# Semgrep Supply Chain

Find reachable vulnerable dependencies.

Source: [Console review](<https://console.dev/tools/semgrep-supply-chain>)

Website: [https://semgrep.dev/products/semgrep-supply-chain?utm\_source=console.dev&utm\_medium=email&utm\_campaign=ssc-launch](<https://semgrep.dev/products/semgrep-supply-chain?utm_source=console.dev&utm_medium=email&utm_campaign=ssc-launch>)

Profile updated: 2026-10-16

## Supported tech stack

Research checked: 2026-10-11

### Integrates with

- C# (Language)
- Go (Language)
- Java (Language)
- JavaScript (Language)
- Kotlin (Language)
- PHP (Language)
- Python (Language)
- Ruby (Language)
- Rust (Language)
- Scala (Language)
- Swift (Language)
- TypeScript (Language)

Source: [Research source](<https://docs.semgrep.dev/>)

Documented compatibility; coverage may be incomplete. Written in describes implementation, not user-project language support.

Supply Chain supported-language list includes C#, Go, Java, JavaScript/TypeScript, Kotlin, PHP, Python, Ruby, Rust, Scala and Swift.

## Console’s review — 2022-10-13

Reviewed: 2022-10-13

Author: [David Mytton](<https://console.dev/about#david-mytton>)

Citation: [This review](<https://console.dev/tools/semgrep-supply-chain#review_3755fed57e4abd95a6df629739a09c99910d2e3a06ce1cb8b3df60c7e928267c>)

### What we like

Analyzes your code to determine not just if you have a vulnerable dependency, but also whether your usage triggers the vulnerability. Helps triage dependency security alerts based on vulnerability reachability, rather than just a version comparison. Run via CLI or CI. Can comment on PRs, alert via Slack/email, and optionally propose auto-fixes.

### Tradeoffs

Only analyzes usage of direct dependencies - can still alert on vulnerabilities in transitive or indirect dependencies, but does not yet support detection of their usage relevancy.

This review reflects Console’s assessment at publication on 2022-10-13. Features and limitations may have changed since the review date.

## Is Semgrep Supply Chain a fit?

Based on [Console’s review published on 2022-10-13](<https://console.dev/tools/semgrep-supply-chain#review_3755fed57e4abd95a6df629739a09c99910d2e3a06ce1cb8b3df60c7e928267c>).

Summary updated: 2026-10-16

### Who it’s for

Developers who need to manage dependency security should consider this tool for vulnerability assessment

### Why consider it

It helps triage dependency security alerts based on vulnerability reachability

### Keep in mind

It only analyzes usage of direct dependencies and does not support detection of transitive dependencies' usage relevancy

[Selection criteria](<https://console.dev/selection-criteria>) · [About Console](<https://console.dev/about>) · [Browse tools](<https://console.dev/tools>)