MCP server · Code and developer tools
Semgrep MCP server
Lets an assistant scan code for security issues with Semgrep, write custom rules and pull findings from Semgrep AppSec Platform.
- Maintainer
- Semgrep (official)
- Licence
- LGPL-2.1-or-later
- Runs
- Locally (semgrep)
- Sign-in
- Optional token
- Last activity
- 2026-10-07
Overview
What it does
The Semgrep MCP server now ships inside the Semgrep CLI as the semgrep mcp subcommand. The old standalone semgrep/mcp repository and its semgrep-mcp package are deprecated and archived. Once the CLI is installed, the server runs over stdio by default, or over Streamable HTTP on 127.0.0.1:8000 with -t streamable-http. The semgrep/semgrep Docker image can run it too.
Use it when you want an assistant to check the code it has just written for security problems before you commit. It can scan files with Semgrep’s rules or a custom rule, check dependencies, show a file’s abstract syntax tree and explain the rule schema. With a SEMGREP_APP_TOKEN it can also fetch findings from Semgrep AppSec Platform. For Claude Code and Cursor, Semgrep recommends its Semgrep Guardian plugin, which bundles the MCP server with hooks and skills and installs the CLI for you.
Tools
What the assistant can do
- Scan code files for security issues (semgrep_scan)
- Scan with a custom Semgrep rule
- Scan dependencies for supply chain issues
- Fetch findings from Semgrep AppSec Platform (semgrep_findings)
- Show the abstract syntax tree of a file
- List supported languages and the rule schema
- Prompt for writing a custom rule
Install
Install Semgrep MCP server in your app
You need:
- The Semgrep CLI (for example brew install semgrep); the PyPI package needs Python 3.10 or newer
- Optional: a Semgrep AppSec Platform account and SEMGREP_APP_TOKEN for findings
Run in your project. --scope local keeps the servers private to you in this project; use user for every project.
claude mcp add --scope local semgrep -- semgrep mcp
claude mcp add --scope local semgrep -- semgrep mcp
Project root. Commit it to share the servers with your team; each person sets the variables in their own shell.
{
"mcpServers": {
"semgrep": {
"command": "semgrep",
"args": [
"mcp"
]
}
}
}
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json · Windows: %APPDATA%\Claude\claude_desktop_config.json (Settings → Developer → Edit Config). Restart Claude after saving.
{
"mcpServers": {
"semgrep": {
"command": "semgrep",
"args": [
"mcp"
]
}
}
}
In your project, or ~/.cursor/mcp.json for every project.
{
"mcpServers": {
"semgrep": {
"type": "stdio",
"command": "semgrep",
"args": [
"mcp"
]
}
}
}
In your workspace. VS Code asks for each secret the first time a server starts and stores it securely.
{
"servers": {
"semgrep": {
"type": "stdio",
"command": "semgrep",
"args": [
"mcp"
]
}
}
}
macOS/Linux: ~/.config/devin/mcp_config.json · Windows: %APPDATA%\devin\mcp_config.json. Read by the default Devin Local agent and by the legacy Cascade agent.
{
"mcpServers": {
"semgrep": {
"command": "semgrep",
"args": [
"mcp"
]
}
}
}
Want it alongside other servers? Open Semgrep MCP server in the MCP config generator and add the rest; it writes one file per app. The snippets follow the setup in the server’s README, checked on 2026-10-14.
Before you install
- Local scan tools read files from the paths the assistant passes, so they can reach any file your user account can read.
- SEMGREP_APP_TOKEN gives access to your organisation’s findings on Semgrep AppSec Platform. Keep it in an environment variable, not in a shared config file.
- Streamable HTTP mode opens a local port (8000 by default). Keep it bound to 127.0.0.1.
- A local MCP server runs with your user account’s permissions. Install it only from the source linked above. See how to choose a safe server.
Why it’s listed
Why we list it
A deterministic, well-known static analysis engine that assistants can call to check their own code, maintained inside Semgrep’s main CLI.
Related
More MCP servers
- GitHub MCP ServerLets an assistant read code, manage issues and pull requests, and check Actions runs in the GitHub repositories you can access.
- GitLab MCP serverGives an assistant access to GitLab projects, issues, merge requests, pipelines and search through an MCP endpoint built into GitLab.
- Sentry MCPLets a coding assistant search Sentry errors, traces and logs, triage issues and read Sentry docs while you debug.
- Figma MCP serverGives a coding assistant design context from Figma files, such as layout, variables and components, and can write back to the canvas.
- SonarQube MCP ServerConnects an assistant to SonarQube Cloud or Server to analyse code, review issues and hotspots, and check quality gates.
- Postman MCP ServerConnects an assistant to your Postman workspaces, collections, specs and environments, and can generate client code from APIs.
All MCP serversMCP config generatorGuide: MCP servers in Claude CodeGuide: what is MCP?