Does servasec support custom Semgrep rules?

Yes. Semgrep runs with your custom rules locally, and the results are pushed to servasec. servasec ingests the SARIF output which includes all findings regardless of which rules generated them.

Can I see Semgrep findings alongside other scanners?

Absolutely. servasec normalizes findings from all scanners into a unified format. You can filter by scanner type or view correlated findings across SAST, SCA, DAST, and secrets scanning.

Supported/SAST

Semgrep + servasec

Lightweight static analysis for finding bugs and enforcing coding standards. Supports 30+ languages with pattern-based rules.

What is Semgrep?

Semgrep is a fast, open source static analysis tool that finds bugs and enforces code standards across 30+ languages. It uses pattern-based rules that are easy to write and understand, making it accessible for developers who want to catch security issues early in the development cycle. Semgrep supports custom rules, registry-shared rules, and integrates natively into CI/CD pipelines.

30+ languages supportedPattern-based custom rulesFast execution (< 10s on most codebases)OWASP Top 10 coverageNative CI/CD integration

Integrate Semgrep with servasec

Install Semgrep

Install Semgrep via pip or use the official Docker image.

pip install semgrep

Run a scan

Run Semgrep on your codebase and output SARIF format.

semgrep scan --config auto --sarif -o results.sarif .

Push to servasec

Send the results to servasec via API.

curl -X POST "$SSC_PUBLIC_URL/api/ingest" \
  -H "X-Api-Token: $API_TOKEN" \
  -F "[email protected]"

What servasec adds to Semgrep

Trend analysis

Track how Semgrep findings evolve over time across releases.

Cross-scanner correlation

Correlate SAST findings with SCA and DAST results for a complete risk picture.

Team assignments

Assign findings to developers with due dates and track remediation progress.

Try Semgrep with servasec

Self-host servasec and connect Semgrep in minutes. AGPLv3 licensed, full data ownership.