Semgrep

v0.0.2 · by Zeel Sheladiya · added 3 November 2026

Semgrep language server integration for Zed

Language servers

How to install

With Forge Super installed, the button above opens the app on this extension, where you press Install. Nothing is installed until you do.

You can also open the Extensions panel in the app and search for Semgrep. The extension's id is semgrep.

Don't have Forge Super yet? Download it here.

README

From the extension's repository, written by its authors and not by Mentenaz. See the source.

Semgrep for Zed

Semgrep language server integration for Zed.

Identify bugs and security issues in your code in real-time. This extension brings the power of semgrep lsp directly into your editor, offering zero-config usage and "Professional" defaults so you see findings immediately.

Features

Zero-Config Setup: Works out of the box.
- Automatically detects if semgrep is installed.
- Smart Defaults: Runs with configuration: ["auto"] and only_git_dirty: false so you see findings in all files immediately without needing a .semgrep.yml.
Real-time Diagnostics: Highlights bugs and security vulnerabilities as you type.
Full Configuration: Supports Zed's settings.json to override binary paths, environment variables, and scan rules.

Installation

Open Zed.
Press cmd-shift-x to open the Extensions view.
Search for Semgrep and click Install.

Note: The extension requires semgrep to be installed on your system. It will not install it for you.

Manual Installation (If needed)

If Semgrep is not found:

macOS: brew install semgrep
Linux/WSL: pip install semgrep (or check Semgrep Installation Docs)
Windows: Install via WSL or Pip, then configure the path in Zed settings.

Configuration

You can customize the extension in your Zed settings.json.

Recommended Settings

The extension uses sensible defaults, but you can override them.

{
  "lsp": {
    "semgrep": {
      "initialization_options": {
        "scan": {
          // Choose specific rulesets (defaults to ["auto"])
          "configuration": ["p/security-audit", "p/secrets"],
          // Set to true to only scan modified lines (less noise)
          "only_git_dirty": false
        }
      }
    }
  }
}

Advanced Settings (Binary Path)

If semgrep is in a non-standard location or you want to use a specific version:

{
  "lsp": {
    "semgrep": {
      "binary": {
        "path": "/path/to/custom/semgrep",
        "arguments": ["lsp", "--debug"],
        "env": {
          "SEMGREP_APP_TOKEN": "your-token-here"
        }
      }
    }
  }
}

Troubleshooting

"Semgrep not found"

If you see this error, it means semgrep was not found in your PATH.

Open a terminal.
Run semgrep --version to verify it's installed.
If not, run brew install semgrep or pip3 install semgrep.

No Underlines / Diagnostics?

Check the logs: Run zed: open log in the command palette.
Verify file type: Semgrep only scans supported languages (JS, TS, Python, Go, Java, etc.).
Check Rules: Ensure your configuration isn't empty. The default is auto, but if you have a local .semgrep.yml that matches nothing, you won't see results.

Contributing

Issues and Pull Requests are welcome!

Clone the repo.
Run cargo check to verify the Rust code.
Submit a PR.

License

MIT