Semgrep

Semgrep builds application security tools. At its core is static code analysis. Static analysis means the code is checked without running it. Rules look like the code itself, which makes them easy to read. The Semgrep CLI is open source under the LGPL 2.1. The commercial AppSec Platform with Semgrep Code, Supply Chain and Secrets builds on top of it. For AI coding agents, Semgrep offers an official MCP server; MCP is an open standard that lets AI assistants use external tools.

MCP servers

Semgrep MCP Server

Official Semgrep MCP server: checks the code an AI agent writes for vulnerabilities, vulnerable dependencies and secrets, either locally through the Semgrep CLI or as the Guardian plugin for Claude Code and Codex.

Profile

Status
verified
Last reviewed
28.10.2026
Official website Is this your company? Claim this profile

Besides technically necessary cookies, we would like your consent to use privacy-friendly analytics (Matomo). See the privacy policy for details.