Semgrep MCP Server

The Semgrep MCP Server brings Semgrep's security checks straight into your AI coding agent. Semgrep is a widely used tool for static code analysis. Static analysis means the code is examined without running it. MCP, the Model Context Protocol, is an open standard that lets assistants such as Claude Code, Codex, Cursor or GitHub Copilot call external tools. The server comes from Semgrep itself. It used to live in a separate repository, which has been archived since October 2025. According to Semgrep, it is now developed as part of the official Semgrep CLI, whose source code is licensed under the LGPL 2.1.

What is the Semgrep MCP Server good for?

AI agents write a lot of code in very little time. Typical mistakes slip through easily: a SQL query built from concatenated strings, a hard-coded API key, or a package pinned to a version with a known vulnerability. Usually these problems only surface in CI, after the push, or during code review. The Semgrep MCP Server steps in earlier. The agent checks its own code while it is still writing it. If Semgrep finds a problem, the agent receives the finding and can regenerate the code right away. The new code is checked again. According to the documentation, Semgrep does not rewrite anything itself; it only returns findings. The decision stays with the agent and with you.

What does it check?

According to Semgrep, three areas are covered. Semgrep Code looks for vulnerable patterns in source code, such as injection flaws or weak cryptography. Supply Chain checks dependencies for known vulnerabilities. On top of that come rules that detect hard-coded credentials. This secrets detection relies on code rules and does not verify whether a key it finds is still valid. For full secrets scanning, Semgrep still recommends its dedicated product in CI.

Guardian: the plugin for Claude Code and Codex

For Claude Code and Codex, Semgrep recommends the Semgrep Guardian plugin. It bundles the MCP server with hooks and skills. A hook is a command the agent runs automatically when a certain event happens. In Claude Code, Guardian registers a hook that fires after every write, so each newly written file gets checked without you having to remember it. The plugin uses a server hosted by Semgrep, so you do not need a local CLI install. You sign in once in the browser. One important detail: the remote plugin uses a fixed ruleset called guardian-default. It is based on Semgrep's default ruleset and, according to the documentation, only contains rules for which the agent can apply a reliable fix. Your organization's own policies do not apply here.

Local option through the Semgrep CLI

For every other agent, the server runs locally through the Semgrep CLI with the command semgrep mcp. The documentation lists Cursor, GitHub Copilot in VS Code, Visual Studio and JetBrains, Devin or Windsurf, and Kiro, among others. The agent then calls the semgrep_scan tool. In this setup, the rules from your Semgrep organization's policies apply. If you have already tuned your rules, the agent gets the same results as your pipeline. Claude Code also has a local plugin that uses the local CLI instead of the hosted server.

How does Semgrep differ from alternatives?

Many security scanners only run in CI or as a downstream service. Semgrep starts at the moment code is written and returns findings in a form an agent can act on. Its rules look like the code they check, which makes them readable even for developers without a security background. In this catalog, Semgrep complements the GitGuardian MCP Server, which focuses on secrets, with broader checks of code patterns and dependencies.

Who is the Semgrep MCP Server for?

The server pays off for teams that generate a lot of code with AI agents and want to catch security issues early. If you already run Semgrep in your pipeline, the local option connects the same policies to your agent. Individual developers get started fastest with the Guardian plugin. Semgrep stresses that Guardian does not replace CI scanning but adds to it. On cost: the Semgrep CLI is open source. According to the pricing page, the platform offers a free plan for small teams as well as paid Teams and Enterprise plans. Guardian can be tried for 30 days without a credit card and is billed per seat after that.

A Semgrep account. For the Guardian plugin, Claude Code or the Codex CLI; for the local option, also the Semgrep CLI (Python 3.10 or later, installed with pipx, uv or Homebrew) signed in with semgrep login.

The Semgrep MCP Server checks the code your AI agent writes for security problems. This guide shows the two ways to set it up and what to keep in mind afterwards.

Pick the right path

Semgrep offers two options. The Guardian plugin for Claude Code and Codex uses a hosted server and needs no local install. It checks code with the fixed guardian-default ruleset. The local option runs through the Semgrep CLI and uses your Semgrep organization's policies. It is the way to go for Cursor, VS Code, GitHub Copilot, Windsurf and Kiro. If you have already tuned your rules, choose the local option.

Step 1: Install Guardian in Claude Code

Run claude plugin install semgrep@claude-plugins-official. Then start a new session with claude. Claude Code asks you to sign in to Semgrep in the browser or create an account. You only sign in once. To see whether the server is connected, run claude mcp get plugin:semgrep:guardian. From now on, every file Claude writes gets checked.

claude plugin install semgrep@claude-plugins-official
claude mcp get plugin:semgrep:guardian

Step 2: Install Guardian in Codex

First add the marketplace: codex plugin marketplace add https://github.com/semgrep/guardian --sparse .claude-plugin --sparse plugin. Then install the plugin with codex plugin add semgrep@semgrep-marketplace. Restart Codex and type: Log in to Semgrep Guardian. After signing in through the browser, verify the setup with codex plugin list --json. Codex asks whether you trust the hooks. Scans after writes only run once you approve them.

codex plugin marketplace add https://github.com/semgrep/guardian --sparse .claude-plugin --sparse plugin
codex plugin add semgrep@semgrep-marketplace
codex plugin list --json

Step 3: Local option for Cursor and VS Code

Install the Semgrep CLI, ideally with pipx install semgrep or uv tool install semgrep as the documentation suggests. You need Python 3.10 or later. Sign in with semgrep login. In VS Code, create the file .vscode/mcp.json with a server named semgrep, the command semgrep and the argument mcp. After a reload, the Semgrep tools are available in Copilot Chat's Agent mode. VS Code has no post-write hook. The agent therefore only checks code when it calls the tool. Ask it to do so explicitly. In Cursor, install Semgrep from the plugin marketplace, which brings hooks along.

pipx install semgrep
uv tool install semgrep

Read findings the right way

Semgrep does not rewrite code itself. It reports findings, and the agent decides whether to regenerate the code. The new code is checked again. A clean scan does not mean the code is secure, though. The guardian-default ruleset is deliberately small. Keep running Semgrep in CI.

PHP notice on the first write

The plugin for Claude Code and Codex checks the local PHP version once per session. If that version has actively exploited vulnerabilities, Guardian blocks the first write command and names the version to upgrade to. If PHP is not installed, the check is skipped.

Guardian plugin: OAuth with a one-time browser sign-in, credentials stored in ~/.semgrep/guardian.yml, tokens refreshed automatically. Local option: semgrep login, credentials stored in ~/.semgrep/settings.yml. According to the documentation, OAuth credentials take precedence over an API token when both exist.

Reads the files the agent writes or edits and returns findings. According to the documentation, Semgrep itself does not change any code. The Claude Code and Codex plugin also runs php -v once per session and blocks the first write command if the PHP version has actively exploited vulnerabilities.

The Guardian plugin for Claude Code and Codex uses a scanner hosted by Semgrep, so the code being checked is sent to Semgrep. The local option scans with the Semgrep CLI on your own machine and loads its rules from your organization's policies.

Low, because the server only checks and changes nothing. Keep in mind: with the remote plugin, code leaves your machine. A clean scan does not mean the code is secure; the guardian-default ruleset is deliberately limited. CI scanning should therefore stay in place.