Semgrep Assistant
AI triage and autofix for Semgrep findings — false-positive filtering and one-click remediations in PRs.
About
Semgrep Assistant is the AI layer on top of Semgrep's code scanning, generally available since 2024. It auto-triages findings (users agree with its triage ~96% of the time per Semgrep), filters noise and false positives from PR comments, writes step-by-step remediation guidance, and generates autofixes — suggested code patches developers can commit directly from the PR. It can also auto-write custom Semgrep rules tailored to a codebase, which Semgrep says has doubled fix rates for customers using it.
The honest picture: it requires the Semgrep AppSec Platform (the paid/Team tier), not just the OSS CLI — the free scanner alone gets you none of this. Enabling it means sending code snippets to AI models, which needs security-team sign-off in regulated environments. And like all AI triage, its judgment is probabilistic: teams should spot-check auto-ignored findings rather than trusting them blindly.
What it can do
- AI auto-triage of security findings
- False-positive noise filtering in PR comments
- AI-written autofix code suggestions committable from PRs
- Step-by-step remediation guidance per finding
- Auto-generation of custom Semgrep rules
- Component tagging to surface high-priority issues
Setup
Enable in the Semgrep AppSec Platform under General > Assistant; connect your GitHub/GitLab org via the semgrep-app integration.
Prerequisites
Semgrep AppSec Platform (Team tier or above); a connected source-code manager.
Use cases
Works with
Trust score — 7/10
Scored 7/10 (metrics tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 56; Trending score 70/100 from researcher assessment.
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.