Semgrep MCP Server

Example Use Cases

• 1

  Scan code (including generated code) for security vulnerabilities using Semgrep rules and return deterministic findings.

• 2

  Generate, test, and apply custom Semgrep rules programmatically to enforce project-specific security or quality checks.

• 3

  Retrieve Semgrep AppSec Platform findings, rule schemas, or AST representations to inform remediation or code understanding workflows.

Description

This MCP server provides tools to run Semgrep scans, create and apply custom Semgrep rules, output ASTs, and fetch findings from the Semgrep AppSec Platform. It supports multiple MCP transports (stdio, SSE, streamable HTTP) and integrates with Cursor, VS Code, ChatGPT, Claude, and other MCP-capable clients. The server is distributed as a Python package and Docker container, enabling easy local or hosted deployment and automation within agent workflows.