# Semgrep Assistant overview

Source: https://semgrep.dev/docs/semgrep-assistant/overview#autofix

- [](/docs/)- [Scan](/docs/getting-started/quickstart)- Semgrep Assistant- Overview**On this page- [Deployment](/docs/tags/deployment)- [Semgrep Assistant](/docs/tags/semgrep-assistant)Semgrep Assistant overview
Semgrep Assistant provides AI-powered security recommendations to help you review, triage, and remediate your Semgrep findings.

***Figure.** Semgrep Assistant detects the use of untrusted, unsanitized data.*

## Support and availability[​](#support-and-availability)
Semgrep Assistant:

- Primarily supports findings generated by Semgrep Code
- Supports [the same languages as Semgrep Code](/docs/supported-languages)
- Is available to users of the following source code managers (SCMs):

Azure DevOps Cloud
- Bitbucket Cloud Premium and Bitbucket Data Center
- GitHub Cloud and GitHub Enterprise Server (self-hosted)
- GitLab, including SaaS and self-managed plans

- Requires the Semgrep AppSec Platform for its use
- Auto-analyzes many, but not all, findings during scans

For full scans, all *new* issues that have **Critical** or **High** severity AND **High** or **Medium** confidence are auto-analyzed
- For diff-aware scans (pull pequest or merge request scans), up to 10 new issues are auto-analyzed per scan

## Features[​](#features)
### Remediation[​](#remediation)
Semgrep Assistant can provide remediation advice and autofixes, or suggested fixes, for Semgrep Code findings.

#### Guidance[​](#guidance)
With Assistant enabled, PR or MR comments from Semgrep include step-by-step remediation instructions for the finding identified by Semgrep Code.

***Figure.** PR comment displaying the rule message followed by a comment that contains Assistant-generated remediation guidance.*

Semgrep also displays remediation information on Semgrep AppSec Platform&#x27;s **Findings page** under **Your code &amp; fix** in the [finding&#x27;s details](/docs/semgrep-code/findings#view-details-about-a-specific-finding) page.

***Figure.** Findings detail page with the Your code &amp; fix section displaying the suggested fix.*

infoSemgrep only waits for a limited amount of time for Assistant guidance before posting a PR or MR comment, since comments are time-sensitive. If guidance is missing from the PR or MR comment because it was not yet available, it should still be present on Semgrep AppSec Platform&#x27;s **Findings page** for the finding.

#### Autofix[​](#autofix)
Semgrep Assistant can suggest [autofix](/docs/writing-rules/autofix) code snippets for Semgrep Code findings when it identifies a true positive. Assistant only suggests an autofix if the rule doesn&#x27;t have a human-written autofix. You can set the minimum autofix confidence level required to display autofix suggestions from Semgrep Assistant on Semgrep AppSec Platform&#x27;s **Settings** page. To receive as many Assistant suggestions as are available, set the minimum to **low confidence**.

Assistant customizes the code snippets it provides based on previous feedback, if any, and your rule customizations. For example, if you have a custom rule recommending a specific sanitizer, Assistant can recommend its use in the autofix suggestion for the issue in your code.

Autofixes are available in PR and MR comments, so developers can review and verify Semgrep&#x27;s generated fixes before applying them.

***Figure.** Semgrep Assistant generates a potential fix in a PR comment.*

Autofixes are also available on Semgrep AppSec Platform&#x27;s **Findings page** under **Assistant suggested fix** in the [finding&#x27;s details](/docs/semgrep-code/findings#view-details-about-a-specific-finding).

*Figure*. Semgrep Assistant showing a potential fix in Semgrep AppSec Platform.

infoIf many new issues are found in a given scan, Assistant auto-triage and autofix may not run on every issue.

### Component tags[​](#component-tags)
**Component tags** use AI to categorize a finding based on its function, such as:

- Payments
- User authentication
- Infrastructure

By categorizing your code through component tags, Semgrep Assistant can help you prioritize **high-risk issues**, such as remediating a code finding related to payments or user authentication.

Component tags can be viewed in Semgrep AppSec Platform&#x27;s **Findings** page.

***Figure.** Semgrep AppSec Platform&#x27;s Findings page showing the Component filter.*

### Auto-triage[​](#auto-triage)
Semgrep Assistant uses AI&#x27;s understanding of programming languages and libraries, and your code and triage history, to auto-triage findings and suggest whether a finding can safely be ignored. For every recommendation to ignore a finding, Semgrep also provides guidance with an explanation on why this is the case.

Auto-triage recommendations are available in Semgrep AppSec Platform&#x27;s **Findings** page when you filter for findings that Assistant suggests should be ignored, and in the [finding&#x27;s details](/docs/semgrep-code/findings#view-details-about-a-specific-finding).

***Figure.** Semgrep Assistant auto-triage in the Findings page.*

Assistant&#x27;s suggestions to ignore findings are also surfaced in PR or MR comments, so developers can triage an issue directly without leaving their PR or MR.

### Weekly priority emails[​](#weekly-priority-emails)
Semgrep sends weekly emails with information on Assistant&#x27;s top three backlog tasks across all findings. Unlike other Assistant features, these suggestions can include information for all Semgrep products that you have enabled. The emails are sent out on Monday to all organization admins.

### Noise filtering (beta)[​](#noise-filtering-beta)
Noise filtering increases developer velocity by reducing interruptions from potential false positives. With Noise Filtering, Assistant evaluates each finding to determine if it&#x27;s a true positive using additional context. If Assistant thinks a finding may be a false positive, it prevents a PR comment from being posted in the developer workflow.

Security teams can review filtered findings at any time on Semgrep&#x27;s [**Code &gt; Pre-production** page](https://semgrep.dev/orgs/-/findings?tab=open&amp;last_opened=All+time&amp;backlog=preprod). Semgrep also allows you to agree or disagree with the filtering. If you agree with the suggestion, Semgrep closes the finding, but if you disagree, Semgrep reopens the finding.

Assistant is [over 95% accurate in categorizing Semgrep Code findings as false positives](/docs/semgrep-assistant/metrics).

### Memories[​](#memories)
Assistant Memories allows AppSec teams and developers to tailor Assistant&#x27;s remediation guidance to their organization&#x27;s standards and defaults on a per-project, per-rule basis. When Assistant gives a suggested fix, you can provide feedback by adding custom instructions.

For example, if the code contains a hardcoded secret, Assistant might suggest using an SDK that handles credentialing. However, if your company prefers to use a different secrets manager, you can provide this information to Assistant. Assistant then generates remediation guidance that works with your specific secrets manager in the future.

### Upgrade guidance (beta)[​](#upgrade-guidance-beta)
Semgrep Supply Chain&#x27;s dependency upgrade guidance uses AI to analyze if a finding can be **safely upgraded** or if upgrading the package can cause **breaking changes**. Semgrep&#x27;s click to fix capability can then create a PR to upgrade the package.

Read more about [Upgrade guidance and Click to fix](/docs/semgrep-supply-chain/triage-and-remediation).

## Reliability[​](#reliability)
Assistant supports fallback between model providers to ensure optimal performance and reliability. OpenAI is the primary provider in most cases, with automatic fallback to AWS Bedrock as needed. Semgrep&#x27;s fallback decisions are based on an internal ranking system informed by ongoing research. Semgrep ranks models by performance and dynamically selects the best available from [your enabled options](/docs/semgrep-assistant/customize#select-your-ai-provider).

Enabling additional model providers for your Semgrep organization can improve performance in some scenarios, while removing them could result in reduced performance.

Not finding what you need in this doc? Ask questions in our [Community Slack group](https://go.semgrep.dev/slack), or see [Support](/docs/support/) for other ways to get help.

Tags:**- [Deployment](/docs/tags/deployment)- [Semgrep Assistant](/docs/tags/semgrep-assistant)[Edit this page](https://github.com/semgrep/semgrep-docs/edit/main/docs/semgrep-assistant/overview.md)Last updated on **Dec 12, 2025**