vetkit and Semgrep: what each tool is for

The short version

Semgrep is a static analysis platform with a well-known open-source engine, built around rules that look like the code they match. It is a strong choice when you have people who want to write and tune their own security rules, and when you need deep code and supply chain analysis across many languages.

vetkit is a repository audit for teams that write a lot of code with AI assistants. One audit covers security, code quality, sustainability, AI-specific mistakes and production readiness, and the results go into a workflow with owners and target dates. It is aimed at teams that want a clear picture and a list of fixes without maintaining a rule set themselves. vetkit is also newer and in early access.

The two overlap less than the word “static analysis” suggests, and they can run side by side.

What Semgrep is

Semgrep, made by Semgrep, Inc., started as an open-source static analysis tool and is now a platform with three main products: Semgrep Code for static application security testing, Semgrep Supply Chain for dependency vulnerabilities (with reachability analysis), and Semgrep Secrets. The engine is available as Semgrep Community Edition under the LGPL 2.1 license, and the hosted platform has a free edition with usage limits alongside paid plans.

Semgrep is known for its rule syntax, which lets you describe a bug pattern in something close to the target language, and for its large library of community rules. The documentation describes cross-function dataflow analysis for supported languages. It runs as a CLI, in CI, in VS Code and JetBrains IDEs, and connects to GitHub, GitLab and Bitbucket, including their self-managed editions, as well as Azure DevOps Cloud.

Semgrep also works with coding agents. Semgrep Guardian bundles an MCP server, hooks and skills for agents such as Claude Code, Cursor and Codex, and the Semgrep CLI includes a local MCP server. The platform offers AI-assisted triage and suggested fixes.

What vetkit is

vetkit audits a repository and produces one graded report across five suites: security, code quality, sustainability, AI code risks and production readiness. It reads a temporary checkout of your code and never installs dependencies, runs builds or executes anything from the repository.

Under the hood vetkit combines open-source engines with its own checks. For code patterns it runs Opengrep, an open-source fork of the Semgrep engine, with a rule set written by the vetkit project. It uses gitleaks for secrets, OSV-Scanner for dependency vulnerabilities, Trivy and zizmor for infrastructure and CI configuration, and tree-sitter for complexity, duplication and test analysis.

Many of vetkit’s checks target mistakes common in AI-assisted code: dependencies that do not exist on public registries, unfinished implementations left in production paths, Supabase tables without row level security, secrets exposed through public environment variables, and LLM features that pass model output to code execution, SQL or HTML. Production readiness checks look for HTTP calls without timeouts, blocking calls on the request path and queries inside loops.

Findings can be assigned, given target dates and discussed, and risk acceptance requires a reason and an administrator’s review in team organizations. vetkit connects to coding agents through a local MCP server and a REST API. It is in early access: a free Security Quick Scan is available, and paid plans are not yet on sale.

Side by side

When Semgrep is the better fit

• You have security engineers who want to write, tune and share their own rules, or who need to encode company-specific patterns.
• You need deep static analysis and dependency reachability across a wide range of languages, enforced in CI on every change.
• Your code lives on self-managed GitHub, GitLab or Bitbucket, or in Azure DevOps.
• You want an open-source engine you can run anywhere, with no service in between.

When vetkit is the better fit

• You want one report that also covers code quality, dependency licenses and maintenance, and production readiness, not only security.
• Much of your code comes from AI assistants and you want checks aimed at their typical mistakes, such as invented packages, unfinished code and open Supabase tables.
• The people reading the results are founders or product engineers rather than a dedicated security team, and you want grades, explanations and suggested fixes instead of a rule console.
• You want findings to turn into tracked work with owners, deadlines and reviewed risk decisions.

Using both

A common split is to keep Semgrep in CI as the gate for security rules on every pull request, and to run a vetkit audit on the whole repository to see the state of things beyond security: AI-specific mistakes, production pitfalls, test maturity and dependency health. vetkit exports findings as SARIF, so they can sit next to other scanners’ results in tools that read that format.

There will be some overlap in security findings, because both look at code patterns and dependencies. Treat that as confirmation rather than noise, and pick one place where your team actually works the backlog.

Sources

We checked the information about other products on this page against their public documentation on November 1, 2026. Products change quickly, so treat the vendor’s own documentation as the final word.

• Semgrep documentation
• Semgrep supported languages
• Semgrep source control support
• Semgrep Community Edition
• Semgrep Guardian
• Semgrep pricing
• Opengrep on GitHub

Semgrep is a trademark of its owner. vetkit is not affiliated with, endorsed by or sponsored by it. Names are used only to identify the products being compared. Spotted something out of date or wrong? Email contact@vetkit.dev and we will correct it.