---
schema_version: 1
route: /t/semgrep.md
tool: "semgrep"
---

# sincecutoff.com /t/semgrep — Semgrep

- name: Semgrep
- kind: cli
- children: none
- homepage: <https://github.com/semgrep/semgrep>

Changes to the tools coding agents drive, since a model's training cutoff, each linked to its first-party source. Check installed versions and limitations before acting; a cutoff date does not establish what a model knows.
Original editorial content: [Apache 2.0](https://sincecutoff.com/v1/data-license.txt), by [0xPatrick](https://0xpatrick.dev). Preserve applicable license and [NOTICE](https://sincecutoff.com/notice.txt) attribution when redistributing. Third-party source text and examples retain their own rights. [License scope and attribution](https://sincecutoff.com/v1/license.json).
To stay current, read the changes feed: [`/v1/changes.md?tool=semgrep`](https://sincecutoff.com/v1/changes.md?tool=semgrep) (or `.json`), adding `since=YYYY-MM-DD` for your training cutoff. Entries for registered children are included; the registry itself is `/v1/tools.json`. How to page and save your place: [llms.txt](https://sincecutoff.com/llms.txt).

### Semgrep scans OpenTofu .tofu files as Terraform (2026-07-22)
- slug: semgrep-scans-opentofu-tofu-files-as-terraform-c7e9186e5a09
- score: 0.94

How to use it:

When scanning a repository with OpenTofu `.tofu` files, run a recursive Semgrep scan with `p/terraform`; Semgrep 1.171.0 detects and scans `.tofu` files as Terraform without extra configuration.

Examples:

```
semgrep scan --config p/terraform .
```

- why_it_matters: Scan a repository containing OpenTofu files with recursive scans or Terraform rulesets.
- sources: <https://github.com/semgrep/semgrep/releases/tag/v1.171.0>, <https://semgrep.dev/docs/cli-reference>
- gotchas: "Version: 1.171.0"; "TARGETS (`.`): Files or folders to scan; Semgrep defaults to the current working directory."; "--config (`p/terraform`) (required): Select a Semgrep Registry ruleset by name."; "Prerequisite: Use Semgrep 1.171.0 or later for the documented `.tofu` automatic detection change."

### semgrep scan and ci add experimental --x-dependency-paths output (2026-06-24)
- slug: semgrep-scan-and-ci-add-experimental-x-dependency-paths-output-e7be0c43bfb2
- score: 0.93

How to use it:

When inspecting transitive supply-chain findings, run `semgrep scan` or `semgrep ci` with `--x-dependency-paths` and select JSON or SARIF output. The flag adds full dependency paths to those findings in the selected output.

Examples:

```
semgrep scan --x-dependency-paths --json
```

```
semgrep scan --x-dependency-paths --sarif
```

```
semgrep ci --x-dependency-paths --json
```

- why_it_matters: Inspect transitive supply-chain findings in JSON or SARIF output from a `scan` or `ci` run.
- sources: <https://github.com/semgrep/semgrep/releases/tag/v1.168.0>, <https://docs.semgrep.dev/cli-reference>
- gotchas: "Version: 1.168.0"; "Availability: experimental"; "--x-dependency-paths: Experimental flag; includes full dependency paths for transitive supply-chain findings in JSON and SARIF output."; "--json: Outputs results in Semgrep JSON format. Use as the selected output format with `--x-dependency-paths`."; "--sarif: Outputs results in SARIF format. Use as the selected output format with `--x-dependency-paths`."

### Semgrep skips binary files by default with an opt-out flag (2026-06-17)
- slug: semgrep-skips-binary-files-by-default-with-an-opt-out-flag-bb66ff762a3e
- score: 0.92

How to use it:

When a repository scan must include binary files, run `semgrep scan --no-exclude-binary-files <path>`; binary-file exclusion is enabled by default and detects files by matching their extensions to known magic bytes.

Examples:

```
semgrep scan --no-exclude-binary-files <path>
```

- why_it_matters: Scan a repository containing binary files when those files need to be included.
- before: The release note says to pass `--no-exclude-binary-files` to scan binary files as before.
- sources: <https://github.com/semgrep/semgrep/releases/tag/v1.167.0>, <https://docs.semgrep.dev/cli-reference>
- gotchas: "Version: 1.167.0"; "--no-exclude-binary-files: Negates `--exclude-binary-files`, allowing binary files to be scanned."; "<path> (TARGETS): File or folder to scan; without a target, `semgrep scan` searches the current working directory."; "Binary files such as images, archives, and compiled executables are skipped by default."

### semgrep --max-match-context-size limits source context per match (2026-06-03)
- slug: semgrep-max-match-context-size-limits-source-context-per-match-32dfd04c5fe1
- score: 0.95

How to use it:

When scanning minified source files, pass `--max-match-context-size <characters>` to limit source-code context included for each match. Use `0` for unlimited context, the default.

Examples:

```
semgrep scan --max-match-context-size <characters> <path>
```

- why_it_matters: Limit output context when scanning minified source files.
- sources: <https://github.com/semgrep/semgrep/releases/tag/v1.165.0>
- gotchas: "Version: v1.165.0"; "--max-match-context-size <characters>: Maximum number of source-code characters included as context for each match in output. `0` means unlimited and is the default."; "The limit applies to source code included as context for each match in the output."; "A value of 0 means unlimited and is the default."

### Semgrep Dart patterns add typed metavariables and function-definition matching (2026-05-27)
- slug: semgrep-dart-patterns-add-typed-metavariables-and-function-definition-matching-4b4b32adf797
- score: 0.97

How to use it:

When writing Dart rules in Semgrep 1.164.0, use the release’s new typed metavariable, `metavariable-type`, interpolation binding, and function-definition matching support. Scan the target with your rule file using `semgrep scan --config <rule.yaml> <target>`.

Examples:

```
semgrep scan --config <rule.yaml> <target>
```

- why_it_matters: Write or update Semgrep rules that match Dart code using typed metavariables, string interpolations, or function definitions.
- sources: <https://github.com/semgrep/semgrep/releases/tag/v1.164.0>, <https://semgrep.dev/docs/semgrep-ci/sample-ci-configs>, <https://github.com/semgrep/semgrep-interfaces/blob/main/rule_schema_v1.yaml>
- gotchas: "Version: 1.164.0"; "`metavariable-type.metavariable` (required): Metavariable to match."; "`metavariable-type.type`: Type expression. Use either `type` or `types`; the schema requires one of them."; "`metavariable-type.types`: Array of type expressions. Use either `types` or `type`; the schema requires one of them."; "`metavariable-type.language`: Language field in the `metavariable-type` object; its purpose is not described in the schema."; "`$X as T`: Dart typed metavariable syntax; the release note names it but the documentation found does not define its matching behavior."

### MCP semgrep_findings filters by branch and includes findings without AI verdicts (2026-05-07)
- slug: mcp-semgrep-findings-filters-by-branch-and-includes-findings-without-ai-verdicts-8e11fe1f320f
- score: 0.93

How to use it:

To retrieve findings for a branch, call `semgrep_findings` with `refs` set to that branch. Omit `autotriage_verdict` to include findings without an AI verdict.

Examples:

```
semgrep_findings(repos=["<owner>/<repository>"], refs=["<branch>"])
```

- why_it_matters: Retrieve Semgrep findings for a particular branch, including findings without an AI verdict.
- sources: <https://github.com/semgrep/semgrep/releases/tag/v1.162.0>, <https://github.com/semgrep/semgrep/blob/develop/cli/src/semgrep/mcp/server.py>
- gotchas: "Version: v1.162.0"; "Availability: MCP"; "repos (required): Repository names to filter by, in `owner/repository` form; the tool returns an error if none are provided."; "refs: List of git refs (branch names) to filter findings by. If omitted, findings are filtered to the primary branch."; "autotriage_verdict: Verdict filter (`VERDICT_TRUE_POSITIVE` or `VERDICT_FALSE_POSITIVE`). Omit it to include findings with any verdict, including unrated findings."; "Prerequisite: Authenticate to Semgrep and have a deployment ID. API tokens must have the `webapi` role."; "The `refs` parameter defaults to the primary branch when unspecified."; "`autotriage_verdict` is optional."

### Semgrep matches class names for metavariable-type checks (2026-03-31)
- slug: semgrep-matches-class-names-for-metavariable-type-checks-ecc3c81a85d4
- score: 0.96

How to use it:

When a rule needs to match a class name in a method call and check that name’s type, match `$C.getInstance(...)` and apply `metavariable-type` to `$C`.

Examples:

```
rules:
  - id: class-name-type-check
    languages: [java]
    message: Matched class name with the requested type
    severity: WARNING
    patterns:
      - pattern: $C.getInstance(...)
      - metavariable-type:
          metavariable: $C
          type: <type-expression>
```

```
patterns:
  - pattern: $C.getInstance(...)
  - metavariable-type:
      metavariable: $C
      types:
        - <type-expression-1>
        - <type-expression-2>
```

- why_it_matters: Write a rule that matches a class name in a method call and checks that class's type.
- before: The release note says this match-and-type-check workflow became possible in v1.157.0; it does not specify the prior alternative.
- sources: <https://github.com/semgrep/semgrep/releases/tag/v1.157.0>, <https://github.com/semgrep/semgrep-interfaces/blob/main/rule_schema_v1.yaml>, <https://docs.semgrep.dev/writing-rules/rule-syntax>
- gotchas: "Version: 1.157.0"; "pattern (required): Code expression to match; here `$C.getInstance(...)`."; "metavariable-type.metavariable (required): Metavariable whose type is checked; here `$C`."; "metavariable-type.type (required): One type expression to check against. Mutually exclusive with `types`."; "metavariable-type.types (required): List of type expressions to check against. Mutually exclusive with `type`."; "metavariable-type.language: Optional language string in the schema; its effect is not documented in the source inspected."; "languages (required): Rule language list; choose the target language for the code being matched."

### Semgrep metavariable comparisons support case-insensitive string matching (2026-02-18)
- slug: semgrep-metavariable-comparisons-support-case-insensitive-string-matching-b1acbe45150b
- score: 0.97

How to use it:

When a Semgrep rule needs to compare a metavariable’s string value without case sensitivity, add a `metavariable-comparison` using `upper(str($VALUE)) == "SEMGREP"` (or use `lower()` for lowercase comparison).

Examples:

```
- metavariable-comparison:
    metavariable: $VALUE
    comparison: upper(str($VALUE)) == "SEMGREP"
```

- why_it_matters: Write a Semgrep rule that compares a metavariable's string value without case sensitivity.
- sources: <https://github.com/semgrep/semgrep/releases/tag/v1.152.0>, <https://docs.semgrep.dev/writing-rules/rule-syntax>
- gotchas: "Version: v1.152.0"; "metavariable (required): The metavariable to compare; it must be bound by a positive pattern."; "comparison (required): A Python-like comparison expression. Docs list `str()` and comparison operators; v1.152.0 release note demonstrates `upper(str(...))` for case-insensitive matching."