Apps similar to Semgrep include SonarQube, which is open source with a free version. Other options are Codacy, Shellcheck, Cppcheck and Coverity Scan. Code Reviews like Semgrep are a crowded field, with more than 25 alternatives for the web, Windows, Linux, Mac and self-hosting.
Exlint is a an open source project that enables developers to centralize their open source coding standards and policies, so that configuring repositories becomes as easy as typing one command.
Israel
Kiuwan Application Security is an end-to-end Appsec platform. Monitoring, action plans and seamless integration within unlocalized teams are but a few of the features offered by Kiuwan.
nittim scans a GitHub repository for committed secrets and vulnerable dependencies for free, then runs a full security audit that returns findings with evidence and a fix for each. It runs inside Cursor, Claude Code, Windsurf, Codex and Copilot through MCP, or from the web.
DefenseCode ThunderScan® is a SAST (Static Application Security Testing, WhiteBox Testing) solution for performing deep and extensive security analysis of application source code.
United Kingdom
Code Buster reports dependency wiring, dead code, cycles, duplication, complexity, architecture-policy violations, feature flags, security and style heuristics, quality scores, and remediation plans.
AI-powered code review and release management: security and compliance scanning, documentation generation, and observability instrumentation, from PR to production.
Qodana is a smart code quality platform by JetBrains best suited for working in teams. It can analyze code written in 60+ languages including Java, JavaScript, TypeScript, PHP, Kotlin, Python, Go, and C#.
Vettalon helps developers inspect source code and dependencies, keep candidate findings under review, and export JSON or SARIF for follow-up. The Apache-2.0 CLI combines available local scanners with optional AI audit and review through model providers you choose.
Improve quality, reduce risk, and ship with confidence. GrammaTech's static analysis SAST tool as part of your secure SDLC identifies bugs that can result in system crashes, unexpected behavior, and security breaches.
United States
Norma is an AI code governance tool for developers using coding agents. It connects to MCP-capable editors such as Cursor, Claude Code, Windsurf, Replit, Lovable and VS Code, and serves an organization's rules to the agent while code is being written.
Code Inspector is a platform that helps developers and managers to deliver better code. Main features:
Parasoft’s C/C++test is the fully-integrated software testing solution for embedded safety-critical industries. Its automated software testing capabilities are also made for today’s high-velocity Agile DevOps environments.
Czechia
EU
Taiwan
