# Warestack vs Semgrep

Semgrep finds code-level bugs with static analysis rules. Warestack governs the entire delivery pipeline — from agent instruction files to post-merge drift.

| Feature                                        | Warestack                       | Semgrep                          |
|-----------------------------------------------|---------------------------------|----------------------------------|
| Analysis                                      | Static code analysis (SAST)     | PR-level risk scoring             |
|                                               | Agent instruction file enforcement (.cursorrules, CLAUDE.md) | Intent-to-diff validation       |
|                                               | Post-merge drift detection       |                                  |
| Governance                                    | Custom YAML check definitions    | Team-level policy enforcement     |
|                                               | Service tier classification      |                                  |
| Integrations                                  | GitHub (Cloud + Server)        | Linear integration                |
|                                               | Slack notifications              | Jira integration                  |
| Analytics                                     | Delivery health scores          | Agent co-authorship tracking      |
|                                               | Natural language queries        |                                  |
| Platform                                      | Open-source core engine         | Watchflow                        |
|                                               | Enterprise SSO                  |                                  |

## Semgrep finds bugs in code. Warestack governs how code ships.

If your challenge is static analysis coverage, Semgrep is excellent. If your challenge is governing agent-authored PRs, enforcing instruction files, and tracking delivery health across teams — Warestack is purpose-built for that.