> ## Documentation Index > Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt > Use this file to discover all available pages before exploring further. # Semgrep Agentic Workflows (beta) > Learn how Semgrep Agentic Workflows run multi-step AI-enabled detection on a repository. Semgrep Agentic Workflows is in **beta**. Beta features are subject to change with continued internal benchmarking and customer feedback. Semgrep Agentic Workflows encodes multi-step application security analysis as reproducible pipelines. A single Agentic Workflows pipeline can run several analysis steps in sequence. It takes code and security context as input, combines program analysis, deterministic tools, and constrained AI-based reasoning, and produces reviewable security issues. During the beta, Semgrep Agentic Workflows provides a curated set of vulnerability **detection** workflows that you run from **Semgrep AppSec Platform**. To run Agentic Workflows for the first time, see [Get started with Semgrep Agentic Workflows (beta)](/workflows/get-started). ## Agentic Workflows versus other Semgrep analysis Semgrep Agentic Workflows performs targeted analysis that combines multiple analysis techniques and reasoning steps. It complements Semgrep Code's rule-based scanning and AI-powered detection. The following table compares Semgrep detection options. For the nine Agentic Workflows and the classes they target, see [Detection coverage](#detection-coverage). | Analysis | Coverage | How it works | Output | | ------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ----------------------------- | | [Semgrep Code](/semgrep-code/overview) | Known insecure patterns defined in Semgrep rules. | Applies deterministic rules to source code. | Code findings | | [AI-powered detection scans](/semgrep-code/ai-powered-detection-concepts) | Business-logic flaws that are difficult to express as generic rules, such as IDORs and broken authorization. | Uses AI-based analysis together with Semgrep program analysis. | AI-powered detection findings | | [Semgrep Agentic Workflows](/workflows/get-started) | On-demand detection across 70+ [CWEs](https://cwe.mitre.org/), including common injection, XSS, SSRF, cryptography, and broader web, API, and crypto security analysis. | Runs a built-in sequence of analysis steps, such as specialized analyzers and AI reasoning, against a selected repository. | Agentic Workflows issues | ## How Agentic Workflows work The following concepts describe how analysis is organized: * **Agentic Workflows**: A reusable definition of an application security pipeline. It specifies the analysis to perform and the type of issue or coverage objective to evaluate. * **Run**: An on-demand request to execute one or more Agentic Workflows against a selected repository. A run can include one or more jobs. * **Job**: One execution of an Agentic Workflow against a single repository. * **Finding**: The immutable raw output of a single detection workflow job. Findings appear on the job details page after a job finishes. * **Issue**: The deduplicated, processed output of the pipeline. Issues appear on the **Workflows** page in Semgrep AppSec Platform and include the evidence and context available from the run. When you start Agentic Workflows, Semgrep clones the repository through its source code manager connection. The workflow runs its jobs and produces findings. Semgrep processes and deduplicates those findings into reviewable issues. You can monitor jobs on the **Projects** page and then review issues on the **Workflows** page in Semgrep AppSec Platform. ## Detection coverage During the beta, Semgrep offers nine pre-built detection workflows. Together, these workflows cover 70+ [CWEs](https://cwe.mitre.org/), including common injection, XSS, SSRF, and cryptography issues, as well as broader web, API, and crypto security analysis. This coverage is **additional** to what [Semgrep Code](/semgrep-code/overview) and [AI-powered detection](/semgrep-code/ai-powered-detection-concepts) already cover. **Semgrep's default** workflow runs all nine of these workflows. Coverage depends on the workflow, repository language, framework, and available code context. A workflow might not analyze every file or detect every instance of a vulnerability class. Continue to use Semgrep Code and Semgrep Supply Chain for continuous rule-based scanning. ### Available workflows | Workflow | What it finds | | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | | SQL injection | Traces user-controlled data into dynamic queries that lack effective parameter binding or allow-list validation. | | XSS | Traces user-controlled input to unsafe HTML rendering sinks, across reflected, stored, and DOM-based cases. | | SSRF | Traces user-controlled data into network requests that lack effective validation. | | Command injection | Traces untrusted input to shell and process-execution APIs across supported languages. | | NoSQL injection | Traces untrusted input into query and scripting operations in MongoDB, Redis, and Elasticsearch. | | Crypto weak hash | Flags security-sensitive use of MD2, MD4, MD5, and SHA-1, while filtering out benign checksum, cache-key, and identifier uses. | | Broad web security | Audits application code across web, API, cryptography, access control, and AI security, then filters by confidence and exploitability. | | Broad API security | Audits REST, GraphQL, gRPC, SOAP, JSON-RPC, and webhook APIs, then prioritizes findings by exploitability. | | Broad crypto security | Audits cryptography, password hashing, key management, signatures, randomness, and TLS, then prioritizes by exploitability. | ## Credit usage and billing Agentic Workflows runs consume [AI credits](/usage-and-billing/overview#ai-credits). The amount of credits used for each run is shown in the **Workflow jobs** view for each project. If a run fails, Semgrep still debits credits for any steps that already completed. See [Usage and billing](/usage-and-billing/overview#ai-credits) for details. ## Beta limitations During the beta: * Runs must be started on demand. Scheduled runs are not available. * Only organization [Admins](/deployment/teams/overview#roles-and-access) can start Agentic Workflows runs. * Creating, modifying, or publishing custom Agentic Workflows is not supported. * Agentic Workflows runs only as a Semgrep-hosted service. Local CLI execution and customer CI environments are not supported. * Agentic Workflows issues are shown separately from findings created by other types of scans. * The API is experimental and can change. * Some deployment configurations are unsupported. See [Unsupported configurations](/workflows/get-started#unsupported-configurations). * Detection coverage and supported repositories vary by workflow. ## Next steps See [Get started](/workflows/get-started) to run your first Agentic Workflows.