# xgrep

A fast, Semgrep-compatible code scanner written in Go.

xgrep scans codebases using Semgrep YAML rule syntax and tree-sitter for language-aware,
AST-based pattern matching. It optimizes for **accuracy** — when it reports a
vulnerability, it should be real and exploitable — and adds code-intelligence and
AI-agent features on top of scanning. See the
[design goals](docs/01-getting-started/index.md#design-goals).

## Installation

```bash
go install go.mondoo.com/xgrep/cmd/xgrep@latest
```

Or build from source:

```bash
git clone https://github.com/mondoohq/xgrep.git
cd xgrep
go build -o xgrep ./cmd/xgrep
```

## Quick start

xgrep ships with a built-in rule corpus, so no rules file is needed to get started:

```bash
# Scan the current directory with the built-in rules (defaults to the security category)
xgrep scan .

# Choose a category (default: security)
xgrep scan --category correctness .

# High-signal, exploitable-only: drop hardening/advisory findings and non-source
# trees (tests, benchmarks, examples). Recommended for embedding or scanning a
# focused surface such as an AI-agent skill.
xgrep scan --category security --subcategory vuln --xgrepignore .
```

```bash
# Machine-readable output
xgrep scan --json .
xgrep scan --sarif .                          # GitHub Code Scanning
xgrep scan --gitlab -o gl-sast-report.json .  # GitLab SAST

# Bring your own rules: point -f at a rule file or a directory of rules
xgrep scan -f rules.yaml src/
```

A scan target can also be a **remote git repository** — xgrep clones it (shallow,
default branch) into a temp directory and scans it, no manual clone needed:

```bash
xgrep scan github.com/mondoohq/xgrep            # host/owner/repo shorthand
xgrep scan https://github.com/mondoohq/xgrep    # or a full HTTPS/SSH URL
xgrep scan github.com/mondoohq/xgrep --ref v1.2.0   # a branch, tag, or commit
```

See the [remote-repository section](docs/02-scanning/cli-reference.md#scanning-a-remote-repository)
for `--ref`, `--depth`, and `--full-clone`.

## Documentation

Full documentation lives in [`docs/`](docs/README.md):

- **[Getting started](docs/01-getting-started/index.md)** — install and run your first scan.
- **[Scanning](docs/02-scanning/index.md)** — CLI reference, output formats, supported
  languages, file filtering, and Semgrep compatibility.
- **[Rules](docs/03-rules/index.md)** — writing, syntax, taint analysis, and testing rules.
- **[Code intelligence](docs/04-code-intelligence/index.md)** — `xgrep inspect` and the code graph.
- **[Integrations](docs/05-integrations/index.md)** — MCP, LSP, and CI.
- **[AI agents](docs/06-ai-agents/index.md)** — using xgrep as an agent backend (see also
  [`AGENTS.md`](AGENTS.md)).

Contributors: see [`CLAUDE.md`](CLAUDE.md) and the
[architecture decision records](docs/adr).
