Semgrep MCP Server

The Semgrep MCP server is an official Model Context Protocol integration from Semgrep that lets LLMs and AI coding assistants run Semgrep static analysis against code. It exposes Semgrep's scanning engine, rule registry, and AppSec Platform findings as MCP tools, so an agent can detect vulnerabilities, generate ASTs, fetch rule schemas, and even draft custom Semgrep rules on the fly.

The server supports stdio, streamable HTTP, and legacy SSE transports, and can be run locally via uvx semgrep-mcp or Docker, or used as a hosted remote server at https://mcp.semgrep.ai/mcp. With a SEMGREP_APP_TOKEN, it can also pull findings from the Semgrep AppSec Platform for organizations using Semgrep Cloud.

Note: the original standalone semgrep/mcp repository was archived on October 28, 2025. Development has moved into the main semgrep/semgrep repository, and the MCP server now ships as part of the official Semgrep binary. The README and tool surface described here remain the canonical reference for usage.

Tools

Install

The server is distributed as the semgrep-mcp Python package and as a Docker image.

# Run via uv (recommended)
uvx semgrep-mcp

# Or via Docker
docker run -i --rm ghcr.io/semgrep/mcp -t stdio

Claude Desktop

Add to ~/.config/Claude/claude_desktop_config.json (or the platform equivalent):

{
  "mcpServers": {
    "semgrep": {
      "command": "uvx",
      "args": ["semgrep-mcp"]
    }
  }
}

Cursor

Add to ~/.cursor/mcp.json or .cursor/mcp.json in your project:

{
  "mcpServers": {
    "semgrep": {
      "command": "uvx",
      "args": ["semgrep-mcp"],
      "env": {
        "SEMGREP_APP_TOKEN": "<your-token>"
      }
    }
  }
}

VS Code

Add to user settings or .vscode/mcp.json:

{
  "mcp": {
    "servers": {
      "semgrep": {
        "command": "uvx",
        "args": ["semgrep-mcp"]
      }
    }
  }
}

Hosted remote server

To use the Semgrep-hosted endpoint instead of running locally:

{
  "mcpServers": {
    "semgrep": {
      "type": "streamable-http",
      "url": "https://mcp.semgrep.ai/mcp"
    }
  }
}

Authentication

Set SEMGREP_APP_TOKEN to enable AppSec Platform features (the semgrep_findings tool). Generate a token at semgrep.dev under Settings, Tokens. Local scanning with default rules works without a token.

Transports

The server supports stdio (default), streamable-http (JSON RPC over HTTP on port 8000), and legacy sse. Override host and port with the FASTMCP_* environment variables.

• Run a security scan of the current file or repo from inside Cursor or Claude Code before opening a PR.
• Triage Semgrep AppSec Platform findings conversationally, pulling open issues by repo, severity, or rule.
• Have the agent draft a new Semgrep YAML rule against an example of a vulnerable pattern, then validate it with a scan.
• Generate an abstract syntax tree of a function to reason about complex code transformations or rule authoring.
• Fetch the rule schema and registry rules so the LLM can write syntactically valid custom rules without guessing.

• "Run a Semgrep security_check on the files I just modified and summarize any high-severity findings."
• "Write a custom Semgrep rule that flags use of eval in our Python code, then scan src/ with it."
• "Pull all open Semgrep findings of severity ERROR for the payments-api repo from the AppSec Platform."
• "Show me the Semgrep AST for this Go function so we can discuss a refactor."
• "What languages does Semgrep support, and which of our project's files would it cover?"

• Official Semgrep project, with a hosted remote endpoint and multiple distribution options (uvx, Docker).
• Covers both local scanning and cloud platform findings, plus rule schema access for LLM-assisted rule writing.
• Works with the full Semgrep rule registry (5,000+ rules) across many languages with no extra setup.
• Supports stdio, streamable HTTP, and SSE transports, so it fits both desktop clients and remote agent setups.

• The standalone semgrep/mcp repository was archived on October 28, 2025; updates now ship inside the main semgrep binary, which can be confusing for users following the old repo.
• AppSec Platform features (semgrep_findings) require a Semgrep account and SEMGREP_APP_TOKEN.
• Marked as a beta project, so tool surface and transports may still change.

• SonarQube MCP server for SonarQube/SonarCloud code quality and security analysis.
• Snyk MCP integrations for SCA and SAST findings from the Snyk platform.
• GitHub MCP server for surfacing CodeQL alerts and Dependabot findings.