Semgrep

⚠️ The Semgrep MCP server has been moved from a standalone repo to themainsemgreprepository!⚠️

A Model Context Protocol (MCP) server for usingSemgrepto scan code for security vulnerabilities. Secure yourvibe coding! 😅

Model Context Protocol (MCP)is a standardized API for LLMs, Agents, and IDEs like Cursor, VS Code, Windsurf, or anything that supports MCP, to get specialized help, get context, and harness the power of tools. Semgrep is a fast, deterministic static analysis tool that semantically understands manylanguagesand comes with over5,000 rules. 🛠️

[!NOTE] This beta project is under active development. We would love your feedback, bug reports, feature requests, and code. Join the#mcpcommunity Slackchannel!

- Semgrep MCP Server

- Contents
- Getting started

- Cursor
- ChatGPT
- Hosted Server

- Cursor

- Tools

- Scan Code
- Understand Code
- Cloud Platform (login and Semgrep token required)
- Meta

- Standard Input/Output (stdio)

- Python
- Docker

- Cursor IDE
- VS Code / Copilot

- Manual Configuration
- Using Docker

- Similar tools 🔍
- Community projects 🌟
- MCP server registries

Run thePython packageas a CLI command usinguv:

uvx semgrep-mcp # see --help for more options

docker run -i --rm ghcr.io/semgrep/mcp -t stdio

{ "mcpServers": { "semgrep": { "command": "uvx", "args": ["semgrep-mcp"], "env": { "SEMGREP_APP_TOKEN": "<token>" } } } }

Add an instruction to your.cursor/rulesto use automatically:

Always scan code generated using Semgrep for security vulnerabilities

- Go to theConnector Settingspage (direct link)
- Namethe connectionSemgrep
- SetMCP Server URLtohttps://mcp.semgrep.ai/sse
- SetAuthenticationtoNo authentication
- Check theI trust this applicationcheckbox
- ClickCreate

[!WARNING]mcp.semgrep.aiis an experimental server that may break unexpectedly. It will rapidly gain new functionality.🚀
- Cmd + Shift + Jto open Cursor Settings
- SelectMCP Tools
- ClickNew MCP Server.
-

{ "mcpServers": { "semgrep": { "type": "streamable-http", "url": "https://mcp.semgrep.ai/mcp" } } }

This Python package is published to PyPI assemgrep-mcpand can be installed and run withpip,pipx,uv,poetry, or any Python package manager.

$ pipx install semgrep-mcp $ semgrep-mcp --help Usage: semgrep-mcp [OPTIONS] Entry point for the MCP server Supports both stdio and sse transports. For stdio, it will read from stdin and write to stdout. For sse, it will start an HTTP server on port 8000. Options: -v, --version Show version and exit. -t, --transport [stdio|sse] Transport protocol to use (stdio or sse) -h, --help Show this message and exit.

The stdio transport enables communication through standard input and output streams. This is particularly useful for local integrations and command-line tools. See thespecfor more details.

This server is published to Github's Container Registry (ghcr.io/semgrep/mcp)

docker run -i --rm ghcr.io/semgrep/mcp -t stdio

By default, the Docker container is inSSEmode, so you will have to include-t stdioafter the image name and run with-ito run ininteractivemode.

Streamable HTTP enables streaming responses over JSON RPC via HTTP POST requests. See thespecfor more details.

By default, the server listens on127.0.0.1:8000/mcpfor client connections. To change any of this, setFASTMCP_environment variables.The server must be running for clients to connect to it.

docker run -p 8000:0000 ghcr.io/semgrep/mcp

By default, the server listens on127.0.0.1:8000/ssefor client connections. To change any of this, setFASTMCP_environment variables.The server must be running for clients to connect to it.

docker run -p 8000:0000 ghcr.io/semgrep/mcp -t sse

Optionally, to connect to Semgrep AppSec Platform:
- Loginor sign up
- Generate a token fromSettings
- Add the token to your environment variables:

"env": { "SEMGREP_APP_TOKEN": "<token>" }

[!TIP] Pleasereach out for supportif needed. ☎️

{ "mcpServers": { "semgrep": { "command": "uvx", "args": ["semgrep-mcp"] } } }

Click the install buttons at the top of this README for the quickest installation.

Add the following JSON block to your User Settings (JSON) file in VS Code. You can do this by pressingCtrl + Shift + Pand typingPreferences: Open User Settings (JSON).

{ "mcp": { "servers": { "semgrep": { "command": "uvx", "args": ["semgrep-mcp"] } } } }

Optionally, you can add it to a file called.vscode/mcp.jsonin your workspace:

{ "servers": { "semgrep": { "command": "uvx", "args": ["semgrep-mcp"] } } }

{ "mcp": { "servers": { "semgrep": { "command": "docker", "args": [ "run", "-i", "--rm", "ghcr.io/semgrep/mcp", "-t", "stdio" ] } } } }

Add the following JSON block to your~/.codeium/windsurf/mcp_config.jsonfile:

{ "mcpServers": { "semgrep": { "command": "uvx", "args": ["semgrep-mcp"] } } }

Here is ashort videoshowing Claude Desktop using this server to write a custom rule.

{ "mcpServers": { "semgrep": { "command": "uvx", "args": ["semgrep-mcp"] } } }

- https://platform.openai.com/docs/mcp
- https://platform.openai.com/docs/guides/tools-remote-mcp

async with MCPServerStdio( params={ "command": "uvx", "args": ["semgrep-mcp"], } ) as server: tools = await server.list_tools()

SeeOpenAI Agents SDK docsfor more info.

See a full example inexamples/sse_client.py

from mcp.client.session import ClientSession from mcp.client.sse import sse_client async def main(): async with sse_client("http://localhost:8000/sse") as (read_stream, write_stream): async with ClientSession(read_stream, write_stream) as session: await session.initialize() results = await session.call_tool( "semgrep_scan", { "code_files": [ { "path": "hello_world.py", "content": "def hello(): print('Hello, World!')", } ] }, ) print(results)

[!TIP] Some client libraries want theURL:[http://localhost:8000/sseand others only want theHOST:localhost:8000. Try out theURLin a web browser to confirm the server is running, and there are no network issues.