Skip to content
Semgrep MCP

Semgrep MCP

by Semgrep
Released
7 views
MIT
Repository Docs
Developer Tools

Summary

Semgrep's official MCP server — scan code for security vulnerabilities, write and test custom rules, and pull findings from Semgrep Cloud, from inside an agent session.

Features

  • Scans code for security vulnerabilities against Semgrep's registry rulesets
  • Runs agent-authored custom rules without leaving the session
  • Exposes the parsed AST so an agent can see what a rule actually matches
  • Reads findings from the Semgrep Cloud Platform for connected projects
  • Runs locally via uvx or Docker so source never leaves your machine
  • Hosted endpoint available at mcp.semgrep.ai for zero-install use

Installation

Set up this MCP server in your favorite AI agent — copy a ready-made configuration below.

Any MCP-compatible agent

Most agents (Claude, Cursor, Windsurf, VS Code, and more) read a standard mcpServers configuration.

  1. Open your agent's MCP configuration file.
  2. Merge the snippet below into it.
  3. Restart the agent — the "Semgrep MCP" tools will be available.
{
  "mcpServers": {
    "semgrep-mcp": {
      "command": "uvx",
      "args": [
        "semgrep-mcp"
      ]
    }
  }
}

Description

Semgrep MCP puts static analysis in the loop while code is being written rather than after it is pushed. Semgrep is a fast, rules-based scanner that matches patterns against a parsed syntax tree, so it understands code structure instead of grepping text — and an agent that can call it gets a real second opinion on the code it just generated.

Tools it exposes
  • `security_check` — a quick pass over a snippet or file for common vulnerability classes.
  • `semgrep_scan` — a full scan against the registry rulesets.
  • `semgrep_scan_with_custom_rule` — run a rule the agent just wrote, which makes iterating on a custom rule a conversation rather than a file-edit-rerun loop.
  • `get_abstract_syntax_tree` — dump the parsed AST, useful when the agent is authoring a rule and needs to see what it is matching against.
  • `semgrep_findings` — read findings from the Semgrep Cloud Platform for a connected project.
  • Supporting tools for supported languages and the rule schema.
Ways to run it

Local stdio via uvx semgrep-mcp (PyPI package semgrep-mcp), a container at ghcr.io/semgrep/mcp, or Semgrep's hosted endpoint at https://mcp.semgrep.ai/mcp. The local paths keep source code on your machine, which matters if you cannot send proprietary code to a third-party endpoint.

Project status

MIT-licensed and maintained by the Semgrep team. The standalone semgrep/mcp repository has been archived and active development has moved into the main semgrep/semgrep repository — the server itself is still current, but check the main repository for the latest changes.

Related MCP Servers

MCP: Mux MCP Server

by Mux

New

Official MCP server for the Mux video API, built on a code-execution scheme: the agent writes TypeScript against the SDK and runs it in a Deno sandbox.

Developer Tools
2 views

MCP: ripwire

by Red Hat

New

Red Hat's zero-dependency C++23 code-context engine — ranked call graphs and blast-radius analysis, indexing a repo in under half a second with no server and no database.

Developer Tools
3 views

MCP: Graft

by Trail

New

Builds a searchable markdown graph of your repo so coding agents stop re-exploring it on every task — reported 42% fewer tokens and 46% fewer tool calls.

Developer Tools
1 views

MCP: Expo MCP Server

by Expo

New

Expo's official remote MCP server — searches Expo docs, installs compatible SDK packages, triggers and monitors EAS builds, and drives iOS/Android simulators.

Developer Tools
2 views
Browse all MCP servers →