Mcp Semgrep Scanner
About
Curated by Archimedes Market. Static security analysis exposed as MCP tools. OWASP top 10, secrets detection, custom rule packs. Baseline scanning focuses on newly-introduced findings. Built for production-grade security review. → archimedes.market/assets/21c4a8ab-80dc-4a69-8444-
Details
- Author
- archimedes-market
- Downloads
- 331
- Categories
- Developer Tools, Security
Jump to
- Run Semgrep static analysis from an AI agent.
- Surface OWASP top-10 findings.
- Detect secrets and supply-chain issues.
- Apply custom rule packs.
- Baseline scanning reduces noise on new findings.
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Mcp Semgrep ScannerCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Configure the server in your MCP client to run Semgrep scanning commands. The server handles baseline scanning to focus results on new findings.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"mcp semgrep scanner": {
"semgrep-scanner": {
"command": "mcp-semgrep-scanner",
"args": [
"serve"
]
}
}
}
}
McpServers
{
"semgrep-scanner": {
"command": "mcp-semgrep-scanner",
"args": [
"serve"
]
}
}
Content:

Verified asset on Archimedes
Market.
---
Run Semgrep static analysis from an AI agent. Surface OWASP top-10 findings, secrets, supply-chain issues,
custom rule packs. Baseline scanning focuses output on newly-introduced findings so the noise floor stays low.
## License
MIT. Browse the full catalog at archimedes.market/assets.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.





