Semgrep's MCP server lets AI assistants scan code with Semgrep's static analysis rules to find and fix security issues. It is now built into the official semgrep binary and launched with `semgrep mcp`; the earlier standalone semgrep/mcp repository is archived. Findings from the Semgrep AppSec Platform require authentication.
Connect
- 1Add the server to Codex
codex mcp add semgrep -- semgrep mcp
Configs are generated from the publisher's documented endpoint. Check their docs for plan requirements and scopes. New to this? Read the step-by-step tutorial.
Tools 6
security_checksemgrep_scansemgrep_scan_with_custom_ruleget_abstract_syntax_treesemgrep_findingssupported_languagesThings to ask
- “Scan this file for security vulnerabilities”
- “Run a security check on the code you just wrote”
- “Write a custom Semgrep rule to find uses of eval and scan the repo”
- “Show my open Semgrep findings”