Did Semgrep Just Get A Lot More Interesting?

Summary

Thomas Ptacek considers whether LLM-driven coding agents could make Semgrep more useful by closing the loop between code generation, execution, and automated repair. He describes Semgrep as a semantics-aware code-search tool whose symbolic variable placeholders and ordinary code can express vulnerability patterns, while noting that teams rarely have time to build extensive rule libraries. Drawing on Cursor’s rules feature, including rules that help organize or generate other rules, he proposes having an agent observe runtime errors, generalize fixes into unit tests, and generate Semgrep rules for the underlying bug. The proposed workflow would test each rule with positive and negative controls, save it, scan the codebase, and fix newly found instances. The post concludes that this adaptive process may be more compelling than predicting every failure in advance.

Takeaways

1. 1

   Semgrep uses symbolic variable placeholders and ordinary code to express searches for vulnerability patterns and other code-level footguns.

2. 2

   The proposed agent workflow includes testing generated rules with positive and negative controls before saving and applying them across the codebase.

3. 3

   Cursor’s rules can be used to constrain the agent, including a rule that prevented it from choosing Bazel and rules that help organize or generate further rules.