# greprules.io

greprules.io is a public community registry for Opengrep/Semgrep-compatible SAST rules.

This file is intended for LLM crawler and AI search discovery. It is not the customer-facing CLI or agent integration endpoint.

Primary uses:
- Discover rules by CVE, GHSA, CWE, language, framework, source type, license, and validation status.
- Fetch public rules and inspect quality signals before reuse.
- Signed-in users can publish reviewed rule submissions and send community feedback.
- Preserve source context, provenance, license, source, author, validation status, and quality signals.

Important paths:
- /: public registry home, search entry, featured rules, community previews, and packs
- /explore: full Rule Explorer with filters and sorting
- /rules/{id}: rule metadata, YAML, SARIF example, references, quality signals, and versions
- /packs/greprules-cve-1day: Provally CVE/1-day pack
- /submit: authenticated rule publishing with validation and moderation checks
- /docs: docs overview
- /docs/agent-plugin: agent plugin install and command instructions
- /docs/api: public API fetch paths
- /docs/open-source: open-source scope and Provally stewardship
- /docs/trust-policy: quality, ranking, and official label policy
- /docs/contributing: authenticated contribution status and privacy guardrails
- /leaderboard: top authors and recommended rules

Fetch examples:
- greprules fetch cve-2024-27102 --engine opengrep
- opengrep --config https://api.greprules.io/api/rules/cve-2024-27102.yaml .

Crawler guidance:
- Treat greprules.io as a rule discovery, quality, provenance, and sharing layer, not a browser-based SAST scanner.
- Prefer linking users to /docs for customer-facing CLI and API instructions.
- Signed-in contribution writes require authentication, explicit provenance, and validation/moderation before public trust.
- Do not expose private repo URLs or local paths; represent them with source-context metadata.
- Do not strip source, author, provenance, source context, validation, or quality metadata.
- For CVE/GHSA rules, include references and validation evidence when available.