How opengrep/opengrep works
Opengrep is an open-source static analysis engine. Its main workflow accepts rules and source targets, scans for code patterns and security issues, then presents findings or emits JSON/SARIF. The tree identifies separate CLI, parsing, matching, taint, fixing, reporting, and language-server areas; the README documents broad language support and intrafile taint analysis. Source excerpts did not include the scan implementation, so the graph captures the documented workflow and major capabilities without asserting detailed internal call wiring.
Main entry points: core_runner Core runner · cli_scan Scan CLI · parsing_languages Language parsing · tainting Taint analysis
Components 19
User interfaces
- Scan CLI
src/osemgrep/cli_scan - Language server
src/osemgrep/language_server
Scan workflow
- Scan configuration
src/osemgrep/configuring - Target selection
src/targeting - Language parsing
src/parsing_languages - Language parsers
languages - Generic AST
libs/ast_generic - Core runner
src/osemgrep/core_runner
Analysis capabilities
- Pattern matching
src/matching - Taint analysis
src/tainting - Interfile analysis
src/call_graph - Autofix
src/fixing
Results and integrations
- Findings
src/core - Output formats
src/reporting
Other components
- Developer
- Rulesets
- Source code
- JSON / SARIF
- Terminal results
Connections 20
- Developer → Scan CLI: invokes
- Developer → Language server: uses
- Rulesets → Scan CLI: supplies rules
- Source code → Scan CLI: supplies targets
- Scan CLI → Scan configuration: configures scan
- Scan CLI → Core runner: starts scan
- Core runner → Target selection: selects files
- Core runner → Language parsing: parses targets
- Language parsing → Language parsers: uses parsers
- Language parsing → Generic AST: produces AST
- Core runner → Pattern matching: runs rules
- Core runner → Taint analysis: runs taint analysis
- Taint analysis → Interfile analysis: uses call graphs
- Pattern matching → Findings: produces matches
- Taint analysis → Findings: reports flows
- Findings → Output formats: formats results
- Output formats → JSON / SARIF: emits JSON/SARIF
- Output formats → Terminal results: prints findings
- Scan CLI → Autofix: offers fixes
- Language server → Core runner: requests analysis