Do coding agents recommend Semgrep?
Semgrep was chosen in 17% of 460 judged security testing sessions, ranking second. Measured with Claude Code, Codex, Grok Build CLI and Muse Code.
Semgrep was chosen in 17% of 460 judged security testing sessions, ranking second. It was also raised as a candidate in 94 further sessions without being chosen.
This page reports what happened when Claude Code, Codex, Grok Build CLI and Muse Code had to solve a problem in security testing inside a realistic codebase. Not what a chat assistant says about Semgrep. What an agent actually installed.
The numbers
| Category | Security testing |
| Sessions in the category | 460 |
| Sessions where Semgrep was chosen | 78 |
| Install share | 17% |
| Rank in category | 2 of 65 |
| Codebases it won in | 6 |
| Raised as a candidate, not chosen | 94 |
| Chosen when considered | 45% |
| Site | semgrep.dev |
By agent
Claude Code, Codex, Grok Build CLI and Muse Code agree closely on Semgrep, choosing it at rates within 5 points of each other.
| Agent | Sessions | Chose Semgrep | Share |
|---|---|---|---|
| Claude Code | 116 | 21 | 18% |
| Codex | 116 | 22 | 19% |
| Grok Build CLI | 116 | 19 | 16% |
| Muse Code | 112 | 16 | 14% |
What Semgrep was up against
The full ranking in security testing, from the same sessions:
| # | Product | Runs won | Share |
|---|---|---|---|
| 1 | ZAP | 111 | 24% |
| 2 | Semgrep (this page) | 78 | 17% |
| 3 | SonarQube | 66 | 14% |
| 4 | Burp Suite | 30 | 7% |
| 5 | GitHub Advanced Security | 25 | 5% |
| 6 | Trivy | 14 | 3% |
| 7 | StackHawk | 12 | 3% |
| 8 | Strix | 11 | 2% |
What this means
A solid second or third position in a category means the agent is genuinely choosing rather than reaching automatically. That is a winnable position, because the inputs it uses can be changed.
The fastest gains are usually in the sessions that were nearly won: read them, find the step where the agent moved on, and fix that step.
Where these numbers come from
The 460 sessions in security testing are part of a published set of 15,287, run with real coding agents inside realistic codebases and judged blind. The full method is on one page: how we measured this.
Every security testing run can be replayed on the board.
If you work on Semgrep: the judge recorded a reason for every session where it was raised and passed over. Those reasons are in the transcripts.
<!-- generated by scripts/write-data-pages.mjs -->
Common questions
Do coding agents recommend Semgrep?
Yes. Semgrep was chosen in 78 of the 460 judged sessions in security testing, a 17% install share, ranking second in its category.
Does Claude Code recommend Semgrep?
In 21 of the 116 sessions in security testing run with Claude Code, which is 18%.
Do different coding agents treat Semgrep differently?
Not much. Claude Code, Codex, Grok Build CLI and Muse Code chose it at similar rates, between 14% and 19% of their runs.
How was this measured?
Real coding agents at pinned versions were run in sandboxes inside 110 realistic codebases and asked to solve real tasks. A simulated project owner approved or questioned each recommendation before any code was written, and a judge from a model family that builds none of the agents read every session blind.
How often is Semgrep considered but not chosen?
It was raised as a candidate in 94 sessions without being chosen, and chosen in 78. That is a 45% conversion from considered to chosen.
Where this comes from
Armature ran 15,287 judged sessions with Claude Code, Codex, Cursor, Grok Build CLI and Muse Code inside 110 realistic codebases, and published every run. The numbers on this page come from that work.