type II report and full-scope penetration test cover the AppSec Platform, including Supply Chain. · trust.semgrep.dev, 30 Sept 2026
Dependency upgrades: The product offers autofix pull requests, line-level breaking-change detection, and upgrade guidance based on LLM reasoning and static-analysis context. · semgrep.dev, 30 Sept 2026
Founded: 2017 · semgrep.dev, 28 Sept 2026
Headquarters: San Francisco, California, United States · semgrep.dev, 28 Sept 2026
Integrations: Semgrep lists GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure, and Buildkite among its CI integrations, with Slack, email, webhooks, VS Code, and IntelliJ also listed. · semgrep.dev, 30 Sept 2026
Malware detection: Semgrep describes malicious dependency detection, impact analysis, and policies to help respond to zero-day supply-chain attacks. · semgrep.dev, 30 Sept 2026
Plan limits: The pricing comparison lists 10 private repositories maximum for Free Edition, 500 maximum for Teams, and unlimited for Enterprise. · semgrep.dev, 30 Sept 2026
Purpose: Semgrep Supply Chain detects vulnerabilities in open-source dependencies, blocks malware, and provides codebase-aware reachability analysis and upgrade guidance. · semgrep.dev, 30 Sept 2026
Reachability: Semgrep says codebase-aware reachability can reduce false positives by up to 98%. · semgrep.dev, 30 Sept 2026
Severity coverage: The product page states that critical and high severity findings have GA-level support in 12 languages. · semgrep.dev, 30 Sept 2026
Supply-chain features: The pricing comparison lists software composition analysis, lockfile and code scanning, reachability analysis, malicious dependency detection, SBOM generation, license compliance checking, and dependency search. · semgrep.dev, 30 Sept 2026
Support: The pricing page lists community-based support for Free Edition, award-winning support for Teams, and a dedicated account manager and tailored onboarding for Enterprise. · semgrep.dev, 30 Sept 2026

Where Semgrep Supply Chain stands on Freedom251

Ruby Static Analysis Tools#8 of 21
Software Composition Analysis Software#29 of 65