Semgrep MCP server
by Semgrep
Scan code for security vulnerabilities with Semgrep rules.
What it can do
- Scan code
- Run custom rules
- Fetch findings
- Get syntax trees
Through MCP1, every tool call is checked against your groups and rules, and recorded in the audit log.
How it connects
Authenticate with Semgrep and approve MCP1. No token to copy; MCP1 keeps the connection sealed and refreshes it.
- Endpoint
https://mcp.semgrep.ai/mcp- Transport
- Streamable HTTP
- Docs
- github.com
With MCP1
Semgrep for the whole team, behind one URL
- 01
Install it once
An admin adds Semgrep from the MCP1 catalog. Its authentication or token stays sealed in MCP1, never on a laptop.
- 02
Decide who gets what
Open it to groups, fully or read-only, and set rules per tool. Destructive tools can need an admin.
- 03
Connect any client
Claude, Cursor, ChatGPT, Codex and the rest connect one gateway URL and sign in with their own account.
More for security & it
See all security & it servers- GitHubEngineering
Repositories, issues, pull requests, code search and Actions.
Token - CloudflareEngineering
The whole Cloudflare API: Workers, DNS, R2, zones and more.
One-click auth - DatadogEngineering
Logs, metrics, traces, monitors and incidents in Datadog.
One-click auth - ClerkEngineering
Clerk SDK snippets plus your apps, users and organizations.
One-click authBeta - WorkOSEngineering
Manage your WorkOS workspace: users, orgs, SSO and directories.
One-click auth - ngrokEngineering
Manage ngrok endpoints, domains, traffic policies and credentials.
TokenPreview
