/usr/bin/semgrep-core

Usage: semgrep-core [options] -rules <file> -targets <file>
Options:
  -rules  <file> obtain formula of patterns from YAML/JSON/Jsonnet file
  -targets  <file> obtain list of targets to run patterns on
  -lang  <str> choose language (valid choices:
     apex, bash, c, c#, c++, cairo, circom, clojure, cpp, csharp, dart, docker, dockerfile, elixir, ex, fga, generic, go, golang, gosu, hack, hcl, html, java, javascript, js, json, jsonnet, julia, kotlin, kt, lisp, lua, move_on_aptos, move_on_sui, none, objc, objective-c, objectivec, ocaml, openfga, php, powershell, promql, proto, proto3, protobuf, py, python, python2, python3, r, regex, ruby, rust, scala, scheme, sh, sol, solidity, swift, terraform, tf, ts, typescript, vue, xml, yaml)
  -l  <str> shortcut for -lang
  -j  <int> number of cores to use (default: automatic)
  -json  output JSON format
  -json_nodots  output JSON format but without intermediate dots
  -json_time  report detailed matching times as part of the JSON response. Implies '-json'.
  -fail_fast  stop at first exception (and get a backtrace)
  -filter_irrelevant_patterns  filter patterns not containing any strings in target file
  -no_filter_irrelevant_patterns  do not filter patterns
  -filter_irrelevant_rules  filter rules not containing any strings in target file
  -no_filter_irrelevant_rules  do not filter rules
  -fast  filter rules not containing any strings in target file
  -disable_rule_paths  do not honor the paths: directive of the rule
  -tree_sitter_only  only use tree-sitter-based parsers
  -pfff_only  only use pfff-based parsers
  -timeout  <float> maxinum time to spend running a rule on a single file (in seconds); 0 disables timeouts (default is 0)
  -timeout_threshold  <int> maximum number of rules that can timeout on a file before the file is skipped; 0 disables it (default is 0)
  -max_memory <int>  maximum memory available (in MiB); allows for clean termination when running out of memory. This value should be less than the actual memory available because the limit will be exceeded before it gets detected. Try 5% less or 15000 if you have 16 GB.
  -max_tainted_vars <int> maximum number of vars to store. This is mostly for internal use to make performance testing easier
  -max_taint_set_size <int> maximum size of a taint set. This is mostly for internal use to make performance testing easier
  -max_match_per_file  <int> maximum numbers of match per file
  -debug  output debugging information
  -strict  fail on warnings
  -debug_matching  raise an exception at the first match failure
  -matching_explanations  output intermediate matching explanations
  -log_to_file  <file> log debugging info to file
  -trace  output tracing information
  -trace_endpoint  url endpoint for collecting tracing information
  -macros  <file> list of macros to expand
  -profile  record and output profiling information to stderr
  -simple_profiling  record profiling information for inclusion in JSON results
  -show_trace_profile  show trace
  -debugger  option to set if launched inside ocamldebug
  -keep_tmp_files  keep temporary generated files
  -full_token_info  print also token information in dumper
  -check_rules  <metachecks file> <files or dirs>
  -parsing_stats  <files or dirs> generate parsing statistics (use -json for JSON output)
  -prefilter_of_rules  <file> dump the prefilter regexps of rules in JSON
  -prefilter_of_rules_interfile  <file> dump the prefilter regexps of rules in JSON
  -dump_extensions  print file extension to language mapping
  -dump_pattern  <file>
  -dump_patterns_of_rule  <file>
  -dump_ast  <file>
  -dump_lang_ast  <file>
  -dump_named_ast  <file>
  -dump_il  <file>
  -pp_il  <file> pretty-print IL in familiar-ish syntax
  -dump_rule  <file>
  -dump_tree_sitter_cst  <file> dump the CST obtained from a tree-sitter parser
  -dump_tree_sitter_pattern_cst  <file>
  -dump_pfff_ast  <file> dump the generic AST obtained from a pfff parser
  -diff_pfff_tree_sitter  <file>
  -test_parse_tree_sitter  <dir> test tree-sitter parser on target files
  -translate_rules  <files or dirs>
  -stat_rules  <files or dirs>
  -parse_rules  <dir>
  -test_eval  <JSON file>
  -sarif_sort  <JSON file>
  -rpc  don't use this unless you already know
  -typing_generic  <file>
  -constant_propagation  <file>
  -il_generic  <file>
  -cfg_il  <file>
  -dfg_svalue  <file>
  -dfg_tainting <rules> <target>
  -naming_generic  <file>
  -version   guess what
  -ocaml_version   The version of OCaml that was used to build this binary
  -use_parmap   Rely on a legacy Parmap implementation of `-j`
  -help  Display this list of options
  --help  Display this list of options