Security & Auditing · head-to-head

semgrep vs trail-of-bits

Pick semgrep when you want machine findings: it runs the Semgrep engine across 30-plus languages and lets you author custom YAML rules for patterns specific to your codebase. Pick trail-of-bits when you want expert review method applied to a change — the reasoning a scanner cannot encode. Scanners find known patterns; review finds the design mistake that created them, so mature teams run both.

Pick semgrep

You want reproducible, gate-able findings in CI, and the ability to encode a house rule as a scanner rule rather than a review comment.

Pick trail-of-bits

You want a severity-tagged review of a specific change, including the architectural and cryptographic judgement a pattern matcher cannot express.

Side by side

How they differ

What it does

semgrep
Runs the Semgrep engine; authors custom YAML rules
trail-of-bits
Applies a security firm's review method to code

Output

semgrep
Findings with rule IDs — gate-able
trail-of-bits
Severity-tagged review prose

Coverage

semgrep
30+ languages, pattern-based
trail-of-bits
Judgement-based, not language-limited

Custom rules

semgrep
Yes — writing rules is a first-class use
trail-of-bits
No

Needs a CLI

semgrep
Yes — the semgrep CLI (or its MCP tools)
trail-of-bits
No

Licence

semgrep
Semgrep Rules License v1.0 — not OSI
trail-of-bits
Apache-2.0

Capability

semgrep
Action-taking — runs scans
trail-of-bits
Read-only

Open semgrep or trail-of-bits for the composite score, license, and exact install commands, or browse the full Security & Auditing category.

Verdict

The bottom line

These are complements with a licence caveat worth knowing. semgrep is the right default for anything you want to run repeatedly and block a merge on, and its custom-rule authoring is the cheapest way to make a house convention enforceable. trail-of-bits is what you reach for on the change that actually matters, where the question is whether the design is sound rather than whether a known pattern appears. Note that Semgrep ships its skill under its own Rules License rather than MIT or Apache — read it before vendoring the rules into a commercial product.

FAQ

Common questions

Do I need both a scanner skill and a review skill?

For code that handles auth, untrusted input, secrets or money, yes. They fail differently: a scanner misses the novel mistake, and a review pass misses the boring instance of a known pattern buried in a large diff. Running one and calling it security is the common gap.

Is the Semgrep skill open source?

Not under an OSI licence. Its repository ships the Semgrep Rules License v1.0, which GitHub reports as "Other". The skill is free to use; redistributing or vendoring the rules is what the licence governs, so read it before shipping them inside a product.

Does semgrep need an API key?

No. It needs the semgrep CLI installed locally (brew or pip), and it will use Semgrep MCP tools if they are available. There is no key requirement for scanning your own code.

Related

More head-to-head comparisons

Browse all best-skill guides or the full directory.