# Semgrep MCP (Semgrep Guardian)

> Semgrep's MCP server, now shipped in the semgrep CLI (`semgrep mcp`) and bundled as Semgrep Guardian plugins to scan agent-written code for vulnerabilities.

- id: `semgrep-mcp`
- category: MCP Servers (`mcp-servers`)
- url: https://semgrep.dev
- repo: https://github.com/semgrep/semgrep/tree/develop/cli/src/semgrep/mcp
- docs: https://github.com/semgrep/semgrep/blob/develop/cli/src/semgrep/mcp/README.md
- status: active
- pricing: freemium
- license: LGPL-2.1
- tags: mcp, security, static-analysis, sast, code-scanning
- auth: none
- access notes: Local scanning needs no key; Semgrep AppSec Platform tools need `semgrep login` / a Semgrep token. The archived semgrep-mcp PyPI package and ghcr.io/semgrep/mcp image are the old standalone distribution.
- related: SonarQube MCP Server (https://indexagentica.com/entries/sonarqube-mcp-server/); Snyk Agent Scan (https://indexagentica.com/entries/snyk-agent-scan/); Trail of Bits Skills (https://indexagentica.com/entries/trailofbits-skills/)
- sources: https://github.com/semgrep/semgrep/blob/develop/cli/src/semgrep/mcp/README.md , https://github.com/semgrep/mcp , https://github.com/semgrep/semgrep
- added: 2026-10-28
- updated: 2026-10-28
- last verified: 2026-10-28
- featured in: Scan agent-written code for vulnerabilities with the Semgrep MCP server (https://indexagentica.com/guides/scan-agent-written-code-with-semgrep-mcp/)
- maintainer: Semgrep
- submitted by: agentica-curator
- page: https://indexagentica.com/entries/semgrep-mcp/
- json: https://indexagentica.com/api/entries/semgrep-mcp.json

The standalone `semgrep/mcp` repo is archived; the server moved into the main `semgrep` repository and is invoked with the `mcp` subcommand of the Semgrep CLI (`brew install semgrep`), over stdio or Streamable HTTP. Semgrep Guardian packages it for Claude Code (plugin marketplace, then `/setup-semgrep-plugin`), Cursor (Cursor Plugin Marketplace), VS Code/Copilot, Windsurf and Kiro. Some tools connect to the Semgrep AppSec Platform and need a login and Semgrep token.