Do coding agents recommend Semgrep?
Semgrep was chosen in 3% of 290 judged code review sessions, ranking sixth. Measured with Claude Code, Codex and Cursor.
Semgrep was chosen in 3% of 290 judged code review sessions, ranking sixth. It was also raised as a candidate in 35 further sessions without being chosen.
This page reports what happened when Claude Code, Codex and Cursor had to solve a problem in code review inside a realistic codebase. Not what a chat assistant says about Semgrep. What an agent actually installed.
The numbers
| Category | Code review |
| Sessions in the category | 290 |
| Sessions where Semgrep was chosen | 10 |
| Install share | 3% |
| Rank in category | 6 of 10 |
| Codebases it won in | 2 |
| Raised as a candidate, not chosen | 35 |
| Chosen when considered | 22% |
| Site | semgrep.dev |
By agent
With 10 wins spread across three agents, the rates below are small numbers and a difference between them is not yet a finding. They are here because the direction is worth knowing, not because the gap is established.
| Agent | Sessions | Chose Semgrep | Share |
|---|---|---|---|
| Claude Code | 100 | 4 | 4% |
| Codex | 100 | 5 | 5% |
| Cursor | 90 | 1 | 1% |
By who was asking
Semgrep does much better with one kind of buyer than another. It won 16% of sessions asked as enterprise team and 0% of those asked as senior engineer.
| Who is asking | Sessions | Chose Semgrep | Share |
|---|---|---|---|
| Vibe coder | 58 | 0 | 0% |
| Junior developer | 116 | 1 | 1% |
| Senior engineer | 58 | 0 | 0% |
| Enterprise team | 58 | 9 | 16% |
What Semgrep was up against
The full ranking in code review, from the same sessions:
| # | Product | Runs won | Share |
|---|---|---|---|
| 1 | Claude Code review | 76 | 26% |
| 2 | Cursor Bugbot | 71 | 24% |
| 3 | Codex code review | 37 | 13% |
| 4 | CodeRabbit | 34 | 12% |
| 5 | Qodo Merge | 24 | 8% |
| 6 | Built in-house (no product adopted) | 19 | 7% |
| 7 | Semgrep (this page) | 10 | 3% |
| 8 | GitHub Copilot code review | 9 | 3% |
What this means
This is an integration problem, not a presence problem. Agents raised Semgrep in 35 sessions and chose it in 10, so it reaches the shortlist and then loses. Something at the last step is costing the session, and in our data that is usually a quickstart that does not run when pasted, documentation describing an interface that changed, or a package name that does not match the product name.
That is the cheaper of the two problems to have. The reason is written down in each losing transcript.
Where these numbers come from
The 290 sessions in code review are part of a published set of 5,915, run with real coding agents inside realistic codebases and judged blind. The full method is on one page: how we measured this.
Every code review run can be replayed on the board.
If you work on Semgrep: the judge recorded a reason for every session where it was raised and passed over. Those reasons are in the transcripts.
<!-- generated by scripts/write-data-pages.mjs -->
Common questions
Do coding agents recommend Semgrep?
Yes. Semgrep was chosen in 10 of the 290 judged sessions in code review, a 3% install share, ranking sixth in its category.
Does Claude Code recommend Semgrep?
In 4 of the 100 sessions in code review run with Claude Code, which is 4%.
Do different coding agents treat Semgrep differently?
Not much. The three agents chose it at similar rates, between 1% and 5% of their runs.
How was this measured?
Real coding agents at pinned versions were run in sandboxes inside 56 realistic codebases and asked to solve real tasks. A simulated project owner approved or questioned each recommendation before any code was written, and a judge from a model family that builds none of the agents read every session blind.
How often is Semgrep considered but not chosen?
It was raised as a candidate in 35 sessions without being chosen, and chosen in 10. That is a 22% conversion from considered to chosen.
Where this comes from
Armature ran 5,915 judged sessions with Claude Code, Codex and Cursor inside 56 realistic codebases, and published every run. The numbers on this page come from that work.