SAST (Opengrep or Semgrep)
Pattern-based static analysis (SAST) for insecure code across many languages.
Why install it
Section titled “Why install it”Opengrep and Semgrep match rules against the syntax of the code rather than its text, so they find injection, unsafe deserialization, weak cryptography and similar flaws in most mainstream languages without building the project. This is the baseline SAST pass of a review. Opengrep is an open-source fork of Semgrep that reads the same rules. Argus runs Opengrep when it is installed and Semgrep otherwise, with the same built-in ruleset, and the report says which one ran.
At a glance
Section titled “At a glance”| Finds | SAST |
| Reads | Any language |
| Trust level | Safe on untrusted input |
| Official image | Included |
| Licence | LGPL-2.1-only |
| Argus tool | run_sast |
Install
Section titled “Install”The official Argus container image already ships SAST (Opengrep or Semgrep). Anywhere else, install one of these binaries on the daemon host. Argus runs the first one listed that it finds:
opengrep:curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bashsemgrep:brew install semgrep (or pip install semgrep)
For other platforms, follow the official install guide. Argus looks for scanners once, when the daemon starts: restart it after installing, and argus doctor shows SAST (Opengrep or Semgrep) as installed.