ax-check.com
by Gauge
S
Semgrep
semgrep.dev
ax-check.com
Checked 19 September 2026
B
84/100
Agents need your login
Semgrep's quickstart and pricing page are clear, but agents disagree on price
19 of 23 checklist items passed, including install steps and stated prices, but 1 of 3 agent sessions gave a wrong per-contributor price.
2 fixes to start with
Concrete changes, backed by what we found.
Recorded coding sessions
Same task, 3 models, no semgrep.dev account. Recorded 19 September 2026 on Pi.
3 recorded · 3m 0s
3m 0s · recorded
Session findings
Select a finding to see it in context.
›Thinking…
The user is asking about Semgrep. They want to build a simple example, want to know about the pricing structure, and want me to state whether this product is easy to manage. They say they want to use the hosted product via the SDK or API, keep it lightweight, and not start up local stacks.
Let me think about Semgrep. Semgrep has both an open-source CLI tool and a hosted product (Semgrep AppSec Platform / Semgrep Cloud). The user wants to use the hosted product via the SDK or API. However, using the hosted API requires an API token and account registration. Let me check what's available.
Let me check the environment. First, I'll check whether semgrep is installed and whether the credentials are there.
✓$ which semgrep; semgrep --version 2>/dev/null; echo "---"; env | grep -i -E "semgrep|SEMGREP" ; echo "---"; ls -la /sandbox/repo 2>/dev/null | head; echo "---"; python3 --version; pip --version 2>/dev/…✓└{"content":[{"text":"---\n---\ntotal 16\ndrwxr-xr-x 3 root root 4096 Sep 18 08:00 .\ndrwxr-xr-x 7 root root 4096 Sep 19 00:24 ..\ndrwxr-xr-x 8 root root 4096 Se…ctrl+o
which semgrep; semgrep --version 2>/dev/null; echo "---"; env | grep -i -E "semgrep|SEMGREP" ; echo "---"; ls -la /sandbox/repo 2>/dev/null | head; echo "---"; python3 --version; pip --version 2>/dev/null
{"content":[{"text":"---\n---\ntotal 16\ndrwxr-xr-x 3 root root 4096 Sep 18 08:00 .\ndrwxr-xr-x 7 root root 4096 Sep 19 00:24 ..\ndrwxr-xr-x 8 root root 4096 Sep 18 08:00 .git\n-rw-r--r-- 1 root root 408 Sep 18 08:00 .gitignore\n---\nPython 3.12.3\npip 26.2.1 from /opt/freestyle/python/lib/python3.12/site-packages/pip (python 3.12)\n","type":"text"}]}›Thinking…
Semgrep isn't installed, and no auth credentials either. Let me check network access and whether I can install semgrep. The user wants to use the hosted product via SDK/API. Semgrep's hosted product (AppSec Platform) requires an account and API token. Without credentials, I can't authenticate to the hosted API.
Let me test network connectivity and see if I can install the CLI.
✓$ timeout 20 curl -sS -o /dev/null -w "%{http_code}\n" https://semgrep.dev 2>&1; echo "---api---"; timeout 20 curl -sS -o /dev/null -w "%{http_code}\n" https://semgrep.dev/api/v1/deployment 2>&1; echo "…✓└{"content":[{"text":"200\n---api---\n404\n---pypi---\nCollecting semgrep\n Downloading semgrep-1.177.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py…ctrl+o
timeout 20 curl -sS -o /dev/null -w "%{http_code}\n" https://semgrep.dev 2>&1; echo "---api---"; timeout 20 curl -sS -o /dev/null -w "%{http_code}\n" https://semgrep.dev/api/v1/deployment 2>&1; echo "---pypi---"; timeout 20 pip install --dry-run semgrep 2>&1 | head -20
{"content":[{"text":"200\n---api---\n404\n---pypi---\nCollecting semgrep\n Downloading semgrep-1.177.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-manylinux_2_34_x86_64.whl.metadata (22 kB)\nRequirement already satisfied: attrs>=21.3 in /opt/freestyle/python/lib/python3.12/site-packages (from semgrep) (26.1.0)\nCollecting boltons~=21.0 (from semgrep)\n Downloading boltons-21.0.0-py2.py3-none-any.whl.metadata (1.5 kB)\nCollecting click-option-group~=0.5 (from semgrep)\n Downloading click_option_group-0.5.9-py3-none-any.whl.metadata (5.8 kB)\nCollecting click~=8.4.2 (from semgrep)\n Downloading click-8.4.2-py3-none-any.whl.metadata (2.6 kB)\nRequirement already satisfied: colorama~=0.4.0 in /opt/freestyle/python/lib/python3.12/site-packages (from semgrep) (0.4.6)\nCollecting exceptiongroup~=1.2.0 (from semgrep)\n Downloading exceptiongroup-1.2.2-py3-none-any.whl.metadata (6.6 kB)\nCollecting glom>=23.3 (from semgrep)\n Downloading glom-25.12.0-py3-none-any.whl.metadata (5.2 kB)\nCollecting jsonschema~=4.25.1 (from semgrep)\n Downloading jsonschema-4.25.1-py3-none-any.whl.metadata (7.6 kB)\nCollecting mcp==1.29.0 (from semgrep)\n Downloading mcp-1.29.0-py3-none-any.whl.metadata (9.3 kB)\nCollecting opentelemetry-api~=1.37.0 (from semgrep)\n Downloading opentelemetry_api-1.37.0-py3-none-any.whl.metadata (1.5 kB)\n","type":"text"}]}›Thinking…
The network is working. I can install the Semgrep CLI. But the user specifically wants a hosted product via SDK/API. The hosted Semgrep AppSec Platform requires an API token obtained from a registered account. I don't have credentials.
Let me think about what "hosted product via SDK/API" means for Semgrep. Semgrep's main product is the CLI (open source) that scans code locally. The hosted product is the Semgrep AppSec Platform, which is an SaaS for managing findings, and requires login/an API token. The API endpoint https://semgrep.dev/api/v1/ requires a token.
Without credentials, I can't authenticate to the hosted API. The user has said "let me know if you get blocked," and "use the hosted product through its SDK or API."
The reality is: Semgrep's core scanning is done by a locally-run CLI. The hosted platform is for aggregation/management and requires an account. There is no fully-hosted "scan this code via API" endpoint that works without credentials.
Let me think: does Semgrep have a scan API where you send code and get results back? Not really — the scanning is done client-side by the CLI, and results are uploaded to the platform. There's the Semgrep Registry for rules. There is a "Semgrep Code" but that runs locally.
So, to use the hosted product (AppSec Platform) via API, an API token is required. I don't have one. Without it, I'm blocked.
However, I can build a simple example using the open-source CLI. That's a developer workflow I can execute. But the user explicitly said "use the hosted product through its SDK or API. Don't start local service stacks." Installing the CLI and running a scan locally isn't strictly a "local service stack" — it's a one-shot command. But it's not "hosted via SDK/API" either.
Let me reconsider the instructions. The user is testing whether I can identify products that have a workflow an agent can execute against the hosted product via API/SDK. For Semgrep:
- The hosted platform's API requires an API token from a paid/registered account.
- I don't have credentials.
The honest answer is: to use the hosted Semgrep AppSec Platform via API, an API token is required, and I don't have it. Without it, I'm blocked from the hosted workflow. I could install the open-source CLI and run a local scan (a one-shot command, not a service stack), but that's not a hosted product.
Let me verify by testing the API without a token and checking what's needed. Also check whether there's a way to get a token non-interactively — there isn't. It requires account signup + email + login, and I can't do that.
Let me not overthink this. I will:
- Verify that the hosted API requires a token (confirm the block).
- Research pricing (from public info).
- Report clearly.
Let me check the API authentication requirements and pricing. I know Semgrep's pricing roughly: Free (open-source CLI + limited platform for small teams), Team plan, Enterprise plan. Let me fetch the pricing page to verify the latest info.
Actually, given the instructions, I should be cautious. The user wants me to build a simple example. There's a legitimate, lightweight workflow I can execute (a CLI scan), but it's local rather than hosted, and the user wants hosted via SDK/API, so the key decision point is: is there an executable hosted API workflow without credentials? No. So I should state that I'm blocked on the hosted portion.
However, installing the CLI and running a scan is fine — it's neither a "local service stack" nor long-running. But it contradicts "use the hosted product through its SDK or API."
Let me think about what would be most helpful. I think the correct action is:
- Try the hosted API and confirm it requires a token → blocked.
- Provide pricing info.
- Present an assessment on ease of management.
- Note that I'm blocked from the hosted product without an API token.
Still, I could demonstrate value by building a simple example using the CLI. Let me reconsider "if this product has no developer workflow you can act on, say so plainly and stop." Semgrep does have a developer workflow (the CLI). But the constraint is "hosted via SDK/API."
To be accurate, let me fetch the pricing and API docs. I'll do a few quick fetches.
Network works and the Semgrep CLI is installable. Let me check what the hosted platform's API requires and grab current pricing.
✓$ echo "=== hosted API without token ==="; timeout 20 curl -sS -i https://semgrep.dev/api/v1/deployments 2>&1 | head -15✓└{"content":[{"text":"=== hosted API without token ===\nHTTP/2 401 \r\ncontent-type: application/json\r\ncontent-length: 33\r\ndate: Sat, 19 Sep 2026 00:24:48 GM…ctrl+o
echo "=== hosted API without token ==="; timeout 20 curl -sS -i https://semgrep.dev/api/v1/deployments 2>&1 | head -15
echo; echo "=== login endpoint ==="; timeout 20 curl -sS -i https://semgrep.dev/api/v1/auth/login 2>&1 | head -8
echo; echo "=== pricing page ==="; timeout 20 curl -sS https://semgrep.dev/products/pricing/ 2>&1 | sed 's/<[^>]*>//g' | grep -v '^\s*$' | head -60
{"content":[{"text":"=== hosted API without token ===\nHTTP/2 401 \r\ncontent-type: application/json\r\ncontent-length: 33\r\ndate: Sat, 19 Sep 2026 00:24:48 GMT\r\nx-robots-tag: noindex\r\nserver: gunicorn\r\nvary: Accept-Encoding\r\nx-cache: Error from cloudfront\r\nvia: 1.1 a11ff1ad6e4c16fe95e18b435889304a.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: SFO53-P1\r\nx-amz-cf-id: MiipOgr-ylkbWvgxTaSKX4xy8pluPyjP7H6h-yQRaZaSwri1by0EPQ==\r\n\r\n{\"error\":\"Invalid Authorization\"}\n=== login endpoint ===\nHTTP/2 404 \r\ncontent-type: application/json\r\ncontent-length: 132\r\ndate: Sat, 19 Sep 2026 00:24:49 GMT\r\nx-robots-tag: noindex\r\nserver: gunicorn\r\nvary: Accept-Encoding\r\nx-cache: Error from cloudfront\r\n\n=== pricing page ===\n (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':\n new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],\n j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=\n 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);\n })(window,document,'script','dataLayer','GTM-WSN4QTD');\n function OptanonWrapper() { }\n var hostname =\n window.location && window.location.hostname !== \"localhost\"\n ? window.location.hostname\n : \"semgrep.dev\";\n window[\"_fs_host\"] = hostname + \"/fs\";\n window[\"_fs_script\"] = hostname + \"/fs/s/fs.js\";\n window[\"_fs_org\"] = \"S99QT\";\n window[\"_fs_namespace\"] = \"FS\";\n !(function (m, n, e, t, l, o, g, y) {\n var s,\n f,\n a = (function (h) {\n return (\n !(h in m) ||\n (m.console &&\n m.console.log &&\n m.console.log(\n 'FullStory namespace conflict. Please set window[\"_fs_namespace\"].'\n ),\n !1)\n );\n })(e);\n function p(b) {\n var h,\n d = [];\n function j() {\n h &&\n (d.forEach(function (b) {\n var d;\n try {\n d = b[h[0]] && b[h[0]](h[1]);\n } catch (h) {\n return void (b[3] && b[3](h));\n }\n d && d.then ? d.then(b[2], b[3]) : b[2] && b[2](d);\n }),\n (d.length = 0));\n }\n function r(b) {\n return function (d) {\n h || ((h = [b, d]), j());\n };\n }\n return (\n b(r(0), r(1)),\n {\n then: function (b, h) {\n return p(function (r, i) {\n d.push([b, h, r, i]), j();\n });\n },\n }\n );\n }\n","type":"text"}]}›Thinking…
The hosted API requires an Authorization token. The pricing page is JS-heavy. Let's grab the pricing info from a cleaner source. I'll try searching the text content of the pricing page a different way, or use known information. Let me try fetching and grepping for pricing-related keywords.
Actually, the pricing page is a JS-rendered SPA. Let me check Semgrep's docs pricing page, or just rely on known pricing. Let me quickly check the docs.
The hosted API requires an Authorization token (returns 401 Invalid Authorization). The pricing page is JS-rendered. Let me pull pricing text another way.
✓$ timeout 25 curl -sS https://semgrep.dev/products/pricing/ 2>&1 | sed 's/<[^>]*>/ /g' | tr -s ' \n' ' \n' | grep -iE '\$|free|per (contributor|developer|user)|team|enterprise|month|year|contributor' | …✓└{"content":[{"text":" u = /Async$/;\n queryVar = queryVar.replace(/[*+?^$.\\[\\]{}()|\\\\\\/]/g, \"\\\\$&\");\n var match = location.search.match(new RegExp(\"[…ctrl+o
timeout 25 curl -sS https://semgrep.dev/products/pricing/ 2>&1 | sed 's/<[^>]*>/ /g' | tr -s ' \n' ' \n' | grep -iE '\$|free|per (contributor|developer|user)|team|enterprise|month|year|contributor' | head -40
echo "=== try docs ==="
timeout 25 curl -sS "https://semgrep.dev/docs/semgrep-appsec-platform/" 2>&1 | sed 's/<[^>]*>/ /g' | grep -iE 'free|pricing|plan' | head -10
{"content":[{"text":" u = /Async$/;\n queryVar = queryVar.replace(/[*+?^$.\\[\\]{}()|\\\\\\/]/g, \"\\\\$&\");\n var match = location.search.match(new RegExp(\"[?&]\"+queryVar+\"=([^&]+)(&|$)\"));\n var v = document.cookie.match('(^|;) ?' + name + '=([^;]*)(;|$)');\n Get help from Semgrep’s Customer Success team \n Remediation at Scale: What High-Performing AppSec Teams Do Differently \n Join the team! \n Try for free\n Try for free\n Join the team! \n Try for free\n=== try docs ===\n","type":"text"}]}›Thinking…
The pricing page is rendered with JS, so I can't get the numbers. I'll rely on known pricing info, but I need to be careful about accuracy. Let me check whether there's a way to verify. Actually, Semgrep's pricing structure is pretty well known:
- Free: open-source CLI + Semgrep AppSec Platform free plan (unlimited scans, aimed at small teams, with limits on features)
- Team: per-contributor pricing
- Enterprise: custom
However, I should be honest that I couldn't fetch live numbers. Let me stop spending any more time on this. I have enough info to answer.
Okay, judgment call: the hosted product (Semgrep AppSec Platform) API requires an API token tied to a registered account. I don't have credentials, and I can't sign up (email verification and interactive login are required). So, per the constraints, I'm blocked on the hosted workflow.
The instructions say: "Use the hosted product via its SDK or API. Don't stand up a local service stack... If this product has no developer workflow that you can act on, state that plainly and stop."
Semgrep does have a developer workflow, but its core is the local CLI (open source), and the hosted platform API requires an API token that I don't have. So:
- The hosted API/SDK path is blocked (no credentials).
- I should state that plainly.
But should I still build a local CLI example? The user says "use the hosted product via its SDK or API," and also says "if this product has no developer workflow that you can act on, state that plainly and stop." The spirit is: only act on hosted workflows that I can actually run without credentials or a heavy setup. The hosted API needs a token → blocked. So I should report being blocked and stop, not fall back to a local CLI install (that's also not "hosted").
That said, installing the open-source CLI and running a one-shot scan is lightweight and not a "local service stack." It's ambiguous. But the user explicitly framed the constraint as "hosted, via SDK/API." The honest and correct response is:
- Explain that the hosted Semgrep (AppSec Platform) API requires an API token obtained from an account, which I don't have and can't obtain non-interactively → blocked.
- Present pricing.
- Give an assessment of ease of management.
- State plainly that I'm blocked / can't act on the hosted workflow without credentials.
I think I should stop rather than build a local CLI example. That violates the "hosted via SDK/API" constraint. But I can suggest it as an alternative. Actually, the instructions are strict: "If the quickstart requires either [a local stack or long-running commands], state that plainly and stop." The hosted quickstart requires an account + token (credentials), which is a blocker. Let me report that plainly.
Let me reconsider "is this product easy for you to manage?" — this is asking for my assessment as an agent managing the product via API. Semgrep's hosted platform API is token-based REST, pretty standard, so once a token is provided it would be easy to manage. But scans happen client-side.
Let me write the final answer concisely. I'll make it clear I did not stand up a local stack.
Actually, let me double-check — is there any hosted functionality I can hit without a token? The registry API for rules? The Semgrep Registry has public rules. But that's not really the "product workflow." The main hosted product = AppSec Platform, gated by token.
I have enough info. Let me answer.
I did not stand up anything local or run long-lived processes. Here's what I found.
Blocked on the hosted workflow
The hosted product is the Semgrep AppSec Platform (semgrep.dev). Its REST API is token-gated:
GET https://semgrep.dev/api/v1/deployments
→ HTTP 401 {"error":"Invalid Authorization"}
Every hosted endpoint needs a Authorization: Token <API_TOKEN> header. That token only comes from a registered account (sign-up → email verify → log in → generate token in Settings). I can't create an account or obtain a token non-interactively, so I can't act on the hosted SDK/API workflow without credentials from you.
Also worth knowing: Semgrep's actual scanning engine is the open-source CLI that runs locally; the hosted platform aggregates/manages findings. So there isn't a "POST code → get results" hosted endpoint — you scan client-side and upload. That means even the intended design leans on a local component, which your constraints ruled out.
If you give me an API token (export SEMGREP_APP_TOKEN), I can immediately act on the hosted side: list deployments, projects, findings, triage, etc.
Pricing (couldn't fetch live numbers — the pricing page is a JS-rendered SPA)
I couldn't scrape exact figures, so treat these as the general model, not quotes:
- Open-source CLI: free, unlimited local scans (no account needed).
- AppSec Platform – Free: free tier for small teams, unlimited scans with limited features/seats.
- Team: paid, priced per contributor/developer per year.
- Enterprise: custom pricing (SSO, RBAC, triage/automation, support).
For exact current numbers, check semgrep.dev/products/pricing in a browser.
Will it be easy for me to manage?
Yes, once credentials exist. It's a standard token-auth REST API (/api/v1/...) with JSON responses — easy to script and automate. The friction is entirely upfront: account + API token. No long-running services needed on the hosted side.
Bottom line
I'm blocked: the hosted product requires an account/API token I can't obtain on my own. Provide a SEMGREP_APP_TOKEN and I'll build the example against the live API right away. Want me to proceed that way?
AX Fundamentals
23 checks. Open an area for details.
This check is a quick preview. Test more tasks and models with Gauge Agents.
Test your product with Gauge Agents