How Semgrep’s scores are calculated

The full audit trail, recomputed from the verdict data at build time through the same code that produced the leaderboard: verdict × quality × story weight per cell, cells sum to dimension scores, dimensions blend into the PA Score. Every number on the product page is reproducible from this page alone; for why the formula looks like this, see the methodology.

verdict factors: full ×1.0 · partial ×0.6 · disputed ×0.3 · none ×0.0 · n/a excluded from both sides · cell points = weight × quality × factor · cell max = weight × 10

PA Score30/100

Agent-ready 37.5 × 0.30 = 11.25

API quality 0.0 × 0.20 = 0.00

Openness 40.8 × 0.20 = 8.16

Built-in AI 28.7 × 0.15 = 4.30

Automation 43.5 × 0.15 = 6.52

(11.25 + 0.00 + 8.16 + 4.30 + 6.52) ÷ (0.30 + 0.20 + 0.20 + 0.15 + 0.15) = 30.24 ÷ 1.00 = 30.2

Scores are stored to 1 decimal; the product page’s pills round to whole numbers for display. Each dimension below shows the stories, verdicts, and cited evidence behind its number.

Agent-ready37.5/100×0.30 of the PA blend

Outside-in: can YOUR agent reach and drive this product — API, MCP, CLI, headless runs, agent docs.

Point an agent at llms.txt or agent-oriented docsweight 2

2 (weight) × 8 (quality) × 1.0 (full) = 16.0 of 20 max

[probe] https://docs.semgrep.dev/llms.txt“PROBE llms.txt: HTTP 200 at https://docs.semgrep.dev/llms.txt # Semgrep ## Home - [Semgrep Docs](https://docs.semgrep.dev/index.md): Get started with Semgrep to help you catch, fla”
[claimed-docs] https://docs.semgrep.dev/_llms/scan-with-semgrep.md“scan your first project, which can be any codebase, repository, or folder within a monorepo, for security issues, and view your findings”
[claimed-docs] https://docs.semgrep.dev/for-developers/cli.md“You can run local Semgrep CLI scans with the Semgrep command-line tool.”
[probe] https://docs.semgrep.dev/getting-started/cli“official CLI documented at https://docs.semgrep.dev/getting-started/cli”

Run the product headlessly / in CI for automationweight 2

2 (weight) × 9 (quality) × 1.0 (full) = 18.0 of 20 max

[claimed-docs] https://docs.semgrep.dev/getting-started/quickstart“navigate to the root of your project, and run your first scan: semgrep ci”
[claimed-docs] https://docs.semgrep.dev/deployment/add-semgrep-to-ci“This guide walks you through creating a Semgrep job in the following CI providers, which are explicitly supported in Semgrep AppSec Platform”
[claimed-docs] https://docs.semgrep.dev/deployment/add-semgrep-to-ci“your development cycle benefits from the automated scanning of repositories at various events, such as: Push events; Pull requests or merge requests”
[claimed-docs] https://docs.semgrep.dev/deployment/add-semgrep-to-ci“Semgrep is integrated into CI environments by creating a **job** that is run by the CI provider. After a scan, findings are sent to Semgrep AppSec Platform for triage and remediation.”
[claimed-docs] https://docs.semgrep.dev/extensions/pre-commit“The pre-commit framework can run semgrep when you commit changes. This is helpful in preventing secrets and security issues from leaking into your Git history.”
[claimed-docs] https://docs.semgrep.dev/for-developers/cli.md“The `--dry-run` flag ensures that your scans are not uploaded to the Semgrep web app.”
[claimed-docs] https://docs.semgrep.dev/for-developers/cli.md“You do **not** need to be logged in to run a scan.”
[claimed-docs] https://docs.semgrep.dev/getting-started/cli“To export the results to a SARIF file: semgrep ci --sarif --sarif-output=semgrep.sarif”
[claimed-docs] https://docs.semgrep.dev/semgrep-appsec-platform/semgrep-api“Semgrep AppSec Platform provides an API that enables you to list deployments, gather findings created by Semgrep”
[community] https://news.ycombinator.com/item?id=43054673“Built a tool using Semgrep's SARIF output plus prompted LLMs to help prioritize triage; used at Microsoft for the past year to help surface the 'most likely interesting' 5% of a large result set for human review - works quite well.”
[community] https://news.ycombinator.com/item?id=23919313“We've used Semgrep for Zulip's Python codebase for months and really appreciate the semantic checks, especially for security lint rules - it removes the hacky regex feel. Main complaint is performance: too slow per-rule to replace our whole-codebase regex-based linter (~100 rules).”

Plug MCP servers into this product so it can use their toolsweight 3

3 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 30 max

[probe] https://docs.semgrep.dev/mcp“official MCP server documented at https://docs.semgrep.dev/mcp”
[claimed-docs] https://docs.semgrep.dev/semgrep-appsec-platform/semgrep-api“Semgrep AppSec Platform provides an API that enables you to list deployments, gather findings created by Semgrep”
[claimed-docs] https://docs.semgrep.dev/semgrep-appsec-platform/semgrep-api“Semgrep AppSec Platform provides an API that enables you to list deployments, gather findings created by Semgrep AppSec Platform, and list projects.”

Connect an agent via an official MCP serverweight 3

3 (weight) × 6 (quality) × 1.0 (full) = 18.0 of 30 max

[probe] https://docs.semgrep.dev/mcp“official MCP server documented at https://docs.semgrep.dev/mcp”

Use an official CLIweight 2

2 (weight) × 8 (quality) × 1.0 (full) = 16.0 of 20 max

[claimed-docs] https://docs.semgrep.dev/getting-started/quickstart“pipx install semgrep # preferred: install through uv (https://docs.astral.sh/uv/) uv tool install semgrep”
[claimed-docs] https://docs.semgrep.dev/getting-started/cli“semgrep scan - This is the recommended command for scanning local codebases or scanning a project when you don't have a Semgrep account”
[claimed-docs] https://docs.semgrep.dev/getting-started/quickstart“navigate to the root of your project, and run your first scan: semgrep ci”
[claimed-docs] https://docs.semgrep.dev/for-developers/cli.md“The `--dry-run` flag ensures that your scans are not uploaded to the Semgrep web app.”
[claimed-docs] https://docs.semgrep.dev/for-developers/cli.md“You do **not** need to be logged in to run a scan.”
[claimed-docs] https://docs.semgrep.dev/getting-started/cli“To export the results to a SARIF file: semgrep ci --sarif --sarif-output=semgrep.sarif”
[probe] https://docs.semgrep.dev/getting-started/cli“official CLI documented at https://docs.semgrep.dev/getting-started/cli”
[community] https://news.ycombinator.com/item?id=23919313“We've used Semgrep for Zulip's Python codebase for months and really appreciate the semantic checks, especially for security lint rules - it removes the hacky regex feel. Main complaint is performance: too slow per-rule to replace our whole-codebase regex-based linter (~100 rules).”

Drive the product through a documented public APIweight 3

3 (weight) × 6 (quality) × 0.6 (partial) = 10.8 of 30 max

[claimed-docs] https://docs.semgrep.dev/semgrep-appsec-platform/semgrep-api“Semgrep AppSec Platform provides an API that enables you to list deployments, gather findings created by Semgrep AppSec Platform, and list projects.”
[claimed-docs] https://docs.semgrep.dev/semgrep-appsec-platform/semgrep-api“Semgrep AppSec Platform provides an API that enables you to list deployments, gather findings created by Semgrep”
[probe] https://docs.semgrep.dev/openapi.json“PROBE openapi: all candidate paths 404 (https://docs.semgrep.dev/openapi.json, https://docs.semgrep.dev/swagger.json, https://docs.semgrep.dev/api/openapi.json, https://docs.semgrep.dev/.well-known/openapi.json)”

Issue scoped/least-privilege API credentials for an agentweight 2