Semgrep

This is your pattern-based static analysis workhorse for finding security vulnerabilities and enforcing coding standards across 30+ languages. It shines when you need quick scans (minutes, not hours) using built-in rulesets like OWASP Top 10 or CWE Top 25, or when you want to write custom YAML rules for project-specific patterns. The taint mode is solid for tracking data flow from untrusted sources to dangerous sinks, which beats simple pattern matching for injection vulnerabilities. The skill includes MCP tools for scanning files and creating custom rules, plus comprehensive CLI fallbacks. One honest take: the test-first approach for custom rules is mandatory, not optional. You'll waste time debugging false positives without those ruleid and ok annotations in your test files.

Install to Claude Code

npx -y skills add semgrep/skills --skill semgrep --agent claude-code