Security & Auditing · head-to-head
semgrep vs trail-of-bits
Pick semgrep when you want machine findings: it runs the Semgrep engine across 30-plus languages and lets you author custom YAML rules for patterns specific to your codebase. Pick trail-of-bits when you want expert review method applied to a change — the reasoning a scanner cannot encode. Scanners find known patterns; review finds the design mistake that created them, so mature teams run both.
Pick semgrep
You want reproducible, gate-able findings in CI, and the ability to encode a house rule as a scanner rule rather than a review comment.
Pick trail-of-bits
You want a severity-tagged review of a specific change, including the architectural and cryptographic judgement a pattern matcher cannot express.
Side by side
How they differ
| semgrep | trail-of-bits | |
|---|---|---|
| What it does | Runs the Semgrep engine; authors custom YAML rules | Applies a security firm's review method to code |
| Output | Findings with rule IDs — gate-able | Severity-tagged review prose |
| Coverage | 30+ languages, pattern-based | Judgement-based, not language-limited |
| Custom rules | Yes — writing rules is a first-class use | No |
| Needs a CLI | Yes — the semgrep CLI (or its MCP tools) | No |
| Licence | Semgrep Rules License v1.0 — not OSI | Apache-2.0 |
| Capability | Action-taking — runs scans | Read-only |
What it does
- semgrep
- Runs the Semgrep engine; authors custom YAML rules
- trail-of-bits
- Applies a security firm's review method to code
Output
- semgrep
- Findings with rule IDs — gate-able
- trail-of-bits
- Severity-tagged review prose
Coverage
- semgrep
- 30+ languages, pattern-based
- trail-of-bits
- Judgement-based, not language-limited
Custom rules
- semgrep
- Yes — writing rules is a first-class use
- trail-of-bits
- No
Needs a CLI
- semgrep
- Yes — the semgrep CLI (or its MCP tools)
- trail-of-bits
- No
Licence
- semgrep
- Semgrep Rules License v1.0 — not OSI
- trail-of-bits
- Apache-2.0
Capability
- semgrep
- Action-taking — runs scans
- trail-of-bits
- Read-only
Open semgrep or trail-of-bits for the composite score, license, and exact install commands, or browse the full Security & Auditing category.
Verdict
The bottom line
These are complements with a licence caveat worth knowing. semgrep is the right default for anything you want to run repeatedly and block a merge on, and its custom-rule authoring is the cheapest way to make a house convention enforceable. trail-of-bits is what you reach for on the change that actually matters, where the question is whether the design is sound rather than whether a known pattern appears. Note that Semgrep ships its skill under its own Rules License rather than MIT or Apache — read it before vendoring the rules into a commercial product.
FAQ
Common questions
Do I need both a scanner skill and a review skill?
For code that handles auth, untrusted input, secrets or money, yes. They fail differently: a scanner misses the novel mistake, and a review pass misses the boring instance of a known pattern buried in a large diff. Running one and calling it security is the common gap.
Is the Semgrep skill open source?
Not under an OSI licence. Its repository ships the Semgrep Rules License v1.0, which GitHub reports as "Other". The skill is free to use; redistributing or vendoring the rules is what the licence governs, so read it before shipping them inside a product.
Does semgrep need an API key?
No. It needs the semgrep CLI installed locally (brew or pip), and it will use Semgrep MCP tools if they are available. There is no key requirement for scanning your own code.
Related
More head-to-head comparisons
- firecrawl vs browser-use
firecrawl for hosted, JavaScript-rendered extraction at scale; browser-use for driving a real browser through logins, forms, and multi-step flows.
- supabase-skill vs planetscale-skills
supabase-skill for Postgres with row-level security, auth, and realtime; planetscale-skills for MySQL with Git-style schema branching at scale.
- stripe-best-practices vs paddle-agent-skills
stripe-best-practices for maximum control over payment flows (you own tax); paddle-agent-skills for merchant-of-record billing (Paddle handles global sales tax and VAT).
- docling vs pdf
docling for reading and converting documents an agent cannot open — including scanned PDFs and RAG chunking; the Anthropic pdf skill for producing and manipulating real PDFs.
- playwright-cli vs Browserbase browser
playwright-cli for a local browser you fully control and an existing Playwright suite; Browserbase browser for hosted sessions with CAPTCHA solving and residential proxies.
- postgres vs supabase-skill
The postgres skill for engine-level decisions — types, indexes, partitioning, extensions; supabase-skill for the platform layer — row-level security, auth, realtime.
- drawio vs mermaid-diagrams
drawio produces an editable .drawio file someone can rearrange later; mermaid keeps the diagram as text inside the document it belongs to.
- Stripe Connect vs Paddle
Stripe Connect for control over multi-party payment flows you operate yourself; Paddle for handing global tax and compliance to a merchant of record.
Browse all best-skill guides or the full directory.