This is the recommended method for Claude Desktop and other MCP clients as it handles all dependencies and configuration automatically.

# Using npm npm install -g mcp-server-semgrep # Using pnpm pnpm add -g mcp-server-semgrep # Using yarn yarn global add mcp-server-semgrep

The package is also available on other registries:

# Using npm npm install -g git+https://github.com/vetcoders/mcp-server-semgrep.git # Using pnpm pnpm add -g git+https://github.com/vetcoders/mcp-server-semgrep.git # Using yarn yarn global add git+https://github.com/vetcoders/mcp-server-semgrep.git

git clone https://github.com/vetcoders/mcp-server-semgrep.git cd mcp-server-semgrep

- Install dependencies (supports all major package managers):

# Using pnpm (recommended) pnpm install # Using npm npm install # Using yarn yarn install

# Using pnpm pnpm run build # Using npm npm run build # Using yarn yarn build

Note: The installation process will automatically check for Semgrep availability. If Semgrep is not found, you'll receive instructions on how to install it.

This server only reads and writes files inside explicitly allowed workspace roots.

- By default, the allowed root is the process working directory (process.cwd()).
- For Claude Desktop, Smithery, or any launcher that does not start the server inside your project root, setMCP_SERVER_SEMGREP_ALLOWED_ROOTSto one or more absolute directories.
- Use your platform path delimiter for multiple roots::on macOS/Linux,;on Windows.

This server does not implement its own Semgrep account handling. It shells out to the installedsemgrepCLI and relies on Semgrep's normal authentication behavior.

- Local terminal and local development runs can often use an existingsemgrep loginsession from the current OS account.
- Managed launches such as Claude Desktop, Smithery, containers, or CI should prefer an explicitSEMGREP_APP_TOKENfor deterministic behavior.
- SEMGREP_APP_TOKENis still the safest option when you need portable configuration across machines or runners.

Semgrep can be installed in several ways:

# Using pnpm pnpm add -g semgrep # Using npm npm install -g semgrep # Using yarn yarn global add semgrep

sudo apt-get install semgrep # or curl -sSL https://install.semgrep.dev | sh

There are two ways to integrate MCP Server Semgrep with Claude Desktop:

Method 1 Install Via Smithery Ai Recommended

For local launches started under a user account that is already authenticated withsemgrep login, the Semgrep CLI may be able to reuse that login. For desktop-managed or shared environments, we still recommend settingSEMGREP_APP_TOKENexplicitly:

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning with Cycode.

Enable AI agents to secure code with Semgrep.

AI-powered code quality analysis to detect best practice violations, security issues, and architectural problems in real-time.

AI-powered security scanning. Scans code, files, and git diffs for vulnerabilities in real-time using the Armis scanning API.

Access the Codacy API to analyze code quality, coverage, and security for your repositories.

MCP Server for local code security scanning - detects secrets, vulnerable dependencies, and insecure code patterns

Provides AI agents with access to development best practices, security guidelines, and coding standards.

Scans projects for secret exposure risks in .env files and logs

Strict AI code reviewer powered by Groq. Finds bugs, SQL injections, hardcoded secrets and vulnerabilities. Scores code 0–100 with concrete fixes.