Semgrep

Semgrep for Zed

Semgrep language server integration for Zed.

Identify bugs and security issues in your code in real-time. This extension brings the power of semgrep lsp directly into your editor, offering zero-config usage and "Professional" defaults so you see findings immediately.

Features

• Zero-Config Setup: Works out of the box.
  • Automatically detects if semgrep is installed.
  • Smart Defaults: Runs with configuration: ["auto"] and only_git_dirty: false so you see findings in all files immediately without needing a .semgrep.yml.
• Real-time Diagnostics: Highlights bugs and security vulnerabilities as you type.
• Full Configuration: Supports Zed's settings.json to override binary paths, environment variables, and scan rules.

Installation

1. Open Zed.
2. Press cmd-shift-x to open the Extensions view.
3. Search for Semgrep and click Install.

Auto-Installation: The extension will automatically attempt to install semgrep (via Homebrew on macOS or pip on Linux) if it is not found in your PATH.

Manual Installation (Optional)

If you prefer to install it yourself or the auto-install fails:

• macOS: brew install semgrep
• Linux/WSL: pip install semgrep (or check Semgrep Installation Docs)
• Windows: Install via WSL or Pip, then configure the path in Zed settings.

Configuration

You can customize the extension in your Zed settings.json.

Recommended Settings

The extension uses sensible defaults, but you can override them.

{
  "lsp": {
    "semgrep": {
      "initialization_options": {
        "scan": {
          // Choose specific rulesets (defaults to ["auto"])
          "configuration": ["p/security-audit", "p/secrets"],
          // Set to true to only scan modified lines (less noise)
          "only_git_dirty": false
        }
      }
    }
  }
}

Advanced Settings (Binary Path)

If semgrep is in a non-standard location or you want to use a specific version:

{
  "lsp": {
    "semgrep": {
      "binary": {
        "path": "/path/to/custom/semgrep",
        "arguments": ["lsp", "--debug"],
        "env": {
          "SEMGREP_APP_TOKEN": "your-token-here"
        }
      }
    }
  }
}

Troubleshooting

"Semgrep not found"

If you see this error, it means semgrep was not found in your PATH.

1. Open a terminal.
2. Run semgrep --version to verify it's installed.
3. If not, run brew install semgrep or pip3 install semgrep.

No Underlines / Diagnostics?

1. Check the logs: Run zed: open log in the command palette.
2. Verify file type: Semgrep only scans supported languages (JS, TS, Python, Go, Java, etc.).
3. Check Rules: Ensure your configuration isn't empty. The default is auto, but if you have a local .semgrep.yml that matches nothing, you won't see results.

Contributing

Issues and Pull Requests are welcome!

1. Clone the repo.
2. Run cargo check to verify the Rust code.
3. Submit a PR.

License

MIT