# Semgrep (MCP Server)

> Scan AI-generated code for security vulnerabilities with Semgrep

- Type: MCP server
- Publisher: Semgrep (official)
- Categories: Security, Development
- Website: https://docs.semgrep.dev/semgrep-guardian/ide-setup/vscode
- Source: https://github.com/semgrep/mcp
- Transport: stdio
- Launch command: semgrep mcp
- Sign-in: none
- GitHub stars: 687
- Listed: 2025-04-01

## About

Semgrep's MCP server lets AI assistants scan code with Semgrep's static analysis rules to find and fix security issues. It is now built into the official semgrep binary and launched with `semgrep mcp`; the earlier standalone semgrep/mcp repository is archived. Findings from the Semgrep AppSec Platform require authentication.

## Install

1. **Add the server to Codex**

   Codex CLI:

   ```bash
   codex mcp add semgrep -- semgrep mcp
   ```

   config.toml:

   ```toml
   [mcp_servers.semgrep]
   command = "semgrep"
   args = ["mcp"]
   ```

   Agents SDK:

   ```python
   from agents import Agent, Runner
   from agents.mcp import MCPServerStdio
   
   async with MCPServerStdio(
       name="Semgrep",
       params={"command": "semgrep", "args": ["mcp"]},
   ) as server:
       agent = Agent(name="Assistant", mcp_servers=[server])
       result = await Runner.run(agent, "Scan this file for security vulnerabilities")
       print(result.final_output)
   ```

## Tools

- `security_check`
- `semgrep_scan`
- `semgrep_scan_with_custom_rule`
- `get_abstract_syntax_tree`
- `semgrep_findings`
- `supported_languages`

## Example prompts

- "Scan this file for security vulnerabilities"
- "Run a security check on the code you just wrote"
- "Write a custom Semgrep rule to find uses of eval and scan the repo"
- "Show my open Semgrep findings"

## Related

- [Chrome DevTools MCP](https://chatgptplugins.directory/mcp/chrome-devtools.md): Let coding agents control and debug a live Chrome browser
- [Playwright MCP](https://chatgptplugins.directory/mcp/playwright.md): Browser automation for agents via Playwright accessibility snapshots
- [GitHub](https://chatgptplugins.directory/mcp/github.md): Manage repos, issues, pull requests and Actions from your AI agent
- [Context7](https://chatgptplugins.directory/mcp/context7.md): Pull up-to-date, version-specific library docs into your coding agent
- [Supabase](https://chatgptplugins.directory/mcp/supabase.md): Manage Supabase databases, migrations, edge functions and logs
- [Stripe](https://chatgptplugins.directory/mcp/stripe.md): Query and act on your Stripe account and search Stripe docs from any agent

---
Source: https://chatgptplugins.directory/mcp/semgrep · Index: https://chatgptplugins.directory/llms.txt · Independent and community-run. Not affiliated with or endorsed by OpenAI. ChatGPT is a trademark of OpenAI.