Semgrep Multimodal overview

Documentation Index

Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt

Use this file to discover all available pages before exploring further.

​

Support and availability

Semgrep Multimodal:

• Primarily supports findings generated by Semgrep Code
• Supports the same languages as Semgrep Code
• Requires the Semgrep AppSec Platform

See the list of supported source code managers.

​

Automatic analysis

Semgrep Multimodal auto-analyzes findings that meet the following criteria:

• Full scans: All new findings that have Critical or High severity AND High or Medium confidence are auto-analyzed
• Diff-aware scans (pull request and merge request scans): Up to 10 new findings are automatically analyzed per scan. AI-powered detection does not support diff-aware scans.

​

Features

​

AI-powered detection scans

With Semgrep Multimodal’s AI-powered detection, you can automatically identify complex business logic flaws, such as insecure direct object references (IDORs) and broken authorization. Semgrep’s AI-powered detection combines the precision of static analysis with the contextual reasoning of large language models (LLMs). For instructions on enabling and running an AI-powered scan, see Scan with AI-powered detection.

​

Explanation

Semgrep Multimodal explains why a finding is a true positive by connecting the rule’s message to the code that triggered it. It highlights the relevant lines of code along with the surrounding context and describes how the rule applies in this specific case. For security rules, Multimodal also connects the finding back to the threat model, showing the potential risk and why the code behavior matters. The explanation helps you understand not just which rule triggered a finding, but why the code is considered problematic. On the finding’s Details page:

• Semgrep Multimodal’s explanation appears in the Finding description tab.
• The rule that triggered the finding is described in the Rule description tab.
• The exact lines of code that caused the finding are displayed in the Your code tab. Click a line to highlight the relevant code in context.

For true positive findings, the same Multimodal-generated explanations are also included in pull request or merge request comments. A brief summary appears in the default view. Expand More details about this to view the full Multimodal-generated explanation. Note that Multimodal-generated explanations are not available for custom rules or community rules.

​

Remediation

Semgrep Multimodal can provide remediation advice or Suggested fixes for Semgrep Code findings.

​

Guidance

With Multimodal enabled, pull request or merge request comments from Semgrep include step-by-step remediation instructions for the finding identified by Semgrep Code. Semgrep also displays remediation information on Semgrep AppSec Platform’s Findings page under Your code & fix in the finding’s details page.

​

Suggested fix

Semgrep Multimodal’s Suggested fix feature suggests changes to code snippets for Semgrep Code findings when it identifies a true positive. Multimodal only suggests a fix if the rule doesn’t have a Rule-defined fix. You can set the minimum Suggested fix confidence level required to display Multimodal suggestions on Semgrep AppSec Platform’s Settings page. To receive as many Multimodal suggestions as are available, set the minimum to low confidence. Multimodal customizes the code snippets it provides based on any previous feedback and your rule customizations. For example, if you’ve created a custom rule that recommends a specific sanitizer, Multimodal will automatically suggest that sanitizer whenever the rule is triggered. Suggested fix is also available in:

• PR and MR comments so that you can review and verify Semgrep’s generated fixes before applying them.
• Semgrep AppSec Platform’s Findings page under Suggested fix in the finding’s details.

​

Component tags

Component tags use AI to categorize a finding based on its function, such as:

• Payments
• User authentication
• Infrastructure

By categorizing your code through component tags, Semgrep Multimodal can help you prioritize high-risk issues, such as remediating a code finding related to payments or user authentication. Component tags can be viewed in Semgrep AppSec Platform’s Findings page.

​

Auto-triage

Semgrep Multimodal uses AI’s understanding of programming languages and libraries, and your code and triage history, to auto-triage findings and suggest whether a finding can safely be ignored. For every recommendation to ignore a finding, Semgrep also provides guidance with an explanation on why this is the case. Auto-triage recommendations are available in Semgrep AppSec Platform’s Findings page when you filter for findings that Multimodal suggests should be ignored, and in the finding’s details. Multimodal’s suggestions to ignore findings are also surfaced in PR or MR comments, so developers can triage an issue directly without leaving their PR or MR.

​

Weekly priority emails

Semgrep sends weekly emails with information on Multimodal’s top three backlog tasks across all findings. Unlike other Multimodal features, these suggestions can include information for all Semgrep products that you have enabled. The emails are sent out on Monday to all organization admins.

​

Noise filtering (beta)

Noise filtering increases developer velocity by reducing interruptions from potential false positives. With Noise Filtering, Multimodal evaluates each finding to determine if it’s a true positive using additional context. If Multimodal thinks a finding may be a false positive, it prevents a PR comment from being posted in the developer workflow. Security teams can review filtered findings at any time on Semgrep’s Code > Pre-production page. Semgrep also allows you to agree or disagree with the filtering. If you agree with the suggestion, Semgrep closes the finding, but if you disagree, Semgrep reopens the finding. Multimodal is over 95% accurate in categorizing Semgrep Code findings as false positives.

​

Memories

Memories allows AppSec teams and developers to tailor Multimodal’s remediation guidance to their organization’s standards and defaults on a per-project, per-rule basis. When Multimodal gives a suggested fix, you can provide feedback by adding custom instructions. For example, if the code contains a hardcoded secret, Multimodal might suggest using an SDK that handles credentialing. However, if your company prefers to use a different secrets manager, you can provide this information to Multimodal. Multimodal then generates remediation guidance that works with your specific secrets manager in the future.

​

Upgrade guidance (beta)

Semgrep Supply Chain’s dependency upgrade guidance uses AI to analyze if a finding can be safely upgraded or if upgrading the package can cause breaking changes. Semgrep’s Autofix capability can then create a PR to upgrade the package. Read more about Upgrade guidance and Autofix.

​

Reliability

Multimodal supports fallback between model providers to ensure optimal performance and reliability. OpenAI is the primary provider in most cases, with automatic fallback to AWS Bedrock as needed. Semgrep’s fallback decisions are based on an internal ranking system informed by ongoing research. Semgrep ranks models by performance and dynamically selects the best available from your enabled options. Enabling additional model providers for your Semgrep organization can improve performance in some scenarios, while removing them could result in reduced performance.