Architecture

Semgrep (Semantic Grep) is a multi-language static analysis tool that matches code by its structure – not just its text – using a unified Abstract Syntax Tree and a rich pattern language. This document covers the full internal architecture from CLI entry-point to taint sink detection.

Table of Contents

0. Introduction
   • What is SAST?
   • History of Semgrep
1. High-Level Architecture
2. Component Breakdown
3. The Full Analysis Pipeline
4. Target Discovery & Filtering
5. Rule Parsing & Optimization
6. Parsing & the Universal AST
7. The Matching Engine
8. The Intermediate Language (IL) & CFG
9. Taint Analysis (Dataflow)
10. Output & Reporting Pipeline
11. OSemgrep / RPC Architecture
12. Key Data Structures

-1. Why?

I have been working as a DevSecOps engineer for nearly four years now. When I started, I had little exposure to tooling like SAST, SCA, or DAST. My mindset was firmly rooted in offensive security. Penetration testing was the goal, the dream.