semgrep is a rules engine: it scans code against patterns and policies and reports findings, mostly for security. act101 answers a different question — did the change your AI agent just made preserve behavior, and should it merge? Here's the honest comparison.
A pattern-and-rules engine for static analysis. Teams write or adopt rules — mostly security and policy — and semgrep scans the codebase and PRs in CI, reporting findings for humans to triage. It asks: does this code match a rule I consider a problem? It's a mature product with a large rules registry and a commercial platform around triage and reporting.
An execution and verification layer for AI agents. Your agent calls 183 typed
refactor operations through MCP; every change lands with a checkpoint and instant
undo; and act gate classifies the diff — format-only, behavior,
signature — finds the tests that reach it, and returns a deterministic
MERGE / REVIEW / BLOCK verdict with a signed receipt. It asks: did this change
preserve behavior, and should it merge?
| Capability | semgrep | act101 |
|---|---|---|
| Structural (AST-aware) pattern matching | ✓ | ✓ |
| Security rules registry + findings workflow (SAST) | ✓ | — (secret & taint analysis, not a rules registry) |
| Free tier | ✓ (OSS engine) | ✓ (Builder) |
| Typed refactor operations (extract, inline, move, rename) with cross-file reference updates | — | ✓ 183 ops |
| Automatic checkpoints + instant undo | — | ✓ |
| Per-change verdict: deterministic MERGE / REVIEW / BLOCK + receipt | — | ✓ |
| Built for AI agents (native MCP server) | — | ✓ |
| Architecture analyzers (coupling, cycles, dead code, hotspots) | — | ✓ 41 |
| Cross-language porting workflow with parity verification | — | ✓ |
Capability rows reflect each tool's documented, shipped surface. If we've got something wrong about semgrep, tell us: support@act101.ai.
You need organization-wide security scanning: a rules registry, findings triage, and compliance reporting across every repo. That's semgrep's home turf, and act101 doesn't try to replace it.
AI agents are changing your code and you need each change classified, verified against the tests that reach it, and reversible — with a receipt. Many teams will sensibly run both.
For some jobs. Both sit in the path to merge, but they answer different questions. semgrep asks: does this code match a rule I consider a problem? act101 asks: did this specific change preserve behavior, which tests reach it, and should it merge? If you need organization-wide security rules and SAST reporting, semgrep is built for that. If AI agents are making changes and you need each one classified, verified, and reversible, that's act101's job.
semgrep's paid team plans are priced per contributor per month, at a comparable order of magnitude. The difference is what you get: semgrep's paid tiers buy policy management and findings workflow; act101's Engineering Edition buys execution — typed refactor operations your agent calls directly, checkpoints and undo, and verification receipts for every change. See pricing.
Yes, and it's a sensible pairing: semgrep for organization-wide security rules and compliance findings, act101 as the execution and verification layer for agent-made changes. They check different things.
The homepage shows a real act gate session — a refactor clearing to MERGE, a behavior change routed to REVIEW.