Semgrep MCP (Semgrep Guardian)
Semgrep's MCP server, now shipped in the semgrep CLI (`semgrep mcp`) and bundled as Semgrep Guardian plugins to scan agent-written code for vulnerabilities.
Tags
Description
The standalone semgrep/mcp repo is archived; the server moved into the main semgrep repository and is invoked with the mcp subcommand of the Semgrep CLI (brew install semgrep), over stdio or Streamable HTTP. Semgrep Guardian packages it for Claude Code (plugin marketplace, then /setup-semgrep-plugin), Cursor (Cursor Plugin Marketplace), VS Code/Copilot, Windsurf and Kiro. Some tools connect to the Semgrep AppSec Platform and need a login and Semgrep token.
Agent access
Related
- SonarQube MCP Server: SonarSource's official MCP server: agents query SonarQube Cloud or Server issues, quality gates, hotspots and metrics, and analyze code snippets.
- Snyk Agent Scan: Security scanner that discovers agent components on your machine (agents, MCP servers, skills) and scans them for prompt injections and vulnerabilities.
- Trail of Bits Skills: Trail of Bits' plugin marketplace of agent skills for security research, vulnerability detection, testing and audit workflows.
Guides & comparisons
- Scan agent-written code for vulnerabilities with the Semgrep MCP server (Guide): Give a coding agent a deterministic security scanner. Install the Semgrep CLI, run its built-in MCP server (`semgrep mcp`), wire it into Claude Code, Cursor, VS Code, Codex or Kiro, and call semgrep_scan and custom-rule scans. Includes two gotchas we hit, and when SonarQube's MCP server fits better.
Sources
- https://github.com/semgrep/semgrep/blob/develop/cli/src/semgrep/mcp/README.md
- https://github.com/semgrep/mcp
- https://github.com/semgrep/semgrep
Machine-readable
- JSON
- Markdown
- Source file on GitHub (edit via pull request)