Semgrep MCP

Name: Semgrep MCP
Author: Semgrep

by Semgrep

Enable AI agents to secure code with Semgrep SAST scanning and pattern matching

security Python Intermediate Self-hostable Verified

⭐ 200 stars 📅 Updated: 1mo ago

View on GitHub View package

Description

Official Semgrep MCP server that lets AI agents run static analysis security testing directly on your code. Powered by Semgrep's pattern-matching engine, it enables code scanning for vulnerabilities, bug patterns, and style enforcement using Semgrep's extensive rule library with 3,000+ community and pro rules. AI assistants can scan code, retrieve findings with contextual explanations, search for specific patterns, and help fix issues — all without leaving the conversation. Supports custom rules alongside the Semgrep Registry, making it adaptable to team-specific coding standards and security policies.

✅ Best for

Development teams wanting AI-assisted security scanning integrated into their coding workflow

⏭️ Skip if

You need deep data-flow analysis or already use a different SAST tool you prefer

💡 Use cases

Scanning code for security vulnerabilities and bug patterns during AI-assisted development
Finding specific code patterns using Semgrep's pattern syntax via natural language
Getting AI-generated explanations and fix suggestions for security findings
Enforcing coding standards and security policies through automated scanning

👍 Pros

✓ Official Semgrep project with access to 3,000+ security and code quality rules
✓ Fast pattern-matching engine that works across 30+ programming languages
✓ Supports custom rules for team-specific standards alongside the Semgrep Registry
✓ AI provides contextual explanations and fix suggestions for each finding

👎 Cons

✗ Requires a Semgrep token for full rule access (free tier available)
✗ Pattern-based analysis may miss complex vulnerabilities requiring data flow tracking
✗ Scanning large codebases may take significant time depending on rule set

🔧 Exposed tools (4 tools)

Tool	Category	Description
scan_code	analysis	Run Semgrep scan on code files or directories
list_rules	configuration	List available Semgrep rules and rulesets
get_findings	results	Retrieve scan findings with code context and severity
search_patterns	search	Search for specific code patterns using Semgrep pattern syntax

⚡ Installation

Prerequisites:

• python v3.10+
• Semgrep token (from semgrep.dev)
• API key required

Check Claude Code documentation to configure this MCP server.

💡 Tips & tricks

Start with Semgrep's default ruleset (p/default) for broad coverage. Ask the AI to scan specific files or directories rather than the entire repo for faster results.

🔄 Alternatives

SonarQube MCP

AI-assisted code quality analysis and security scanning powered by SonarQube

Similar functionality

code-sentinel

MCP server — editorial content pending