Skip to main content
Watch: I Built an AI App Without Leaving Databricks

Auth and security - official Semgrep server

Semgrep MCP server

Exposes Semgrep static analysis to AI agents: scan code for security vulnerabilities, run custom rules, run supply chain scans, fetch the AST and pull findings from Semgrep AppSec Platform. It ships inside the Semgrep CLI as the semgrep mcp subcommand and is bundled with hooks and skills as Semgrep Guardian. It runs locally from semgrep (pypi) with OAuth or API key auth.

Last verified 9 tools11 sources

Install

Claude Code

About Claude Code
Terminal
claude plugin install semgrep@claude-plugins-official

Codex

About Codex
Terminal
codex plugin marketplace add https://github.com/semgrep/guardian --sparse .claude-plugin --sparse plugin
codex plugin add semgrep@semgrep-marketplace

VS Code

JSON
{
  "servers": {
    "semgrep": {
      "command": "semgrep",
        "args": ["mcp"]
    }
  }
}

Generic

JSON
{
  "mcpServers": {
    "semgrep": {
      "command": "semgrep",
      "args": ["mcp"],
      "env": {
        "SEMGREP_APP_TOKEN": "${SEMGREP_TOKEN}"
      }
    }
  }
}

Tools

semgrep_scan
Runs a Semgrep scan locally on provided code files and returns the findings in JSON format.
semgrep_scan_remote
Runs a Semgrep scan on provided code content and returns the findings in JSON format (hosted mode only).
semgrep_scan_with_custom_rule
Runs a Semgrep scan with a custom rule on provided code content.
semgrep_scan_supply_chain
Runs a Semgrep supply chain scan on the provided workspace directory to identify third-party security vulnerabilities.
semgrep_findings
Fetches findings from the Semgrep AppSec Platform Findings API.
get_abstract_syntax_tree
Returns the Abstract Syntax Tree (AST) for the provided code file in JSON format.
get_supported_languages
Returns a list of supported languages by Semgrep.
semgrep_rule_schema
Get the schema for a Semgrep rule.
semgrep_whoami
Returns the identity of the current user (HTTP transports with OAuth only).

As documented on October 17, 2026. A running server reports its current list through tools/list.

Notes and caveats

  • The standalone semgrep/mcp repo (PyPI semgrep-mcp, ghcr.io/semgrep/mcp) is deprecated; the server now lives in the main semgrep repo and runs as semgrep mcp.
  • The recommended Claude Code and Codex setups install the Semgrep Guardian plugin (MCP server plus hooks and skills).
  • These use Semgrep's hosted remote server with OAuth, need no local CLI, and run a fixed guardian-default ruleset that ignores org Policies.
  • The docs do not publish a hosted endpoint URL; the deprecated repo listed https://mcp.semgrep.ai as experimental.
  • Every other agent needs the local Semgrep CLI signed in with semgrep login, and those setups apply org Policies.
  • SEMGREP_APP_TOKEN is optional for AppSec Platform features.
  • Windows needs WSL.
  • Cursor install is through the Cursor Plugin Marketplace, with no config snippet documented.
  • Separately, https://semgrep.dev/docs/mcp is a docs-search MCP endpoint, not this server.

More MCP servers for auth and security

Related reading

FAQ

What does the Semgrep MCP server do?

Exposes Semgrep static analysis to AI agents: scan code for security vulnerabilities, run custom rules, run supply chain scans, fetch the AST and pull findings from Semgrep AppSec Platform. It ships inside the Semgrep CLI as the semgrep mcp subcommand and is bundled with hooks and skills as Semgrep Guardian. The vendor documents 9 tools, including semgrep_scan, semgrep_scan_remote, semgrep_scan_with_custom_rule and semgrep_scan_supply_chain.

How do I add the Semgrep MCP server to Claude Code?

Run claude plugin install semgrep@claude-plugins-official, copied from Semgrep's docs. This page also has snippets for Codex, VS Code and Generic.

Does the Semgrep MCP server need authentication?

Yes, OAuth or API key. Transport: stdio, Streamable HTTP. Status: Unlabelled, last checked October 17, 2026.

Sources

Last verified against 11 Semgrep pages, then re-checked independently.

Newsletter

New MCP servers, the week they ship

One email per week. New official MCP servers, the coding tools that support them and how developers wire them up.