# AX Check: semgrep.dev Checked 2026-09-19. Semgrep's quickstart and pricing page are clear, but agents disagree on price 19 of 23 checklist items passed, including install steps and stated prices, but 1 of 3 agent sessions gave a wrong per-contributor price. ## Onboarding needs a login ## Coding sessions All three sessions completed and reviewed pricing. Two cited concrete figures from the pricing page (one matching the stated $30/contributor/month, one reporting a different ~$40 figure), while the third gave only generic tier names and said it could not confirm live numbers. ### DeepSeek V4 Pro [View public run](https://agents.withgauge.com/p/runs/884f95e6-2904-45c8-b3cc-2646f18b6050) · [Read transcript](https://www.ax-check.com/semgrep.dev/sessions/deepseek.json) Final output cites semgrep.dev/pricing (fetched at seq 18) with Free/$30-per-contributor/Enterprise tiers, per-contributor billing basis, and a caveat to confirm seat/billing terms. #### End-to-end onboarding - **Onboarding needs a login**: Agent never obtained real Semgrep credentials during the session. It only had a PI_GATEWAY_API_KEY (unrelated internal env var) and confirmed the hosted API requires a bearer token it did not have. All actual product usage was the locally-installed OSS CLI running fully offline with a custom local rules file — no authenticated call to the hosted Semgrep platform was made or succeeded. Event 9: ```text PI_GATEWAY_API_KEY= ``` Event 32: ```text {"error":"Invalid Authorization"}code=401 ``` Event 58: ```text I confirmed `GET https://semgrep.dev/api/v1/deployments` returns `401 Invalid Authorization` without a token. ``` Event 58: ```text cloud features (dashboard triage, persistent findings, fingerprints, PR comments) would require you to give me a `SEMGREP_APP_TOKEN` from an account's Settings → Tokens. ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **No credentials for Semgrep's hosted API**: The agent tried the hosted deployments endpoint and got a 401 because it had no SEMGREP_APP_TOKEN. This is a missing-credentials limitation, not a product defect — the hosted API is expected to require an authenticated token, and creating one needs a human to sign up and generate it from account settings. Event 32: ```text {"error":"Invalid Authorization"}code=401 ``` Event 58: ```text I confirmed `GET https://semgrep.dev/api/v1/deployments` returns `401 Invalid Authorization` without a token. ``` - **pip-installed semgrep binary not on PATH**: After `pip install semgrep` completed successfully, the `semgrep` command was not found on PATH; the agent had to locate the binary at /opt/freestyle/python/bin/semgrep and invoke it by full path for the rest of the session. This is an environment/agent-side installation quirk rather than a Semgrep product issue, and it was fully worked around. Event 20: ```text EXIT=0 /bin/bash: line 1: semgrep: command not found ``` Event 25: ```text -rwxr-xr-x 1 root root 198 Sep 19 00:26 /opt/freestyle/python/bin/semgrep ``` #### Suggested Changes - **Ensure pip install of semgrep places the binary on default PATH**: Running `pip install --quiet semgrep` in this environment installed the package but left the semgrep executable unreachable via the plain `semgrep` command, forcing a manual path lookup (/opt/freestyle/python/bin/semgrep). Check this by running `pip install semgrep && semgrep --version` in a fresh shell matching common CI/sandbox setups and confirming the command resolves without extra PATH edits. Event 20: ```text /bin/bash: line 1: semgrep: command not found ``` Event 25: ```text Location: /opt/freestyle/python/lib/python3.12/site-packages ``` - **Clarify in docs that fingerprint/lines fields require a logged-in account**: Local OSS `semgrep scan --json` returns the literal string "requires login" for the fingerprint and lines fields instead of omitting them or linking to an explanation. Update the CLI/API output or nearby quickstart docs to state plainly that these fields populate only after authenticating with a SEMGREP_APP_TOKEN, so users running the free CLI are not confused by the placeholder text. Verify by re-running the same scan after login and confirming real values appear. Event 51: ```text "fingerprint":"requires login","lines":"requires login" ``` ### Kimi K3 [View public run](https://agents.withgauge.com/p/runs/3aa244fb-36a5-42b2-ab30-e8a646e5cc0d) · [Read transcript](https://www.ax-check.com/semgrep.dev/sessions/kimi.json) Final output states Community CLI is free, Team/Enterprise is ~$40/contributor/month, and explicitly names the pricing basis (per-contributor, not per-repo/scan) plus free tier limit (10 contributors). #### End-to-end onboarding - **End-to-end onboarding not demonstrated**: Agent never attempted to obtain or use hosted Semgrep credentials (no API token, no login to semgrep.dev, no `semgrep ci` upload). It explicitly chose a fully offline workflow with local custom rules and a local scan target, avoiding any authenticated interaction with the hosted Semgrep AppSec Platform. No credentials were requested, obtained, or used, so there is no operation to verify. Event 32: ```text Now I'll create the example — a small vulnerable Python app and a local YAML ruleset (fully offline, no registry login or services needed). ``` Event 47: ```text the hosted platform features (dashboard, org policies, `semgrep ci` uploads) require an account token I don't have, and registry rulesets (`--config p/...`) need network access to the registry — neither was needed for a working demo. ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **pip install of semgrep timed out twice before succeeding**: Test-environment friction, not a product defect: the first `pip3 install -q semgrep` call timed out at 180s, and a retry took nearly 5 minutes before completing. This is attributable to sandbox network/install speed rather than Semgrep itself, and the agent worked around it by retrying with a longer timeout. Event 13: ```text Command timed out after 180 seconds ``` Event 22: ```text EXIT=0 /bin/bash: line 1: semgrep: command not found Command exited with code 127 ``` - **Installed semgrep binary not on default PATH**: Agent error / environment quirk: after pip install succeeded, the `semgrep` executable was not resolvable until the agent manually located it and prepended `/opt/freestyle/python/bin` to PATH. This was self-resolved and did not block the final demo. Event 26: ```text /opt/freestyle/python/bin/semgrep ``` Event 47: ```text `pip install semgrep` landed the binary in `/opt/freestyle/python/bin`, which isn't on this environment's default PATH — prepend it (as I did) or use the full path. ``` - **No hosted product workflow exercised**: Agent-chosen scope limitation: the agent deliberately avoided any hosted Semgrep workflow (dashboard, org policies, `semgrep ci` uploads, or registry rulesets like `--config p/python`) because those require an account token and network access to the registry, neither of which were pursued or available in-session. Event 47: ```text the hosted platform features (dashboard, org policies, `semgrep ci` uploads) require an account token I don't have, and registry rulesets (`--config p/...`) need network access to the registry — neither was needed for a working demo. ``` #### Suggested Changes - **Add semgrep CLI PATH note to install docs**: On the Semgrep CLI installation/quickstart page, note that `pip install semgrep` can place the binary in a non-default bin directory (observed here as /opt/freestyle/python/bin) depending on the Python environment, and instruct users to verify with `which semgrep` or add the relevant bin dir to PATH. Check by running a fresh `pip install semgrep` in a minimal container and confirming `semgrep --version` works without manual PATH edits. Event 47: ```text `pip install semgrep` landed the binary in `/opt/freestyle/python/bin`, which isn't on this environment's default PATH — prepend it (as I did) or use the full path. ``` ### Qwen 3.8 Max [View public run](https://agents.withgauge.com/p/runs/15c4d0a3-2e27-4c75-9b32-dfbe3faf9712) · [Read transcript](https://www.ax-check.com/semgrep.dev/sessions/qwen.json) Final output gives only generic tier names (Free/Team/Enterprise, 'priced per contributor/developer per year') and explicitly says it 'couldn't fetch live numbers' — no concrete cost figure is ever stated, so there's nothing with assumptions attached. #### End-to-end onboarding - **Onboarding needs a login**: Agent never obtained real Semgrep credentials. It probed the hosted API without a token, got a 401 Invalid Authorization, and concluded a token requires interactive sign-up (account + email verification + login + generate token in Settings), which it could not do non-interactively. No authenticated operation against the hosted product was ever performed. Event 13: ```text HTTP/2 401 content-type: application/json content-length: 33 ... {"error":"Invalid Authorization"} ``` Event 20: ```text That token only comes from a registered account (sign-up → email verify → log in → generate token in Settings). I can't create an account or obtain a token non-interactively, so **I can't act on the hosted SDK/API workflow without credentials from you.** ``` Event 20: ```text If you give me an API token (export `SEMGREP_APP_TOKEN`), I can immediately act on the hosted side: list deployments, projects, findings, triage, etc. ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **Hosted Semgrep API requires an account-issued token**: The hosted AppSec Platform's REST API rejected unauthenticated requests with a 401, and creating an account/token requires interactive email verification and login in a browser — steps the agent could not perform on its own. This is a normal authentication requirement, not a product defect, and it stopped the agent from building any hosted-API example. Event 13: ```text {"error":"Invalid Authorization"} ``` Event 20: ```text I can't create an account or obtain a token non-interactively, so **I can't act on the hosted SDK/API workflow without credentials from you.** ``` - **Semgrep's core scanning happens locally, not via a hosted call**: The agent determined that Semgrep's actual scan engine is a CLI meant to run against local code, with the hosted platform only aggregating uploaded results — meaning a pure 'call the hosted API to scan code' workflow doesn't exist. Combined with the session's rule against starting local service stacks, this left no lightweight hosted-only path to demonstrate scanning. Event 20: ```text Semgrep's actual scanning engine is the open-source **CLI that runs locally**; the hosted platform aggregates/manages findings. So there isn't a "POST code → get results" hosted endpoint — you scan client-side and upload. ``` - **Pricing page is a JS-rendered SPA, blocking plain-text scraping**: Fetching the pricing page via curl returned only tracking/analytics script boilerplate instead of plan details, because the page renders pricing client-side with JavaScript. This is a test-environment limitation (no browser/JS execution available) rather than a product API defect, and it forced the agent to report only generic, unverified pricing tiers. Event 18: ```text queryVar = queryVar.replace(/[*+?^$.\[\]{}()|\\\/]/g, "\\$&"); ``` Event 20: ```text I couldn't scrape exact figures, so treat these as the general model, not quotes ``` #### Suggested Changes - **Expose plan pricing in a static, scriptable format**: On semgrep.dev/products/pricing, the tier names and prices are only rendered via client-side JavaScript, so a plain HTTP GET (curl) returns no pricing text. Adding a static HTML fallback, a JSON pricing endpoint, or server-side rendering for that page would let automated tools and non-browser clients read current pricing. Verify by running curl against the pricing URL and confirming plan names/prices appear in the raw response body. Event 18: ```text timeout 25 curl -sS https://semgrep.dev/products/pricing/ ``` - **Document a non-interactive path to a hosted API token**: The hosted API at /api/v1/deployments returns 401 Invalid Authorization with no guidance on how to obtain a token without an interactive browser sign-up/login flow. Adding a documented CLI or API-based token-provisioning method (e.g., a signup endpoint or CLI command that returns a token) would let automated/CI users self-serve credentials. Verify by scripting the documented flow end-to-end and confirming a usable SEMGREP_APP_TOKEN is returned without manual browser steps. Event 20: ```text That token only comes from a registered account (sign-up → email verify → log in → generate token in Settings). ``` ### Task given to each agent Help me build a simple example using Semgrep. Tell me how pricing works, and briefly tell me whether this product will be easy for you to manage. Let me know if you get blocked. If this product has no developer workflow you can act on, say so plainly and stop. Stay light: use the hosted product through its SDK or API. Do not start local service stacks or wait for long-running commands; if the quickstart requires either, say so plainly and stop. No product credentials were supplied and no purchases were authorized. ## Score: B · 84/100 (provisional) Grades come from completed site checks. Coding sessions and skipped checks do not affect the score. ### Clarity - **Failed** — Homepage answers Markdown requests ```text Homepage returned text/html for a text/markdown request; no Markdown representation offered. ``` - **Pass** — llms.txt provides an actionable documentation index ```text llms.txt lists docs, API docs, rule registry, GitHub repo and MCP server as starting points. ``` - **Pass** — llms.txt provides navigation guidance ```text llms.txt groups links under Documentation and MCP headings, giving clear navigation. ``` - **Pass** — llms.txt mentions offered API, MCP, and skills ```text llms.txt links API docs and the official MCP server; no skills surface offered. ``` - **Pass** — A compact guide representation exists ```text Quickstart is published as standalone Markdown at docs.semgrep.dev/getting-started/quickstart.md. ``` - **Pass** — A focused guide is directly retrievable ```text Markdown quickstart fetched directly with install, login and scan steps. ``` - **Pass** — Equivalent instructions fit a token budget ```text Markdown quickstart is 1892 tokens, well under the 8000-token budget. ``` - **Skipped** — Product-docs links survive format changes ```text Homepage Markdown unsupported, so link preservation across formats cannot be measured. ``` - **Pass** — The compact guide is independently actionable ```text Quickstart gives concrete steps: install via pipx/uv, semgrep login, semgrep ci, view findings. ``` - **Pass** — Install and next-step links resolve ```text Fetched quickstart, API reference, OpenAPI spec, and MCP repo all resolved successfully. ``` ### Onboarding - **Pass** — Docs lead to a relevant quickstart ```text Quickstart page gives concrete setup, install, login, and first-scan steps. ``` - **Pass** — Installation commands are extractable ```text Install commands shown: pipx install semgrep, uv tool install semgrep, brew install semgrep. ``` - **Pass** — Code examples are available without interaction ```text Bash, PowerShell, and Docker code blocks render inline without interaction. ``` - **Pass** — Prerequisites and auth boundaries are explicit ```text Python 3.10 prerequisite and semgrep login/account auth boundary stated explicitly. ``` ### Pricing - **Failed** — Agents identify pricing and its assumptions ```text 3 of 3 sessions were judged on pricing; 1 fell short. DeepSeek V4 Pro: Final output cites semgrep.dev/pricing (fetched at seq 18) with Free/$30-per-contributor/Enterprise tiers, per-contributor billing basis, and a caveat to confirm seat/billing terms. Kimi K3: Final output states Community CLI is free, Team/Enterprise is ~$40/contributor/month, and explicitly names the pricing basis (per-contributor, not per-repo/scan) plus free tier limit (10 contributors). Qwen 3.8 Max: Final output gives only generic tier names (Free/Team/Enterprise, 'priced per contributor/developer per year') and explicitly says it 'couldn't fetch live numbers' — no concrete cost figure is ever stated, so there's nothing with assumptions attached. This behavioural item does not affect the fast grade. ``` - **Pass** — Pricing is readable without interaction ```text Pricing page renders all plan tiers and prices as static text without interaction. ``` - **Pass** — Prices are stated, not gated ```text Free, Teams $30/month/contributor, and Enterprise custom prices are stated openly. ``` - **Pass** — Pricing units and limits are explicit ```text Units and limits explicit: per contributor, 10 repos, 10 contributors, AI credits. ``` ### Activation - **Pass** — An API reference or OpenAPI spec is reachable ```text API v1 docs state OpenAPI format and link a downloadable public_v1.openapi.yaml spec. ``` - **Pass** — An MCP server is documented and well-formed ```text llms.txt links official MCP server; README documents tools, transports, and uvx/docker install. ``` - **Pass** — A CLI install path is documented ```text Quickstart and CLI guide document pipx/uv/brew install and semgrep ci/scan usage. ``` - **Pass** — SDK packages resolve on their registries ```text semgrep-mcp is published on PyPI and installable via pipx/uvx per README. ``` - **Skipped** — Agent skills are published ```text No agent skills surface is offered or documented in the fetched Semgrep pages. ``` [Full report data](https://www.ax-check.com/semgrep.dev/report.json)