Skip to content
Semgrep MCP

Semgrep MCP

by Semgrep
Released
3 views
MIT
Repository Docs
Developer Tools

Summary

Semgrep's official MCP server — scan code for security vulnerabilities, write and test custom rules, and pull findings from Semgrep Cloud, from inside an agent session.

Features

  • Scans code for security vulnerabilities against Semgrep's registry rulesets
  • Runs agent-authored custom rules without leaving the session
  • Exposes the parsed AST so an agent can see what a rule actually matches
  • Reads findings from the Semgrep Cloud Platform for connected projects
  • Runs locally via uvx or Docker so source never leaves your machine
  • Hosted endpoint available at mcp.semgrep.ai for zero-install use

Installation

Set up this MCP server in your favorite AI agent — copy a ready-made configuration below.

Any MCP-compatible agent

Most agents (Claude, Cursor, Windsurf, VS Code, and more) read a standard mcpServers configuration.

  1. Open your agent's MCP configuration file.
  2. Merge the snippet below into it.
  3. Restart the agent — the "Semgrep MCP" tools will be available.
{
  "mcpServers": {
    "semgrep-mcp": {
      "command": "uvx",
      "args": [
        "semgrep-mcp"
      ]
    }
  }
}

Description

Semgrep MCP puts static analysis in the loop while code is being written rather than after it is pushed. Semgrep is a fast, rules-based scanner that matches patterns against a parsed syntax tree, so it understands code structure instead of grepping text — and an agent that can call it gets a real second opinion on the code it just generated.

Tools it exposes
  • `security_check` — a quick pass over a snippet or file for common vulnerability classes.
  • `semgrep_scan` — a full scan against the registry rulesets.
  • `semgrep_scan_with_custom_rule` — run a rule the agent just wrote, which makes iterating on a custom rule a conversation rather than a file-edit-rerun loop.
  • `get_abstract_syntax_tree` — dump the parsed AST, useful when the agent is authoring a rule and needs to see what it is matching against.
  • `semgrep_findings` — read findings from the Semgrep Cloud Platform for a connected project.
  • Supporting tools for supported languages and the rule schema.
Ways to run it

Local stdio via uvx semgrep-mcp (PyPI package semgrep-mcp), a container at ghcr.io/semgrep/mcp, or Semgrep's hosted endpoint at https://mcp.semgrep.ai/mcp. The local paths keep source code on your machine, which matters if you cannot send proprietary code to a third-party endpoint.

Project status

MIT-licensed and maintained by the Semgrep team. The standalone semgrep/mcp repository has been archived and active development has moved into the main semgrep/semgrep repository — the server itself is still current, but check the main repository for the latest changes.

Related MCP Servers

MCP: Arm MCP Server

by Arm

New

Arm's official MCP server for porting and tuning software on Arm — semantic docs search, codebase migration scanning, container architecture checks and LLVM-MCA assembly analysis.

Developer Tools

MCP: AntV Chart MCP

by AntV

New

Official AntV MCP server that turns a description of your data into a rendered chart — 26 visualization types from bar and line to sankey, mind-map, fishbone and geographic maps.

Developer ToolsDatabases & Data
1 views

MCP: Headroom

by Headroom Labs

New

Context-compression MCP server that shrinks tool outputs, logs, files and RAG chunks before they reach the model, cutting 60-95% of tokens on JSON payloads.

Developer Tools
3 views

MCP: Engram

by Gentleman Programming

New

Persistent memory for coding agents as a single Go binary — SQLite and FTS5 behind MCP, an HTTP API, a CLI and a TUI, with no Node, Python or Docker required.

Developer Tools
2 views
Browse all MCP servers →