Ruff vs Semgrep
Feature checklists rarely decide anything. What decides it is the pricing metric, who has to write the tests, and which limitation you can live with.
Entry price
Free and open source
Open sourceFrom $30 per contributor/month (Teams, per product)
Free tierWhat drives the bill
The metric that actually scales your invoice.
Free and open source. You pay in engineering time and CI minutes.
The CLI plus community rules costs nothing and covers a lot. Teams is priced per product per contributor — Code $30, Supply Chain $30, Secrets $15 — so scanning for all three multiplies the per-contributor figure.
Free tier
Everything, self-hosted
Open-source CLI is free and complete; hosted platform free for up to 10 contributors.
Open source
MIT
LGPL-2.1 (CLI)
Self-hostable
No-code authoring
Languages
Platforms
Fits teams
Adoption
Category standard
Astral · since 2022
Widely used
Semgrep · since 2020
Strengths
- Replaces Flake8, isort, Black, pyupgrade and more with a single fast binary.
- Fast enough to run on every keystroke in the editor.
- Straightforward migration from existing Flake8 configurations.
- Custom rules are genuinely writable — you can encode your own security or architecture standards in an afternoon.
- Free CLI with a large community rule registry is immediately useful.
- Fast enough to run on every pull request without complaint.
Limitations
- Not every niche Flake8 plugin rule has been ported.
- Type checking is a separate concern — you still need mypy or ty.
- Rapid release cadence occasionally changes behaviour.
- Pattern matching without full dataflow misses some vulnerability classes.
- Community rule quality is uneven; expect to curate.
- Advanced dataflow and supply-chain features are paid only.
Best for
Every Python project.
Teams that want customisable static analysis and can start entirely for free.
All of these integrate with: VS Code.
Pricing last reviewed August 2026 and is indicative only — confirm on each vendor’s own page.