How fennec compares
How fennec compares with Semgrep, OpenGrep, CodeQL, Snyk Code, and SonarQube on speed, taint analysis, post-quantum readiness, and price. Figures come from each vendor's docs.
01Capability matrix
| Capability | fennecRust CLI | SemgrepOSS + SaaS | OpenGrepSemgrep fork | CodeQLGitHub | Snyk CodeSaaS | SonarQubeServer |
|---|---|---|---|---|---|---|
| Free, no account requiredFull local scan with no login, token, or paid tier? fennec offers a 14-day trial. | 14-day trial | ✓ | ✓ | OSS / public | — | Community ed. |
| Single static binary | ✓ | — | Release binary | CLI bundle | — | — |
| Sub-second local scansOn small-to-medium repos; measured numbers below. | ✓ | — | — | — | — | — |
| Runs fully offlineDefault scan, no data leaves the machine. SaaS tools upload code or require an account. | ✓ | ✓ | ✓ | ✓ | — | Self-host |
| Intra-file taint / dataflow | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Cross-file taint in the base planfennec: Python, JS, Go, Java, Ruby, PHP, C#, Kotlin (8 langs). Semgrep needs Pro; SonarQube needs Developer ed.; OpenGrep is per-file today. | ✓ | Paid (Pro) | Per-file | ✓ | ✓ | Paid (Dev+) |
| Autofix / remediation | ✓ | ✓ | ✓ | Copilot | DeepCode AI | AI CodeFix |
| Custom rulesfennec runs Semgrep-style YAML today; a native DSL is on the roadmap. | Semgrep YAML | YAML DSL | YAML DSL | QL | — | Plugins / XPath |
| Loads Semgrep / OpenGrep YAMLIngests ~98% of the Semgrep/OpenGrep registry via --rules (parity-tested in CI). | ✓ | ✓ | ✓ | — | — | — |
| Secrets detection | ✓ | Paid product | — | GitHub sep. | Limited | ✓ |
| Post-quantum crypto auditCNSA 2.0 readiness. Flags pre-quantum primitives: RSA, ECDSA, ECDH, DH, DSA. | ✓ | — | — | — | — | — |
| CBOM generationCryptographic Bill of Materials. Lists every crypto primitive in the codebase. | ✓ | — | — | — | — | — |
| SARIF output | ✓ | ✓ | ✓ | ✓ | ✓ | Import |
| IDE extension | VS Code | ✓ | LSP | VS Code | ✓ | SonarLint |
| GitHub PR comments | ✓ | ✓ | CI-based | ✓ | ✓ | ✓ |
| Managed SaaS dashboard | — | ✓ | — | via GitHub | ✓ | SonarCloud |
✓ out of the box · — not available · text = caveat (paid tier / partial / different mechanism). Check each vendor for current details.
02Core attributes
| Attribute | fennecRust CLI | SemgrepOSS + SaaS | OpenGrepSemgrep fork | CodeQLGitHub | Snyk CodeSaaS | SonarQubeServer |
|---|---|---|---|---|---|---|
| Written in | Rust | OCaml + Python | OCaml | Proprietary engine | Proprietary (DeepCode AI) | Java |
| License | Commercial | LGPL-2.1 (engine) | LGPL-2.1 | MIT queries / proprietary CLI | Proprietary | LGPLv3 (Community) + commercial |
| Distribution | Single static binary | Python wheel + runtime | Signed release binaries | CLI bundle + DB build step | CLI + cloud | Server + scanner |
| Install | npx, curl, cargo, brew | pip, brew, Docker | install script | download / GitHub Action | CLI, IDE, SaaS | Docker / self-host |
| Languagesfennec: 12 programming languages plus config/infra. Counts vary by edition/version. | 12 + config | 30+ | 30+ | ~11 | ~10 | ~30 |
| Rule model | 200+ built-in (CWE-mapped) + YAML | YAML registry + Pro packs | Semgrep-compatible YAML | QL query packs | Vendor-maintained | Built-in + plugins |
03Performance
| Metric | fennec | Semgrep |
|---|---|---|
| Typical scan time (medium repo) | < 1 second | 10-30 seconds |
| Cold start (no cache) | < 1 second | 5-15 seconds |
| Memory usage | ~50 MB | ~500 MB+ |
| Parallel execution | Rayon (work-stealing) | Multiprocess |
Same hardware and rulesets; reproduce with ./benchmarks/run.sh. OpenGrep forks the Semgrep engine, so its numbers track Semgrep. CodeQL builds a database before it can query and SonarQube runs as a server. Both are heavier by design and are not sub-second local tools.
04Unique to fennec
None of the other five ship these out of the box:
- ✓Post-quantum crypto audit (CNSA 2.0)
fennec pqc . flags RSA, ECDSA, ECDH, DH, and DSA against NSA CNSA 2.0 timelines.
- ✓CBOM generation
fennec pqc . --format cbom inventories every crypto primitive for compliance and supply-chain reports.
- ✓TUI triage mode
fennec tui . opens an interactive UI to review findings, read dataflow traces, and suppress inline.
- ✓Sub-second scans from a single binary
One Rust binary that scans in milliseconds. It runs without a runtime, a database build, or a server.
05Pricing & licensing
| Tool | License | Cost model |
|---|---|---|
| fennec | Commercial (Singularity RD) | Team $15/contributor/mo, 14-day trialCode, secrets, dependency and post-quantum scanning in one seat. Scans run locally; no token limits. |
| Semgrep | LGPL-2.1 (OSS engine) | Free OSS + Teams $30 per product/contributor/moCLI engine is open source; cross-file (Pro), Secrets, and the AppSec Platform are paid. |
| OpenGrep | LGPL-2.1 (community fork) | FreeVendor-neutral fork of the Semgrep engine (2025); no paid tier or hosted platform. |
| CodeQL | MIT queries / proprietary CLI | Free for OSS; paid for privateFree on public repos and for research; private use needs GitHub Advanced Security. |
| Snyk Code | Proprietary SaaS | Free tier + Team from ~$25/dev/moCloud-based; code is uploaded by default. Limited free tier, paid team/enterprise plans. |
| SonarQube | LGPLv3 (Community) + commercial | Community free; Developer/Enterprise by LOCSelf-hosted Community Build is free; cross-file taint and many languages need Developer Edition+. |
Terms change; figures reflect each vendor's published model, not a quote.
When to pick fennec
- ✓You want a fast, local scanner with flat per-contributor pricing and no token limits.
- ✓You need post-quantum crypto auditing (CNSA 2.0) or a CBOM.
- ✓You want a single static binary that runs without a runtime or database build.
- ✓You need cross-file taint for Python, JS, Go, Java, Ruby, PHP, C#, or Kotlin without a paid license.
When another tool might fit better
- →Semgrep / OpenGrep for a native custom-rule DSL, or 30+ languages including Scala and Terraform.
- →CodeQL for GitHub Advanced Security with deep QL queries and in-platform code scanning.
- →Snyk Code / SonarQube for a managed SaaS or server with team dashboards, policy gates, and quality metrics.
Try fennec on your codebase
Run one command to scan your code. No config required; start with a 14-day trial.
npx @singularityrd/fennec .