Scanning
Supported Languages
Languages with full tree-sitter AST matching, and those matched with regex patterns.
Supported Languages
This page is the raw parser/extension matrix. For what xgrep actually detects in each language — the vulnerability classes, frameworks, and taint coverage — see SAST by language.
Tree-sitter languages (full AST matching)
| Language | Extensions |
|---|---|
| Python | .py, .pyi |
| Go | .go |
| Java | .java |
| JavaScript | .js, .jsx, .mjs, .cjs |
| TypeScript | .ts |
| TSX | .tsx |
| Ruby | .rb |
| PHP | .php |
| C | .c, .h |
| C++ | .cc, .cpp, .cxx, .hpp |
| C# | .cs |
| Rust | .rs |
| Kotlin | .kt, .kts |
| Scala | .scala, .sc |
| Bash | .sh, .bash, .zsh |
| Lua | .lua |
| Julia | .jl |
| OCaml | .ml, .mli |
| HTML | .html, .htm, .vue |
| JSON | .json |
| YAML | .yaml, .yml |
| XML | .xml |
| HCL | .tf, .hcl |
| Dockerfile | Dockerfile |
| Swift | .swift |
Regex-only languages
Solidity, Dart, R, Clojure, Elixir, Erlang, Scheme, Lisp, and generic/text files are matched using regex patterns. AST-specific features (precise structural matching, typed metavariables) are unavailable for these.