Semgrep / OpenGrep Compatibility
Feature parity between xgrep's CLI and Semgrep / OpenGrep — subcommands, flags, output, and xgrep-only extras.
Semgrep / OpenGrep Compatibility
xgrep uses the Semgrep rule format and mirrors the Semgrep / OpenGrep CLI. OpenGrep is the open-source fork of Semgrep; it shares Semgrep's rule syntax and command surface, and is what xgrep tracks for parity, so the comparison columns below apply to both. File-selection behavior (git, ignore files, size limits) is covered in File filtering.
CLI subcommands
| Command | Semgrep / OpenGrep | xgrep | Status |
|---|---|---|---|
scan | scan <targets> | xgrep scan <targets> | ✅ Implemented |
| Root scan | <targets> | xgrep <targets> | ✅ Implemented |
--config / -f rules | Yes | Yes | ✅ Implemented |
--json output | Yes | Yes | ✅ Implemented |
--sarif output | Yes | Yes | ✅ Implemented |
test | --test | xgrep test <path> | ✅ Implemented |
validate | --validate | xgrep validate <path> | ✅ Implemented |
lsp | ❌ | xgrep lsp | xgrep-only |
mcp | ❌ | xgrep mcp | xgrep-only |
graph | ❌ | xgrep graph | xgrep-only |
ci | ci | ✅ | Diff-aware, CI-auto-detecting; no hosted-backend upload — see CI integration |
login / publish | login | ❌ | Not planned (SaaS) |
Output format
| Feature | Semgrep / OpenGrep | xgrep | Status |
|---|---|---|---|
| Banner with product info | Yes | Yes (ASCII art) | ✅ Implemented |
| Scan status tables | Language/Rules/Files + Origin | Language/Rules/Files + Origin | ✅ Implemented |
| Progress spinner | Yes | Yes (bubbletea) | ✅ Implemented |
| Colored findings | Yes | Yes (lipgloss) | ✅ Implemented |
| Severity markers | ❯❯❱ / ❯❱ / ❯ | ❯❯❱ / ❯❱ / ❯ | ✅ Implemented |
| Code snippets with line numbers | Yes | Yes | ✅ Implemented |
| Scan summary | Yes | Yes | ✅ Implemented |
| TTY detection (plain fallback) | Yes | Yes | ✅ Implemented |
--quiet flag | Yes | Yes | ✅ Implemented |
--verbose flag | Yes | Yes | ✅ Implemented |
--metrics reporting | auto / on / off | auto / on / off | ✅ Implemented |
| Warnings section | Yes | Yes (buffered during TUI) | ✅ Implemented |
See Output formats for text/JSON/SARIF details.
Scanning features
| Feature | Semgrep / OpenGrep | xgrep | Status |
|---|---|---|---|
| Pattern matching | Yes | Yes | ✅ Implemented |
| Taint analysis | Yes | Yes | ✅ Implemented |
--severity filter | Yes | Yes | ✅ Implemented |
--rule-id / --skip-rule | Yes | Yes | ✅ Implemented |
--autofix | Yes | Yes | ✅ Implemented |
--baseline-commit | Yes (diff-aware, changed-file limited) | Yes — accepts a ref or base..head range, limits the scan to changed files, line-level diffing | ✅ Implemented |
--jobs parallelism | Yes | Yes | ✅ Implemented |
| Per-rule timeout | Fixpoint timeout warnings | context.WithTimeout, 10 s + file-size scaling | ✅ Implemented |
--timeout (per-file) | Yes | Yes | ✅ Implemented |
--max-memory | Yes | Yes | ✅ Implemented |
| Join mode | Yes | Yes | ✅ Implemented |
| Extract mode | Yes | Yes | ✅ Implemented |
--lang override | Yes | Yes | ✅ Implemented |
Remote repo scanning (scan <url>) | Pro-only (--remote --pro) | Yes — clones with built-in git client | ✨ xgrep extension |
Target selection
How each tool decides which files to scan. xgrep favors completeness over speed-by-omission, with flags to opt into Semgrep-style filtering. See File filtering for the full behavior and rationale.
| Feature | Semgrep / OpenGrep | xgrep | Status |
|---|---|---|---|
Git-tracked files (git ls-files) | Default | Default | ✅ Implemented |
.gitignore respect | Yes | Yes (via git) | ✅ Implemented |
Ignore file (.xgrepignore/.semgrepignore) | Default (auto-load) | --xgrepignore flag | By design: opt-in |
| Default ignore patterns | Always on | --xgrepignore flag | By design: opt-in |
| Max file size (1 MB default) | --max-target-bytes (1 MB) | --max-target-bytes (unlimited) | By design: unlimited |
| Filesystem fallback (no git) | Yes | Yes | ✅ Implemented |
--include / --exclude globs | Yes | Yes | ✅ Implemented |
Rule compatibility
xgrep runs standard Semgrep / OpenGrep YAML rules unchanged. Rule-level test compliance against the OpenGrep suite is tracked internally.
xgrep-only features
| Feature | Description |
|---|---|
mode: analysis + analyzer: | Built-in native analyzers for checks too context-dependent for patterns (Semgrep treats it as an unknown mode) — see Analysis mode |
xgrep lsp | LSP server for IDE integration |
xgrep mcp | MCP server for AI agent integration |
xgrep graph | Code graph extraction (callers, callees, paths) |
context + remediation JSON | Always-on code context and fix guidance in JSON output |
--cpuprofile / --memprofile | Built-in profiling |
| OpenTelemetry | XGREP_ENABLE_TELEMETRY=1 for tracing and metrics |
| Per-function taint scoping | Taint analysis scoped to function boundaries |
| Comment-aware pre-checks | Skip patterns whose literals only appear in comments |