# xgrep

A fast, Semgrep-compatible code scanner written in Go.

xgrep scans codebases using Semgrep YAML rule syntax and tree-sitter for language-aware,
AST-based pattern matching. It optimizes for **accuracy** — when it reports a
vulnerability, it should be real and exploitable — and adds code-intelligence and
AI-agent features on top of scanning. See the
[design goals](docs/01-getting-started/index.md#design-goals).

## Installation

```bash
go install go.mondoo.com/xgrep/cmd/xgrep@latest
```

Or build from source:

```bash
git clone https://github.com/mondoohq/xgrep.git
cd xgrep
go build -o xgrep ./cmd/xgrep
```

## Quick start

```bash
# Scan a directory with a rule file (or a directory of rules)
xgrep -f rules.yaml src/

# Machine-readable output
xgrep -f rules.yaml --json src/
xgrep -f rules.yaml --sarif src/                          # GitHub Code Scanning
xgrep -f rules.yaml --gitlab -o gl-sast-report.json src/  # GitLab SAST
```

A scan target can also be a **remote git repository** — xgrep clones it (shallow,
default branch) into a temp directory and scans it, no manual clone needed:

```bash
xgrep scan github.com/mondoohq/xgrep            # host/owner/repo shorthand
xgrep scan https://github.com/mondoohq/xgrep    # or a full HTTPS/SSH URL
xgrep scan github.com/mondoohq/xgrep --ref v1.2.0   # a branch, tag, or commit
```

See the [remote-repository section](docs/02-scanning/cli-reference.md#scanning-a-remote-repository)
for `--ref`, `--depth`, and `--full-clone`.

## Documentation

Full documentation lives in [`docs/`](docs/README.md):

- **[Getting started](docs/01-getting-started/index.md)** — install and run your first scan.
- **[Scanning](docs/02-scanning/index.md)** — CLI reference, output formats, supported
  languages, file filtering, and Semgrep compatibility.
- **[Rules](docs/03-rules/index.md)** — writing, syntax, taint analysis, and testing rules.
- **[Code intelligence](docs/04-code-intelligence/index.md)** — `xgrep inspect` and the code graph.
- **[Integrations](docs/05-integrations/index.md)** — MCP, LSP, and CI.
- **[AI agents](docs/06-ai-agents/index.md)** — using xgrep as an agent backend (see also
  [`AGENTS.md`](AGENTS.md)).

Contributors: see [`CLAUDE.md`](CLAUDE.md) and the
[architecture decision records](docs/adr).
