Semgrep also a CLI, that can run offline and without a cloud account.
At work, we use it for enforcing a bunch of custom lint rules configured as a yaml file committed directly to our repo, entirely cloud-free.
(I may be overreading your comment as suggesting that these were reasons to use ast-grep over semgrep.)