Name: Semgrep MCP Server
Author: Semgrep

The Semgrep MCP server now ships inside the Semgrep CLI as the semgrep mcp command, so Claude can scan files or code snippets with Semgrep's rules, write custom rules and explain or fix what it finds. Adding a Semgrep AppSec Platform token brings in your organization's existing findings, and Semgrep's Guardian plugin for Claude Code wraps the same server with hooks that scan every file Claude writes.

Who it is for

Developers who want security checks on AI-written code
Application security engineers
Teams already using Semgrep in CI

Prompts to try

Once it is connected, ask in plain words. Claude decides when to use the server and asks before it changes anything important.

Prompt 1

Scan the src folder for security issues and fix anything rated high.

Prompt 2

Write a Semgrep rule that flags SQL queries built with string concatenation, then run it on this repo.

Prompt 3

Show the open Semgrep findings for this project and suggest fixes for the top three.

How to connect it

In Claude Code

$claude mcp add --transport stdio semgrep -- semgrep mcp

In the Claude desktop app

Add this to claude_desktop_config.json, then restart the app:

json

{
  "mcpServers": {
    "semgrep": {
      "command": "semgrep",
      "args": [
        "mcp"
      ]
    }
  }
}

Good to know

Install the Semgrep CLI first (for example brew install semgrep). For Claude Code, Semgrep now recommends its Guardian plugin, which bundles this server with automatic scans.

Unlock the setup steps

Free. Leave your email once to open the setup steps for all 150 servers, and get the best new connectors each month.

How we checked it

Checked the MCP folder in the semgrep/semgrep repo (LGPL-2.1, last change 2026-08, CLI release 1.181.0 in 2026-10), the archived semgrep/mcp repo that points there and Semgrep's Guardian docs for Claude Code.

Source: github.com/semgrep/semgrep/tree/develop/cli/src/semgrep/mcp

Semgrep MCP Server