Ruff vs Semgrep

Free and open source

From $40 per contributor/month (indicative)

Free and open source. You pay in engineering time and CI minutes.

The CLI plus community rules costs nothing and covers a lot; paid tiers add the platform, supply chain and secrets.

Everything, self-hosted

Open-source CLI is free and complete; hosted platform free for up to 10 contributors.

Category standard

Astral · since 2022

Widely used

Semgrep · since 2020

• Replaces Flake8, isort, Black, pyupgrade and more with a single fast binary.
• Fast enough to run on every keystroke in the editor.
• Straightforward migration from existing Flake8 configurations.

• Custom rules are genuinely writable — you can encode your own security or architecture standards in an afternoon.
• Free CLI with a large community rule registry is immediately useful.
• Fast enough to run on every pull request without complaint.

• Not every niche Flake8 plugin rule has been ported.
• Type checking is a separate concern — you still need mypy or ty.
• Rapid release cadence occasionally changes behaviour.

• Pattern matching without full dataflow misses some vulnerability classes.
• Community rule quality is uneven; expect to curate.
• Advanced dataflow and supply-chain features are paid only.

Every Python project.

Teams that want customisable static analysis and can start entirely for free.