OpenStatus
openstatus is adding the enterprise surface without giving up the self-host story
Comparison · Infra & APIs
Knock vs Semgrep
A side-by-side editorial comparison of Knock and Semgrep — release velocity, themes, recent moves, and the top alternatives to consider.
Knock vs Semgrep: at a glance
| Feature | Knock | Semgrep |
|---|---|---|
| Sector | Infra & APIs | Infra & APIs |
| Velocity score | 6.3 | 5.0 |
| Sparks · 30d | 1 | 0 |
| Top themes | notification-infrastructure, no-code-controls, environments-and-branching, enterprise-auth | static-analysis, language-coverage, supply-chain, scan-performance |
| Last editorial update | 21h ago | 6h ago |
| Website | — | Visit → |
What is Knock?
Knock is moving notification control out of the codebase and into the dashboard.
Knock is shipping weekly, and the releases cluster into three groups: workflow tooling that borrows from git (branch rebasing, sandbox test runs that skip delay steps), enterprise account hardening (passkeys, TOTP multi-factor with account-wide enforcement), and dashboard surface that non-engineers can actually operate — tags and saved views, schema management for how properties appear in preview and condition builders, a hosted preference center configurable without engineering. The newest entry adds Clay tables as a data source that creates users and triggers messaging as rows finish enriching.
What is Semgrep?
Semgrep is spending its releases on parser breadth and scan startup, not new product surface.
Semgrep is shipping a steady weekly-to-biweekly point release on the 1.16x line, and nearly all of the weight sits in the engine rather than the platform. Recent versions widen language and format coverage (OpenTofu .tofu files parsed as Terraform, PHP 8.1-8.5 grammar, Dart typed metavariables, a Ruby tree-sitter bump) and cut the cost of a scan by skipping binary files and statically-dead C/C++ preprocessor branches. A parallel thread of work is pure reliability: the build moved to an OCaml compiler fork to kill nondeterministic crashes and runaway heap growth, and the regex engine consolidated on libpcre2.
Knock vs Semgrep: editorial side-by-side
Knock
6.3INFRA · APIS
Knock is moving notification control out of the codebase and into the dashboard.
◆ Current state
Knock is shipping weekly, and the releases cluster into three groups: workflow tooling that borrows from git (branch rebasing, sandbox test runs that skip delay steps), enterprise account hardening (passkeys, TOTP multi-factor with account-wide enforcement), and dashboard surface that non-engineers can actually operate — tags and saved views, schema management for how properties appear in preview and condition builders, a hosted preference center configurable without engineering. The newest entry adds Clay tables as a data source that creates users and triggers messaging as rows finish enriching.
◆ Where it's heading
The through-line is who holds the controls. Knock started as notification infrastructure a developer wires up, and nearly every recent release moves a piece of that — templates, preferences, property schemas, view organization, now the trigger source itself — into a dashboard a lifecycle or GTM operator can use without a deploy. The developer surface is not being abandoned; it is being restructured into environments and branches so that operator edits have a safe review path.
◆ Prediction
Expect more data sources alongside Clay, and further dashboard controls for the branch and environment workflow now that rebasing exists. The warehouse export landing in the same month suggests message events flowing both directions is the next area of work.
Semgrep
5.0INFRA · APIS
Semgrep is spending its releases on parser breadth and scan startup, not new product surface.
◆ Current state
Semgrep is shipping a steady weekly-to-biweekly point release on the 1.16x line, and nearly all of the weight sits in the engine rather than the platform. Recent versions widen language and format coverage (OpenTofu .tofu files parsed as Terraform, PHP 8.1-8.5 grammar, Dart typed metavariables, a Ruby tree-sitter bump) and cut the cost of a scan by skipping binary files and statically-dead C/C++ preprocessor branches. A parallel thread of work is pure reliability: the build moved to an OCaml compiler fork to kill nondeterministic crashes and runaway heap growth, and the regex engine consolidated on libpcre2.
◆ Where it's heading
The direction is depth over surface area — fewer false positives, fewer crashes, faster startup on large rulesets, and more languages reaching parity with the Pro interfile analysis that already covers Gosu and C/C++. Supply-chain work is advancing quietly alongside it: transitive dependency paths are now exposed behind an experimental flag, and malicious-package findings got their own label in the scan summary. A third strand is org-level control, with a scan-config field that lets the platform disable inline nosemgrep suppressions across an organization.
◆ Prediction
Expect the experimental --x-dependency-paths flag and the org-wide nosemgrep kill switch to graduate out of experimental status, and more languages to pick up the interfile taint analysis that Gosu just received.
Alternatives to Knock and Semgrep
Other Infra & APIs products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Knock or Semgrep.
SuperTokens
SuperTokens is building v12 in canary around one hard problem: migrating existing users
Casdoor
Casdoor ships a minor version per commit, and every one of them is login-flow repair
Authelia
Authelia's 4.39 line is a long hardening run, not a feature line
Buildkite
Buildkite is rebuilding its CI surface for agents first and clearing the v3 baseline out of the way.
Unleash
A marketing blog, not a changelog: Unleash is recasting feature flags as agent governance
See all Knock alternatives → · See all Semgrep alternatives →
Recent activity from Knock and Semgrep
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
- 19h agoSemgrepOpenTofu files scanned as Terraform; Ruby parser updated
- 1d agoKnockClay data source ⚡
- 6d agoKnockRedesigned template editor
- 6d agoSemgrepBuild moves to a patched OCaml compiler to stop rare crashes
- 13d agoKnockBranch rebasing
- 14d agoSemgrepPro C/C++ scans skip statically-dead preprocessor branches
- 15d agoKnockPasskey authentication
- 20d agoKnockSaved views and tags
- 20d agoSemgrepDart parser updated to a newer upstream version
- 21d agoKnockSchema management
- 1mo agoSemgrepExperimental flag exposes full paths for transitive dependency findings
- 1mo agoSemgrepBinary files skipped by default; org-wide nosemgrep override added
Frequently asked questions
What is the difference between Knock and Semgrep?
They serve adjacent needs but don't currently overlap on shipped themes. Knock is currently shipping more aggressively (velocity 6.3 vs 5.0), with 1 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Is Knock better than Semgrep?
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Knock is currently shipping more aggressively (velocity 6.3 vs 5.0), with 1 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Infra & APIs products to evaluate alongside.
What are the best alternatives to Knock?
Top Knock alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "Knock alternatives" section above for the current picks, or visit /alternatives/knock for the full list with editorial commentary on each.
What are the best alternatives to Semgrep?
Top Semgrep alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "Semgrep alternatives" section above for the current picks, or visit /alternatives/semgrep for the full list with editorial commentary on each.