Semgrep MCP

MIT

securitysaststatic-analysiscode-reviewvulnerabilitiessemgrep

Summary

Semgrep's official MCP server — scan code for security vulnerabilities, write and test custom rules, and pull findings from Semgrep Cloud, from inside an agent session.

Features

Scans code for security vulnerabilities against Semgrep's registry rulesets
Runs agent-authored custom rules without leaving the session
Exposes the parsed AST so an agent can see what a rule actually matches
Reads findings from the Semgrep Cloud Platform for connected projects
Runs locally via uvx or Docker so source never leaves your machine
Hosted endpoint available at mcp.semgrep.ai for zero-install use

Installation

Set up this MCP server in your favorite AI agent — copy a ready-made configuration below.

Any MCP-compatible agent

Most agents (Claude, Cursor, Windsurf, VS Code, and more) read a standard mcpServers configuration.

Open your agent's MCP configuration file.
Merge the snippet below into it.
Restart the agent — the "Semgrep MCP" tools will be available.

{
  "mcpServers": {
    "semgrep-mcp": {
      "command": "uvx",
      "args": [
        "semgrep-mcp"
      ]
    }
  }
}

Claude Code

Add the server with a single CLI command.

claude mcp add semgrep-mcp -- uvx semgrep-mcp

Claude Desktop

Add the server to claude_desktop_config.json (Settings → Developer → Edit Config).

{
  "mcpServers": {
    "semgrep-mcp": {
      "command": "uvx",
      "args": [
        "semgrep-mcp"
      ]
    }
  }
}

Cursor

{
  "command": "uvx",
  "args": [
    "semgrep-mcp"
  ]
}

Containerised stdio server

{
  "command": "docker",
  "args": [
    "run",
    "-i",
    "--rm",
    "ghcr.io/semgrep/mcp",
    "-t",
    "stdio"
  ]
}

Description

Semgrep MCP puts static analysis in the loop while code is being written rather than after it is pushed. Semgrep is a fast, rules-based scanner that matches patterns against a parsed syntax tree, so it understands code structure instead of grepping text — and an agent that can call it gets a real second opinion on the code it just generated.

Tools it exposes

`security_check` — a quick pass over a snippet or file for common vulnerability classes.
`semgrep_scan` — a full scan against the registry rulesets.
`semgrep_scan_with_custom_rule` — run a rule the agent just wrote, which makes iterating on a custom rule a conversation rather than a file-edit-rerun loop.
`get_abstract_syntax_tree` — dump the parsed AST, useful when the agent is authoring a rule and needs to see what it is matching against.
`semgrep_findings` — read findings from the Semgrep Cloud Platform for a connected project.
Supporting tools for supported languages and the rule schema.

Ways to run it

Local stdio via uvx semgrep-mcp (PyPI package semgrep-mcp), a container at ghcr.io/semgrep/mcp, or Semgrep's hosted endpoint at https://mcp.semgrep.ai/mcp. The local paths keep source code on your machine, which matters if you cannot send proprietary code to a third-party endpoint.

Project status

MIT-licensed and maintained by the Semgrep team. The standalone semgrep/mcp repository has been archived and active development has moved into the main semgrep/semgrep repository — the server itself is still current, but check the main repository for the latest changes.

Related MCP Servers

MCP: deja-vu

by Vladislav Shulcz

New

Indexes the coding-agent sessions already sitting on your disk — months of history from before you installed it — and serves them back over MCP. 3.5 GB searched in ~1.5 ms, no LLM, no embeddings.

Developer ToolsDatabases & Data

MCP: Azure DevOps MCP Server

by Microsoft

New

Microsoft's official MCP server for Azure DevOps - work items, repos, pipelines, wikis, test plans and iterations, reachable from any MCP client in plain language.

Developer Tools