Opengrep SAST

Purpose

Opengrep is a fully free, self-hostable deep SAST engine (a community fork of Semgrep). It complements SonarQube where Sonar is weakest: custom, organization-specific source→sink taint rules expressed as YAML. SonarQube runs a fixed, vendor-controlled ruleset; Opengrep lets the team encode their own anti-patterns (e.g. "a tainted request parameter must never reach our internal exec() wrapper", "forbidden internal API X is called").

It is the chosen free SAST complement. No separate Semgrep CE skill exists — Opengrep is the superset (it restores intra-file cross-function taint that Semgrep's free tier removed). If the organization already pays for GitHub Advanced Security, CodeQL offers deeper global cross-file analysis as an additional layer; otherwise Opengrep is the free self-hosted choice.

Core Workflow (drive to zero)

1. Scan with the registry's auto ruleset:

   ~/.claude/skills/opengrep-sast/scripts/scan.sh [TARGET_DIR]

2. Fix each finding at the root cause (sanitize/validate input, use safe APIs, remove the dangerous sink). Do not silence with # nosemgrep unless a finding is a verified false positive — and justify it inline.
3. Re-run until the scan exits 0.

Custom rules (the main value)

Write organization-specific rules as YAML and point Opengrep at them with OPENGREP_RULES_DIR (it takes precedence over OPENGREP_CONFIG and is mounted read-only into the container):

OPENGREP_RULES_DIR=/path/to/my-rules \
  ~/.claude/skills/opengrep-sast/scripts/scan.sh [TARGET_DIR]

A minimal taint rule:

rules:
  - id: tainted-input-to-internal-exec
    mode: taint
    pattern-sources: [{ pattern: "request.$ANY" }]
    pattern-sinks: [{ pattern: "internal.exec(...)" }]
    message: Untrusted input reaches internal exec wrapper.
    languages: [python]
    severity: ERROR

Use a focused registry pack instead of auto with OPENGREP_CONFIG=p/owasp-top-ten (or other packs).

Notes

• --error makes the scan exit non-zero when any finding is reported, which drives the loop.
• The default OPENGREP_CONFIG=auto resolves rules from the registry and so requires network. For an offline/air-gapped run, mount your own rules via OPENGREP_RULES_DIR (there is no bundled offline ruleset in the image).
• JSON output for programmatic parsing: OPENGREP_JSON=1 scan.sh [DIR].

Resources

• scripts/scan.sh — runs opengrep scan against a directory with the configured ruleset. Exit: 0 = no findings, 1 = FINDINGS, 125 = operational error (rule-registry/network/image failure — NOT a finding). Env: OPENGREP_CONFIG, OPENGREP_RULES_DIR, OPENGREP_JSON.